Merge branch 'bjozet-dhparam-env' into release-1.2.3
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2ecf27a..c362184 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,13 @@
The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
+## [1.2.2] - Unreleased
+### Added
+ - gce statefulset #241
+
+### Changed
+ - Update openldap 2.4.44 (released over two years ago!) to 2.4.46 (released 6 months ago) #247
+
## [1.2.2] - 2018-09-04
### Added
- Environment variable LDAP_NOFILE to setup a custom ulimit value #237
diff --git a/Makefile b/Makefile
index 0f3cd49..daecab7 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,5 @@
NAME = osixia/openldap
-VERSION = 1.2.2
+VERSION = 1.2.3-dev
.PHONY: build build-nocache test tag-latest push push-latest release git-tag-version
diff --git a/README.md b/README.md
index fc021cb..1d0821d 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
-Latest release: 1.2.2 - OpenLDAP 2.4.44 - [Changelog](CHANGELOG.md) | [Docker Hub](https://hub.docker.com/r/osixia/openldap/)
+Latest release: 1.2.3-dev - OpenLDAP 2.4.46 - [Changelog](CHANGELOG.md) | [Docker Hub](https://hub.docker.com/r/osixia/openldap/)
**A docker image to run OpenLDAP.**
@@ -35,7 +35,7 @@
- [Link environment file](#link-environment-file)
- [Make your own image or extend this image](#make-your-own-image-or-extend-this-image)
- [Advanced User Guide](#advanced-user-guide)
- - [Extend osixia/openldap:1.2.2 image](#extend-osixiaopenldap122-image)
+ - [Extend osixia/openldap:1.2.3-dev image](#extend-osixiaopenldap123-dev-image)
- [Make your own openldap image](#make-your-own-openldap-image)
- [Tests](#tests)
- [Kubernetes](#kubernetes)
@@ -55,7 +55,7 @@
## Quick Start
Run OpenLDAP docker image:
- docker run --name my-openldap-container --detach osixia/openldap:1.2.2
+ docker run --name my-openldap-container --detach osixia/openldap:1.2.3-dev
This start a new container with OpenLDAP running inside. Let's make the first search in our LDAP container:
@@ -91,7 +91,7 @@
By default the admin has the password **admin**. All those default settings can be changed at the docker command line, for example:
docker run --env LDAP_ORGANISATION="My Company" --env LDAP_DOMAIN="my-company.com" \
- --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.2.2
+ --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.2.3-dev
#### Data persistence
@@ -141,12 +141,12 @@
# single file example:
docker run \
--volume ./bootstrap.ldif:/container/service/slapd/assets/config/bootstrap/ldif/50-bootstrap.ldif \
- osixia/openldap:1.2.2 --copy-service
+ osixia/openldap:1.2.3-dev --copy-service
#directory example:
docker run \
--volume ./ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom \
- osixia/openldap:1.2.2 --copy-service
+ osixia/openldap:1.2.3-dev --copy-service
### Use an existing ldap database
@@ -157,7 +157,7 @@
docker run --volume /data/slapd/database:/var/lib/ldap \
--volume /data/slapd/config:/etc/ldap/slapd.d \
- --detach osixia/openldap:1.2.2
+ --detach osixia/openldap:1.2.3-dev
You can also use data volume containers. Please refer to:
> [https://docs.docker.com/engine/tutorials/dockervolumes/](https://docs.docker.com/engine/tutorials/dockervolumes/)
@@ -177,7 +177,7 @@
#### Use auto-generated certificate
By default, TLS is already configured and enabled, certificate is created using container hostname (it can be set by docker run --hostname option eg: ldap.example.org).
