#171 - Allow setting up read only replicas

.bin/readonly.yaml

@@ -0,0 +1,30 @@
+persistence:
+  accessModes:
+  - ReadWriteOnce
+  enabled: true
+  size: 1Gi
+ltb-passwd:
+  enabled : false
+phpldapadmin:
+  enabled: false
+replicaCount: 3
+readOnlyReplicaCount: 1
+replication:
+  clusterName: cluster.local
+  enabled: true
+  interval: "00:00:00:10"
+  retry: 60
+  starttls: critical
+  timeout: 1
+  tls_reqcert: never
+initTLSSecret:
+  tls_enabled: true
+  secret: "custom-cert" 
+service:
+  ldapPortNodePort: 30389
+  sslLdapPortNodePort: 30636
+  type: NodePort
+serviceReadOnly:
+  ldapPortNodePort: 31389
+  sslLdapPortNodePort: 31636
+  type: NodePort

.github/workflows/ci-readonly.yml

@@ -0,0 +1,58 @@
+# WIP!
+name: Test readonly replica
+on:
+  workflow_call:
+jobs:
+  qualif:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Check out code
+      uses: actions/checkout@v1
+    - name: Run custom action
+      # Use the location in the repository (without action.yml)
+      uses: ./.github/actions/setup
+      with:
+        install-chaos: false
+    - name: setup certs
+      shell: bash
+      run: |
+        openssl req -x509 -newkey rsa:4096 -nodes -subj '/CN=example.com' -keyout tls.key -out tls.crt -days 365
+        cp tls.crt ca.crt
+        kubectl create secret generic custom-cert --from-file=./tls.crt --from-file=./tls.key --from-file=./ca.crt
+    - name: deploy openldap-stack-ha
+      shell: bash
+      run: |
+        cd "$GITHUB_WORKSPACE"
+        helm install openldap-stack-ha -f .bin/readonly.yaml .
+        kubectl rollout status sts openldap-stack-ha 
+    - name: verify deployment
+      shell: bash
+      run: |
+          echo "test access to openldap database"
+          sleep 10
+          LDAPTLS_REQCERT=never ldapsearch -x -D 'cn=admin,dc=example,dc=org' -w Not@SecurePassw0rd -H ldaps://localhost:30636 -b 'dc=example,dc=org'
+    - name: verify certs
+      shell: bash
+      run: |
+          echo "verify certificate"
+          echo | openssl s_client -showcerts -servername example.com -connect localhost:30636 2>/dev/null | openssl x509 -inform pem -noout -text > /tmp/test-cert.txt
+          if ! grep -q "CN = example.com" /tmp/test-cert.txt; then  echo exit 1; fi
+    - name: test write on main cluster
+      shell: bash
+      run: |
+          echo "Write test to openldap database"
+          LDAPTLS_REQCERT=never ldapadd -x -D 'cn=admin,dc=example,dc=org' -w Not@SecurePassw0rd -H ldaps://localhost:30636 -f  .bin/user.ldif
+          LDAPTLS_REQCERT=never ldapsearch -o nettimeout=20 -x -D 'cn=admin,dc=example,dc=org' -w Not@SecurePassw0rd -H ldaps://localhost:30636 -b 'dc=example,dc=org' > /tmp/test-write.txt
+          if ! grep  "Einstein" /tmp/test-write.txt; then echo 'no Einstein entry found' ; fi
+          if ! grep  "objectClass: ownCloud" /tmp/test-write.txt; then  echo 'no ownCloud entry found'; fi
+    - name: test memberOf on main cluster
+      shell: bash
+      run: |
+          echo "MemberOf test to openldap database"
+          LDAPTLS_REQCERT=never ldapsearch -o nettimeout=20 -x -D 'cn=admin,dc=example,dc=org' -w Not@SecurePassw0rd -H ldaps://localhost:30636 -b 'dc=example,dc=org' "(memberOf=cn=testgroup,ou=Group,dc=example,dc=org)" > /tmp/test-write.txt
+          if [ $(grep "numResponses" /tmp/test-write.txt | cut -d ":" -f 2 | tr -d ' ') -ne 2 ]; then exit 1 ; fi
+          if ! grep -q "uid=test1,ou=People,dc=example,dc=org" /tmp/test-write.txt; then  echo exit 1; fi
+    - name: test write on readonly replica
+      run: |
+          echo "Write test to openldap readonly replica"
+          LDAPTLS_REQCERT=never ldapadd -x -D 'cn=admin,dc=example,dc=org' -w Not@SecurePassw0rd -H ldaps://localhost:31636 -f .bin/user.ldif

