fukuops/k8s/charts/lldap

lldap

Lightweight LDAP authentication server with a web UI.

TL;DR

helm install lldap oci://git.roboces.dev/catalin/fukuops/lldap --version 1.0.0 -n apps-roboces

Prerequisites

• Kubernetes 1.19+
• Helm 3+
• A NFS storage class (default: truenas-nfs-csi) - only if persistence is enabled
• An existing Secret with credentials (see lldap.secret.existingSecretName)

Configuration

All values are nested under the lldap: key. Example:

lldap:
  service:
    type: LoadBalancer
    httpPort: 17170
    ldapPort: 3890
  config:
    ldapBaseDn: "dc=example,dc=com"
    httpUrl: "https://lldap.example.com"
  persistence:
    enabled: true
    storageClass: "truenas-nfs-csi"
    accessMode: ReadWriteMany
    size: 10Gi
  secret:
    existingSecretName: lldap-secrets

Secret Requirements

The secret must contain the following keys:

• LLDAP_JWT_SECRET - JWT signing secret (generate with openssl rand -base64 32)
• LLDAP_KEY_SEED - Key seed for password hashing (generate with openssl rand -base64 32)
• LLDAP_LDAP_USER_PASS - Admin password for LDAP and web UI

Example secret:

apiVersion: v1
kind: Secret
metadata:
  name: lldap-secrets
type: Opaque
stringData:
  LLDAP_JWT_SECRET: <your-jwt-secret>
  LLDAP_KEY_SEED: <your-key-seed>
  LLDAP_LDAP_USER_PASS: <your-admin-password>

Values Reference

Key	Type	Default	Description
lldap.replicaCount	int	1	Number of replicas
lldap.image.repository	string	lldap/lldap	Image repository
lldap.image.pullPolicy	string	IfNotPresent	Image pull policy
lldap.image.tag	string	stable	Image tag
lldap.service.type	string	LoadBalancer	Service type
lldap.service.httpPort	int	17170	Web UI port
lldap.service.ldapPort	int	3890	LDAP port
lldap.config.ldapBaseDn	string	dc=example,dc=com	LDAP base DN
lldap.config.httpUrl	string	https://lldap.example.com	Public URL for web UI
lldap.config.databaseUrl	string	""	Database URL (empty = SQLite)
lldap.config.verbose	bool	false	Enable verbose logging
lldap.ldaps.enabled	bool	false	Enable LDAPS
lldap.ldaps.certFile	string	""	TLS certificate file path
lldap.ldaps.keyFile	string	""	TLS key file path
lldap.smtp.enabled	bool	false	Enable SMTP for password reset
lldap.smtp.enablePasswordReset	bool	false	Enable password reset via email
lldap.smtp.server	string	""	SMTP server
lldap.smtp.port	int	465	SMTP port
lldap.smtp.encryption	string	"TLS"	SMTP encryption (NONE, TLS, STARTTLS)
lldap.smtp.user	string	""	SMTP username
lldap.smtp.fromAddress	string	""	From email address
lldap.smtp.fromName	string	""	From name
lldap.smtp.replyTo	string	""	Reply-to address
lldap.persistence.enabled	bool	false	Enable persistence
lldap.persistence.storageClass	string	truenas-nfs-csi	Storage class
lldap.persistence.accessMode	string	ReadWriteMany	Access mode
lldap.persistence.size	string	1Gi	PVC size
lldap.secret.existingSecretName	string	""	Existing secret name
lldap.debug.enabled	bool	false	Enable debug mode
lldap.resources	object	{}	Container resources
lldap.livenessProbe	object	(see values.yaml)	Liveness probe
lldap.readinessProbe	object	(see values.yaml)	Readiness probe
lldap.nodeSelector	object	{}	Node selector
lldap.tolerations	array	[]	Tolerations
lldap.affinity	object	{}	Affinity rules

Database

By default, lldap uses SQLite stored in /data. To use an external database:

lldap:
  config:
    databaseUrl: "mysql://user:password@mysql-server/my-database"

Supported databases: SQLite (default), MySQL/MariaDB, PostgreSQL.

Persistence

When persistence is enabled, a PVC named lldap-data is created. The PVC uses the truenas-nfs-csi storage class by default with ReadWriteMany access mode.

Troubleshooting

Debug Mode

Enable debug mode to troubleshoot issues:

lldap:
  debug:
    enabled: true

Pod not starting

kubectl get pvc -n apps-roboces -l app.kubernetes.io/name=lldap

Check logs

kubectl logs lldap-0 -n apps-roboces

Verify configmap

kubectl get configmap lldap-config -n apps-roboces -o yaml

Default Credentials

If no secret is provided, the default admin password is password. Change this immediately in production.