- docker run --hostname ldap.my-company.com --detach osixia/openldap:1.2.2
+ docker run --hostname ldap.my-company.com --detach osixia/openldap:1.2.3-dev
#### Use your own certificate
@@ -187,24 +187,24 @@
--env LDAP_TLS_CRT_FILENAME=my-ldap.crt \
--env LDAP_TLS_KEY_FILENAME=my-ldap.key \
--env LDAP_TLS_CA_CRT_FILENAME=the-ca.crt \
- --detach osixia/openldap:1.2.2
+ --detach osixia/openldap:1.2.3-dev
Other solutions are available please refer to the [Advanced User Guide](#advanced-user-guide)
#### Disable TLS
Add --env LDAP_TLS=false to the run command:
- docker run --env LDAP_TLS=false --detach osixia/openldap:1.2.2
+ docker run --env LDAP_TLS=false --detach osixia/openldap:1.2.3-dev
### Multi master replication
Quick example, with the default config.
#Create the first ldap server, save the container id in LDAP_CID and get its IP:
- LDAP_CID=$(docker run --hostname ldap.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.2)
+ LDAP_CID=$(docker run --hostname ldap.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.3-dev)
LDAP_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP_CID)
#Create the second ldap server, save the container id in LDAP2_CID and get its IP:
- LDAP2_CID=$(docker run --hostname ldap2.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.2)
+ LDAP2_CID=$(docker run --hostname ldap2.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.3-dev)
LDAP2_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP2_CID)
#Add the pair "ip hostname" to /etc/hosts on each containers,
@@ -240,7 +240,7 @@
To fix that run the container with `--copy-service` argument :
- docker run [your options] osixia/openldap:1.2.2 --copy-service
+ docker run [your options] osixia/openldap:1.2.3-dev --copy-service
### Debug
@@ -249,11 +249,11 @@
Example command to run the container in `debug` mode:
- docker run --detach osixia/openldap:1.2.2 --loglevel debug
+ docker run --detach osixia/openldap:1.2.3-dev --loglevel debug
See all command line options:
- docker run osixia/openldap:1.2.2 --help
+ docker run osixia/openldap:1.2.3-dev --help
## Environment Variables
@@ -319,7 +319,7 @@
If you want to set this variable at docker run command add the tag `#PYTHON2BASH:` and convert the yaml in python:
- docker run --env LDAP_REPLICATION_HOSTS="#PYTHON2BASH:['ldap://ldap.example.org','ldap://ldap2.example.org']" --detach osixia/openldap:1.2.2
+ docker run --env LDAP_REPLICATION_HOSTS="#PYTHON2BASH:['ldap://ldap.example.org','ldap://ldap2.example.org']" --detach osixia/openldap:1.2.3-dev
To convert yaml to python online: http://yaml-online-parser.appspot.com/
@@ -339,7 +339,7 @@
Environment variables can be set by adding the --env argument in the command line, for example:
docker run --env LDAP_ORGANISATION="My company" --env LDAP_DOMAIN="my-company.com" \
- --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.2.2
+ --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.2.3-dev
Be aware that environment variable added in command line will be available at any time
in the container. In this example if someone manage to open a terminal in this container
@@ -350,14 +350,14 @@
For example if your environment files **my-env.yaml** and **my-env.startup.yaml** are in /data/ldap/environment
docker run --volume /data/ldap/environment:/container/environment/01-custom \
- --detach osixia/openldap:1.2.2
+ --detach osixia/openldap:1.2.3-dev
Take care to link your environment files folder to `/container/environment/XX-somedir` (with XX < 99 so they will be processed before default environment files) and not directly to `/container/environment` because this directory contains predefined baseimage environment files to fix container environment (INITRD, LANG, LANGUAGE and LC_CTYPE).
Note: the container will try to delete the **\*.startup.yaml** file after the end of startup files so the file will also be deleted on the docker host. To prevent that : use --volume /data/ldap/environment:/container/environment/01-custom**:ro** or set all variables in **\*.yaml** file and don't use **\*.startup.yaml**:
docker run --volume /data/ldap/environment/my-env.yaml:/container/environment/01-custom/env.yaml \
- --detach osixia/openldap:1.2.2
+ --detach osixia/openldap:1.2.3-dev
#### Make your own image or extend this image
@@ -365,13 +365,13 @@
## Advanced User Guide
-### Extend osixia/openldap:1.2.2 image
+### Extend osixia/openldap:1.2.3-dev image
If you need to add your custom TLS certificate, bootstrap config or environment files the easiest way is to extends this image.