.github/workflows/ci.yml

@@ -13,4 +13,6 @@ jobs:
   call-ci-other:
     uses: ./.github/workflows/ci-other.yml
   call-ci-ha:
-    uses: ./.github/workflows/ci-ha.yml
+    uses: ./.github/workflows/ci-ha.yml
+  call-ci-readonly:
+    uses: ./.github/workflows/ci-readonly.yml

templates/_helpers.tpl

@@ -61,6 +61,11 @@ Generate olcServerID list
     {{- $index1 := $index0 | add1 }}
     olcServerID: {{ $index1 }} ldap://{{ $name }}-{{ $index0 }}.{{ $name }}-headless.{{ $namespace }}.svc.{{ $cluster }}:1389
   {{- end -}}
+{{- $readonlyNodeCount := .Values.readOnlyReplicaCount | int }}
+  {{- range $index0 := until $readonlyNodeCount }}
+    {{- $index1 := $index0 | add $nodeCount | add 1 }}
+    olcServerID: {{ $index1 }} ldap://{{ $name }}-readonly-{{ $index0 }}.{{ $name }}-headless-readonly.{{ $namespace }}.svc.{{ $cluster }}:1389
+  {{- end -}}
 {{- end -}}
 
 {{/*
@@ -81,6 +86,11 @@ Generate olcSyncRepl list
     {{- $index1 := $index0 | add1 }}
     olcSyncRepl: rid=00{{ $index1 }} provider=ldap://{{ $name }}-{{ $index0 }}.{{ $name }}-headless.{{ $namespace }}.svc.{{ $cluster }}:1389 binddn="cn={{ $bindDNUser }},cn=config" bindmethod=simple credentials={{ $configPassword }} searchbase="cn=config" type=refreshAndPersist retry="{{ $retry }} +" timeout={{ $timeout }} starttls={{ $starttls }} tls_reqcert={{ $tls_reqcert }}
   {{- end -}}
+{{- $readonlyNodeCount := .Values.readOnlyReplicaCount | int }}
+  {{- range $index0 := until $readonlyNodeCount }}
+    {{- $index1 := $index0 | add $nodeCount | add 1 }}
+    olcSyncRepl: rid=00{{ $index1 }} provider=ldap://{{ $name }}-readonly-{{ $index0 }}.{{ $name }}-headless-readonly.{{ $namespace }}.svc.{{ $cluster }}:1389 binddn="cn={{ $bindDNUser }},cn=config" bindmethod=simple credentials={{ $configPassword }} searchbase="cn=config" type=refreshAndPersist retry="{{ $retry }} +" timeout={{ $timeout }} starttls={{ $starttls }} tls_reqcert={{ $tls_reqcert }}
+  {{- end -}}
 {{- end -}}
 
 {{/*
@@ -99,6 +109,7 @@ Generate olcSyncRepl list
 {{- $tls_reqcert := .Values.replication.tls_reqcert }}
 {{- $interval := .Values.replication.interval }}
 {{- $nodeCount := .Values.replicaCount | int }}
+{{- $readonlyNodeCount := .Values.readOnlyReplicaCount | int }}
   {{- range $index0 := until $nodeCount }}
     {{- $index1 := $index0 | add1 }}
     olcSyncrepl:
@@ -116,6 +127,23 @@ Generate olcSyncRepl list
       starttls={{ $starttls }}
       tls_reqcert={{ $tls_reqcert }}
   {{- end -}}
+  {{- range $index0 := until $readonlyNodeCount }}
+    {{- $index1 := $index0 | add $nodeCount | add 1 }}
+    olcSyncrepl:
+      rid=10{{ $index1 }}
+      provider=ldap://{{ $name }}-readonly-{{ $index0 }}.{{ $name }}-headless-readonly.{{ $namespace }}.svc.{{ $cluster }}:1389
+      binddn={{ printf "cn=%s,%s" $bindDNUser $domain }}
+      bindmethod=simple
+      credentials={{ $adminPassword }}
+      searchbase={{ $domain }}
+      type=refreshAndPersist
+      interval={{ $interval }}
+      network-timeout=0
+      retry="{{ $retry }} +"
+      timeout={{ $timeout }}
+      starttls={{ $starttls }}
+      tls_reqcert={{ $tls_reqcert }}
+  {{- end -}}
 {{- end -}}
 
