openshift-management
openshift-management copied to clipboard
Update LDAP Group Sync Templates for OCP 4.1
High level steps used on OCP 4.1 to set up LDAP group sync. Adding the steps here as requested via internal chat.
- Create
Secret
namedldap-bind-secret
inopenshift-config
namespace withdata.bindPassword
containing the base64 encoded bind password. - Create
ConfigMap
namedldap-ca-config-map
inopenshift-config
namespace withdata
specced toca.crt
containing the CA Cert. - Create
Namespace
namedinfra-cronjobs
with labelname: infra-cronjobs
- Create
ConfigMap
in theinfra-cronjobs
namespace containingdata
withca.crt
defined as well asldap-group-sync.yaml
containing the required data defined in the OCP 4.1 Auth Providers: AD/LDAP docs. - Create
CronJob
namedldap-group-sync
in namespaceinfra-cronfjobs
containing a spec consuming the items created prior. - Create
ClusterRole
namedldap-group-syncer
with rules allowingget
,list
,create
,update
, anddelete
ongroup
resources. - Create
ClusterRoleBinding
namedsystem:ldap-group-syncers
withroleRef
set toldap-group-syncer
forldap-group-syncer
service account - Create
ServiceAccount
namedldap-group-syncer
in namespaceinfra-cronjobs
- Create
Job
namedinitial-ldap-group-sync
in namespaceinfra-cronjobs
which consumes the body of theCronJob
created in step 5 in order to kick things off.
How do you map the synced user names to the base64 encoded user names when users are logging in?