//Cloudogu EcoSystem Docs

Install and Configure the LDAP Component

This document describes how to operate LDAP as a LOP component using the Helm chart in this repository.

Prerequisites

• Kubernetes cluster with access via kubectl and helm
• Target namespace (examples below use ecosystem)
• Pull secret for registry.cloudogu.com (default: ces-container-registries)
• Global CES configuration as a ConfigMap (default name: global-config)
• Optional: secret for the initial admin password

1. Provide the global ConfigMap

The component reads global values via doguctl config --global, especially domain. At minimum, domain must be set.

Example:

apiVersion: v1
kind: ConfigMap
metadata:
  name: global-config
  namespace: ecosystem
data:
  config.yaml: |
    domain: "ces.local"

Create:

kubectl apply -f global-config.yaml

2. Initial admin password secret

The initial password of the LDAP admin user under ou=People is read from a Secret. This password is only used during the first initialization of the LDAP data.

By default, Helm creates this secret automatically:

• Secret name: <release>-initial-admin-password
• Password key: password

You only need to provide a secret manually if you want a fixed initial value or if create=false is configured.

Example:

apiVersion: v1
kind: Secret
metadata:
  name: ldap-initial-admin-password
  namespace: ecosystem
type: Opaque
stringData:
  password: "admin"

Create:

kubectl apply -f ldap-initial-admin-password.yaml

3. Install/Uninstall via make targets

helm-apply / helm-delete (direct Helm release):

make helm-apply
make helm-delete

component-apply / component-delete (component CR):

make component-apply
make component-delete

4. Configuration (values.yaml) Overview

Service Account Behavior

• If secret.create=true, Helm creates a secret.
• If a secret already exists, existing values are reused.
• If username is missing, a default username is used (cas, usermgt, ldap-mapper).
• If password is missing, a random password is generated.
• On startup, LDAP service accounts are reconciled with secret data (create/update/delete).
• If an account is disabled or secret data is missing, the corresponding LDAP service account is removed.

Note for ArgoCD/GitOps:

• For strict declarative operation without Helm lookup, prefer secret.create=false and externally managed secrets.

Initial admin password behavior

• If secrets.initialAdminPasswordSecretRef.create=true, Helm creates a secret with a random password if none exists yet.
• If the secret already exists, the existing password is reused.
• This secret only provides the initial password for the LDAP admin user under ou=People.
• After first initialization, LDAP becomes the source of truth. Password changes via UserMgt or LDAP are not written back to the secret.

Resource names for standalone installations

By default, the chart uses <release-name>-<chart-name> as the base name. For helm install lop-idp ..., this results in resource names such as lop-idp-ldap.

For standalone installations, it is recommended to choose an explicit release name, for example:

helm install ldap-component k8s/helm --set globalConfig.domain=example

If you need a fixed resource name independent of the release name, set fullnameOverride instead:

helm install test k8s/helm \
  --set fullnameOverride=ldap-component \
  --set globalConfig.domain=example

Example Overrides

globalConfig:
  configMapName: global-config
  key: config.yaml

secrets:
  initialAdminPasswordSecretRef:
    create: true
    name: ""
    passwordKey: password
  serviceAccounts:
    cas:
      enabled: true
      secret:
        create: true
        name: ldap-cas-sa
        usernameKey: username
        passwordKey: password
    usermgt:
      enabled: true
      secret:
        create: true
        name: ldap-usermgt-sa
        usernameKey: username
        passwordKey: password
    ldapMapper:
      enabled: true
      secret:
        create: true
        name: ldap-ldap-mapper-sa
        usernameKey: username
        passwordKey: password

5. Uninstall

make helm-delete
make component-delete

Depending on the StorageClass reclaim policy, the PVC is retained or removed automatically.