Dockerfile example:
- FROM osixia/openldap:1.2.2
+ FROM osixia/openldap:1.2.3-dev
MAINTAINER Your Name <your@name.com>
ADD bootstrap /container/service/slapd/assets/config/bootstrap
diff --git a/example/docker-compose.yml b/example/docker-compose.yml
index 931ab22..3d7dd26 100644
--- a/example/docker-compose.yml
+++ b/example/docker-compose.yml
@@ -1,7 +1,7 @@
version: '2'
services:
openldap:
- image: osixia/openldap:1.2.2
+ image: osixia/openldap:1.2.3-dev
container_name: openldap
environment:
LDAP_LOG_LEVEL: "256"
diff --git a/example/extend-osixia-openldap/Dockerfile b/example/extend-osixia-openldap/Dockerfile
index c7b97fc..f6f9a8a 100644
--- a/example/extend-osixia-openldap/Dockerfile
+++ b/example/extend-osixia-openldap/Dockerfile
@@ -1,4 +1,4 @@
-FROM osixia/openldap:1.2.2
+FROM osixia/openldap:1.2.3-dev
MAINTAINER Your Name <your@name.com>
ADD bootstrap /container/service/slapd/assets/config/bootstrap
diff --git a/example/kubernetes/simple/ldap-deployment.yaml b/example/kubernetes/simple/ldap-deployment.yaml
index ce61bf4..89017fb 100644
--- a/example/kubernetes/simple/ldap-deployment.yaml
+++ b/example/kubernetes/simple/ldap-deployment.yaml
@@ -13,7 +13,7 @@
spec:
containers:
- name: ldap
- image: osixia/openldap:1.2.2
+ image: osixia/openldap:1.2.3-dev
volumeMounts:
- name: ldap-data
mountPath: /var/lib/ldap
diff --git a/example/kubernetes/using-secrets/gce-statefullset.yaml b/example/kubernetes/using-secrets/gce-statefullset.yaml
new file mode 100644
index 0000000..0f0d00b
--- /dev/null
+++ b/example/kubernetes/using-secrets/gce-statefullset.yaml
@@ -0,0 +1,58 @@
+apiVersion: apps/v1beta1
+kind: StatefulSet
+metadata:
+ name: ldap
+spec:
+ serviceName: "ldap"
+ replicas: 1
+ template:
+ metadata:
+ labels:
+ pod: ldap
+ spec:
+ containers:
+ - name: azaldap
+ image: osixia/openldap:1.2.2
+ imagePullPolicy: IfNotPresent
+ #command: ["/bin/bash","-c","while [ 1 = 1 ] ; do sleep 1; date; done"]
+ ports:
+ - containerPort: 389
+ volumeMounts:
+ - mountPath: /var/lib/ldap
+ name: ldap-data
+ - mountPath: /etc/ldap/slapd.d
+ name: ldap-config
+ - mountPath: /container/service/slapd/assets/certs
+ name: ldap-certs
+ - mountPath: /container/environment/01-custom
+ name: secret-volume
+ - mountPath: /container/run
+ name: container-run
+ volumes:
+ - name: "secret-volume"
+ secret:
+ secretName: "ldap-secret"
+ - name: container-run
+ emptyDir: {}
+ volumeClaimTemplates:
+ - metadata:
+ name: ldap-data
+ spec:
+ accessModes: ["ReadWriteOnce"]
+ resources:
+ requests:
+ storage: 1Gi
+ - metadata:
+ name: ldap-config
+ spec:
+ accessModes: ["ReadWriteOnce"]
+ resources:
+ requests:
+ storage: 10Mi
+ - metadata:
+ name: ldap-certs
+ spec:
+ accessModes: ["ReadWriteOnce"]
+ resources:
+ requests:
+ storage: 10Mi
