osixia/container-openldap

To deploy OpenLDAP to a Kubernetes cluster using local YAML files, follow these steps:

1. Generate the initial example files: make example
2. Edit the YAML files located in the environment directory to set your desired parameters.
3. Generate the secret file from your environment configuration: make ldap-secret.yaml
4. Deploy the generated secret to Kubernetes: kubectl apply -f ldap-secret.yaml
5. Deploy the OpenLDAP deployment manifest: kubectl apply -f ldap-deployment.yaml
6. Deploy the OpenLDAP service manifest: kubectl apply -f ldap-service.yaml

To add custom LDIF files for the OpenLDAP bootstrap process without overwriting the image's default bootstrap LDIF files, you can place your files in the /container/service/slapd/assets/config/bootstrap/ldif/custom directory.

At runtime, you can achieve this by mounting a data volume containing your LDIF files to that specific path.

To avoid passing passwords in clear text via environment variables, you can use the _FILE suffix. This instructs the startup script to load the value from a file. This is supported for LDAP_ADMIN_PASSWORD, LDAP_CONFIG_PASSWORD, and LDAP_READONLY_USER_PASSWORD.

docker run \
	--env LDAP_ORGANISATION="My company" \
	--env LDAP_DOMAIN="my-company.com" \
	--env LDAP_ADMIN_PASSWORD_FILE=/run/secrets/ \
	authentication_admin_pw \
	detach osixia/openldap:1.2.4

To ensure your schema and data are saved outside the container, map the following host directories to the container volumes:

• /var/lib/ldap (LDAP database files)
• /etc/ldap/slapd.d (LDAP config files)

Note: The default database backend is mdb. To use a different backend, set the LDAP_BACKEND environment variable.

docker run \
	--volume /data/slapd/database:/var/lib/ldap \
	--volume /data/slapd/config:/etc/ldap/slapd.d \
	--detach osixia/openldap:1.5.0

You can mount custom environment files into the container. To ensure they are processed before the default files, link your files to a directory named with a prefix less than 99 (e.g., /container/environment/01-custom).

Warning: The container attempts to delete *.startup.yaml files after the first startup. To prevent the files from being deleted on your host machine, mount the volume as read-only (:ro) or use standard .yaml files instead of .startup.yaml.

# Mounting a directory of environment files
docker run \
	--volume /data/ldap/environment:/container/environment/01-custom \
	detach osixia/openldap:1.5.0

# Mounting a specific file as read-only to prevent deletion
docker run \
	--volume /data/ldap/environment/my-env.yaml:/container/environment/01-custom/env.yaml:ro \
	detach osixia/openldap:1.5.0

To enable TLS, you must provide a TLS server certificate, a private key, and an optional CA certificate. You can do this by placing the files in the /container/service/slapd/assets/certs directory within the container.

When running the container via Docker, mount a local data volume containing these files to the following path inside the container: /container/service/slapd/assets/certs