forked from ungleich-public/ungleich-user
Sajeyks
24fe2122b4
Sample entries from production show: - customers live in ou=customer (singular), not ou=customers - customers have gidNumber 10004 and staff 10002; uidNumbers are in the 10000s - staff entries list organizationalPerson and person explicitly - the servers serve ldaps:// on port 636 The app reads all of these from settings, so its behaviour is unchanged; the customer entry it creates already matches production attribute for attribute. The defaults and test setups were wrong: env.sample, the Kubernetes ConfigMap (now ldaps:// without StartTLS, gid 10004, start uid 10000), dev/env.dev and the dev LDAP seed now mirror production. The made-up ou=groups is gone. The tests take the customer DN and gidNumber from settings instead of hardcoding them.
89 lines
2.3 KiB
YAML
89 lines
2.3 KiB
YAML
# Local test overlay (kind): the app plus throwaway LDAP, PostgreSQL and a
|
|
# mail catcher (Mailpit).
|
|
# Dev-only credentials, no persistence. See deploy/k8s/README.md.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: ungleich-user-dev
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- ../base
|
|
- ldap.yaml
|
|
- postgres.yaml
|
|
- mailpit.yaml
|
|
|
|
secretGenerator:
|
|
- name: ungleich-user
|
|
options:
|
|
disableNameSuffixHash: true
|
|
literals:
|
|
- SECRET_KEY=dev-only-not-a-secret-dev-only-not-a-secret-dev-only
|
|
- LDAP_ADMIN_DN=cn=admin,dc=ungleich,dc=ch
|
|
- LDAP_ADMIN_PASSWORD=admin
|
|
- DATABASE_PASSWORD=dev-only
|
|
- ADMIN_SEED=JBSWY3DPEHPK3PXP
|
|
|
|
patches:
|
|
- target: {kind: ConfigMap, name: ungleich-user}
|
|
patch: |-
|
|
- op: replace
|
|
path: /data/ALLOWED_HOSTS
|
|
value: "localhost,127.0.0.1"
|
|
- op: replace
|
|
path: /data/CSRF_TRUSTED_ORIGINS
|
|
value: "http://localhost:8080"
|
|
- op: replace
|
|
path: /data/LDAPSERVER
|
|
value: "ldap://ldap1:389 ldap://ldap2:389"
|
|
- op: replace
|
|
path: /data/LDAP_USE_TLS
|
|
value: "False"
|
|
- op: replace
|
|
path: /data/DATABASE_HOST
|
|
value: "postgres"
|
|
- op: replace
|
|
path: /data/EMAIL_FROM_ADDRESS
|
|
value: "noreply@example.com"
|
|
- op: replace
|
|
path: /data/OTPSERVER
|
|
value: "http://otp.invalid/"
|
|
- op: replace
|
|
path: /data/ADMIN_NAME
|
|
value: "dev"
|
|
- op: replace
|
|
path: /data/ADMIN_REALM
|
|
value: "ungleich-admin"
|
|
- op: replace
|
|
path: /data/USER_REALM
|
|
value: "ungleich-auth"
|
|
- op: replace
|
|
path: /data/ALLOWED_REALMS
|
|
value: "ungleich-auth"
|
|
- op: replace
|
|
path: /data/EMAIL_HOST
|
|
value: "mailpit"
|
|
- op: replace
|
|
path: /data/EMAIL_PORT
|
|
value: "1025"
|
|
- op: replace
|
|
path: /data/EMAIL_USE_TLS
|
|
value: "False"
|
|
- op: add
|
|
path: /data/SESSION_COOKIE_SECURE
|
|
value: "False"
|
|
- op: add
|
|
path: /data/CSRF_COOKIE_SECURE
|
|
value: "False"
|
|
- target: {kind: Ingress, name: ungleich-user}
|
|
patch: |-
|
|
$patch: delete
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: ungleich-user
|
|
|
|
images:
|
|
- name: ungleich-user
|
|
newName: ungleich-user
|
|
newTag: dev
|