diff --git a/example/kubernetes/using-secrets/ldap-deployment.yaml b/example/kubernetes/using-secrets/ldap-deployment.yaml
index f3f8e23..a802946 100644
--- a/example/kubernetes/using-secrets/ldap-deployment.yaml
+++ b/example/kubernetes/using-secrets/ldap-deployment.yaml
@@ -13,7 +13,7 @@
spec:
containers:
- name: ldap
- image: osixia/openldap:1.2.2
+ image: osixia/openldap:1.2.3-dev
args: ["--copy-service"]
volumeMounts:
- name: ldap-data
diff --git a/image/Dockerfile b/image/Dockerfile
index 2df26db..b8c3b67 100644
--- a/image/Dockerfile
+++ b/image/Dockerfile
@@ -11,12 +11,15 @@
RUN if [ -z "${LDAP_OPENLDAP_GID}" ]; then groupadd -r openldap; else groupadd -r -g ${LDAP_OPENLDAP_GID} openldap; fi \
&& if [ -z "${LDAP_OPENLDAP_UID}" ]; then useradd -r -g openldap openldap; else useradd -r -g openldap -u ${LDAP_OPENLDAP_UID} openldap; fi
-# Install OpenLDAP, ldap-utils and ssl-tools from baseimage and clean apt-get files
+# Add stretch-backports in preparation for downloading newer openldap components, especially sladp
+RUN echo "deb http://ftp.debian.org/debian stretch-backports main" >> /etc/apt/sources.list
+
+# Install OpenLDAP, ldap-utils and ssl-tools from the (backported) baseimage and clean apt-get files
# sources: https://github.com/osixia/docker-light-baseimage/blob/stable/image/tool/add-service-available
# https://github.com/osixia/docker-light-baseimage/blob/stable/image/service-available/:ssl-tools/download.sh
RUN echo "path-include /usr/share/doc/krb5*" >> /etc/dpkg/dpkg.cfg.d/docker && apt-get -y update \
&& /container/tool/add-service-available :ssl-tools \
- && LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+ && LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get -t stretch-backports install -y --no-install-recommends \
ldap-utils \
libsasl2-modules \
libsasl2-modules-db \
diff --git a/image/service/slapd/assets/config/admin-pw/ldif/06-root-pw-change.ldif b/image/service/slapd/assets/config/admin-pw/ldif/06-root-pw-change.ldif
new file mode 100644
index 0000000..266bc06
--- /dev/null
+++ b/image/service/slapd/assets/config/admin-pw/ldif/06-root-pw-change.ldif
@@ -0,0 +1,14 @@
+# Change config password
+dn: cn=config
+changeType: modify
+
+dn: olcDatabase={0}config,cn=config
+replace: olcRootPW
+olcRootPW: {{ LDAP_CONFIG_PASSWORD_ENCRYPTED }}
+
+# Change schema password
+
+dn: olcDatabase={1}{{ LDAP_BACKEND }},cn=config
+changetype: modify
+replace: olcRootPW
+olcRootPW: {{ LDAP_ADMIN_PASSWORD_ENCRYPTED }}
\ No newline at end of file
diff --git a/image/service/slapd/assets/config/admin-pw/ldif/07-admin-pw-change.ldif b/image/service/slapd/assets/config/admin-pw/ldif/07-admin-pw-change.ldif
new file mode 100644
index 0000000..25ba4b7
--- /dev/null