 {{/*

templates/configmap-env.yaml

@@ -18,7 +18,6 @@ metadata:
 {{- end }}
 data:
   LDAP_ROOT: {{ include "global.baseDomain" . }}
-  LDAP_EXTRA_SCHEMAS: {{ print "cosine,inetorgperson,nis," (include "openldap.schemaFiles" .) }}
   {{- if .Values.users }}
   LDAP_USERS: {{ .Values.users }}
   {{- end }}

templates/configmap-readonly.yaml

@@ -0,0 +1,19 @@
+{{- if (gt (.Values.readOnlyReplicaCount | int) 0) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "openldap.fullname" . }}-readonly
+  labels:
+    app: {{ template "openldap.name" . }}
+    chart: {{ template "openldap.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+{{- if .Values.extraLabels }}
+{{ toYaml .Values.extraLabels | indent 4 }}
+{{- end }}
+data:
+  # replication
+  readonly.ldif: |
+    dn: olcDatabase={2}mdb,cn=config
+    olcReadonly: TRUE
+{{- end }}

templates/service-readonly.yaml

@@ -0,0 +1,57 @@
+{{- if (gt (.Values.readOnlyReplicaCount | int) 0) }}
+apiVersion: v1
+kind: Service
+metadata:
+{{- if .Values.serviceReadOnly.annotations }}
+  annotations:
+{{ toYaml .Values.serviceReadOnly.annotations | indent 4 }}
+{{- end }}
+  name: {{ template "openldap.fullname" . }}-readonly
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/component: {{ template "openldap.fullname" . }}
+    chart: {{ template "openldap.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+{{- if .Values.extraLabels }}
+{{ toYaml .Values.extraLabels | indent 4 }}
+{{- end }}
+spec:
+  type: {{ .Values.serviceReadOnly.type }}
+  {{- if and (eq .Values.serviceReadOnly.type "LoadBalancer") .Values.serviceReadOnly.loadBalancerIP }}
+  loadBalancerIP: {{ .Values.serviceReadOnly.loadBalancerIP }}
+  {{- end }}
+  {{- if and (eq .Values.serviceReadOnly.type "LoadBalancer") .Values.serviceReadOnly.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges: {{ toYaml .Values.serviceReadOnly.loadBalancerSourceRanges | nindent 4 }}
+  {{- end }}
+  {{- if and (eq .Values.serviceReadOnly.type "ClusterIP") .Values.serviceReadOnly.clusterIP }}
+  clusterIP: {{ .Values.serviceReadOnly.clusterIP }}
+  {{- end }}
+  ports:
+    {{- if .Values.serviceReadOnly.enableLdapPort }}
+    - name: ldap-port
+      protocol: TCP
+      port: {{ .Values.global.ldapPort }}
+      targetPort: ldap-port
+      {{- if and (or (eq .Values.serviceReadOnly.type "NodePort") (eq .Values.serviceReadOnly.type "LoadBalancer")) (not (empty .Values.serviceReadOnly.ldapPortNodePort)) }}
+      nodePort: {{ .Values.serviceReadOnly.ldapPortNodePort }}
+      {{- else if eq .Values.serviceReadOnly.type "ClusterIP" }}
+      nodePort: null
+      {{- end }}
+    {{- end }}
+    {{- if .Values.serviceReadOnly.enableSslLdapPort }}
+    - name: ssl-ldap-port
+      protocol: TCP
+      port: {{ .Values.global.sslLdapPort }}
+      targetPort: ssl-ldap-port
+      {{- if and (or (eq .Values.serviceReadOnly.type "NodePort") (eq .Values.serviceReadOnly.type "LoadBalancer")) (not (empty .Values.serviceReadOnly.sslLdapPortNodePort)) }}
+      nodePort: {{ .Values.serviceReadOnly.sslLdapPortNodePort }}
+      {{- else if eq .Values.serviceReadOnly.type "ClusterIP" }}
+      nodePort: null
+      {{- end }}
+    {{- end }}
+  sessionAffinity: {{ .Values.service.sessionAffinity }}
+  selector:
+    app.kubernetes.io/component: {{ template "openldap.fullname" . }}-readonly
+    release: {{ .Release.Name }}
+{{- end }}