41ca29024e
- Add OpenLDAP deployment with persistent storage - Configure OpenCloud to use external LDAP for user/group storage - Exclude internal IDM service (using external LDAP instead) - Keep Pocket ID OIDC for authentication - Add LDAP directory initialization structure - Add comprehensive deployment guide Architecture: - External OpenLDAP (ldap://openldap.opencloud.svc:389) - Pocket ID OIDC (https://auth.basicstack.de) - Auto-provision users on first OIDC login to LDAP - Users: ou=users,dc=basicstack,dc=de - Groups: ou=groups,dc=basicstack,dc=de Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
27 lines
796 B
YAML
27 lines
796 B
YAML
---
|
|
# OpenLDAP Admin Credentials
|
|
# This is a PLACEHOLDER - you need to create the actual SealedSecret
|
|
#
|
|
# To create the sealed secret, run:
|
|
#
|
|
# kubectl create secret generic openldap-admin-secret \
|
|
# --namespace opencloud \
|
|
# --from-literal=admin-password='YOUR_SECURE_ADMIN_PASSWORD' \
|
|
# --from-literal=config-password='YOUR_SECURE_CONFIG_PASSWORD' \
|
|
# --dry-run=client -o yaml | \
|
|
# kubeseal --format yaml > openldap-admin-sealed.yaml
|
|
#
|
|
# Then replace this file with the output.
|
|
#
|
|
# LDAP Admin DN: cn=admin,dc=basicstack,dc=de
|
|
# LDAP Base DN: dc=basicstack,dc=de
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: openldap-admin-secret
|
|
namespace: opencloud
|
|
type: Opaque
|
|
stringData:
|
|
# REPLACE THESE WITH ACTUAL SEALED SECRET
|
|
admin-password: "CHANGE_ME"
|
|
config-password: "CHANGE_ME"
|