+++ b/image/service/slapd/assets/config/admin-pw/ldif/07-admin-pw-change.ldif
@@ -0,0 +1,5 @@
+# Admin schema password
+dn: cn=admin,{{ LDAP_BASE_DN }}
+changetype: modify
+replace: userPassword
+userPassword: {{ LDAP_ADMIN_PASSWORD_ENCRYPTED }}
\ No newline at end of file
diff --git a/image/service/slapd/assets/config/replication/replication-disable.ldif b/image/service/slapd/assets/config/replication/replication-disable.ldif
index 2c2e498..b138bcf 100644
--- a/image/service/slapd/assets/config/replication/replication-disable.ldif
+++ b/image/service/slapd/assets/config/replication/replication-disable.ldif
@@ -4,6 +4,8 @@
delete: olcSyncRepl
-
delete: olcMirrorMode
+-
+delete: olcLimits
# Delete syncprov on backend
dn: olcOverlay=syncprov,olcDatabase={1}{{ LDAP_BACKEND }},cn=config
@@ -24,3 +26,4 @@
dn: cn=config
changeType: modify
delete: olcServerID
+
diff --git a/image/service/slapd/startup.sh b/image/service/slapd/startup.sh
index fe39009..25656ed 100755
--- a/image/service/slapd/startup.sh
+++ b/image/service/slapd/startup.sh
@@ -23,6 +23,7 @@
WAS_STARTED_WITH_TLS="/etc/ldap/slapd.d/docker-openldap-was-started-with-tls"
WAS_STARTED_WITH_TLS_ENFORCE="/etc/ldap/slapd.d/docker-openldap-was-started-with-tls-enforce"
WAS_STARTED_WITH_REPLICATION="/etc/ldap/slapd.d/docker-openldap-was-started-with-replication"
+WAS_ADMIN_PASSWORD_SET="/etc/ldap/slapd.d/docker-openldap-was-admin-password-set"
LDAP_TLS_CA_CRT_PATH="${CONTAINER_SERVICE_DIR}/slapd/assets/certs/$LDAP_TLS_CA_CRT_FILENAME"
LDAP_TLS_CRT_PATH="${CONTAINER_SERVICE_DIR}/slapd/assets/certs/$LDAP_TLS_CRT_FILENAME"
@@ -398,6 +399,22 @@
fi
+ if [[ -f "$WAS_ADMIN_PASSWORD_SET" ]]; then
+ LDAP_CONFIG_PASSWORD_ENCRYPTED=$(slappasswd -s "$LDAP_CONFIG_PASSWORD")
+ LDAP_ADMIN_PASSWORD_ENCRYPTED=$(slappasswd -s "$LDAP_ADMIN_PASSWORD")
+ sed -i "s|{{ LDAP_CONFIG_PASSWORD_ENCRYPTED }}|${LDAP_CONFIG_PASSWORD_ENCRYPTED}|g" ${CONTAINER_SERVICE_DIR}/slapd/assets/config/admin-pw/ldif/06-root-pw-change.ldif
+ sed -i "s|{{ LDAP_ADMIN_PASSWORD_ENCRYPTED }}|${LDAP_ADMIN_PASSWORD_ENCRYPTED}|g" ${CONTAINER_SERVICE_DIR}/slapd/assets/config/admin-pw/ldif/06-root-pw-change.ldif
+ sed -i "s|{{ LDAP_BACKEND }}|${LDAP_BACKEND}|g" ${CONTAINER_SERVICE_DIR}/slapd/assets/config/admin-pw/ldif/06-root-pw-change.ldif
+ sed -i "s|{{ LDAP_ADMIN_PASSWORD_ENCRYPTED }}|${LDAP_ADMIN_PASSWORD_ENCRYPTED}|g" ${CONTAINER_SERVICE_DIR}/slapd/assets/config/admin-pw/ldif/07-admin-pw-change.ldif
+ sed -i "s|{{ LDAP_BASE_DN }}|${LDAP_BASE_DN}|g" ${CONTAINER_SERVICE_DIR}/slapd/assets/config/admin-pw/ldif/07-admin-pw-change.ldif
+
+ for f in $(find ${CONTAINER_SERVICE_DIR}/slapd/assets/config/admin-pw/ldif -type f -name \*.ldif | sort); do
+ ldap_add_or_modify "$f"
+ done
+ else
+ touch "$WAS_ADMIN_PASSWORD_SET"
+ fi
+
#
# stop OpenLDAP
#
