adminPassword: "myAwesomePassw0rd"
replicaCount: 3
# settings for enabling TLS
customLdifFiles:
  01-default-users.ldif: |-
    # Predefine users here
service:
  annotations:
    cloud.google.com/load-balancer-type: "Internal"

    clusterIP: ""

  ldapPort: 389
  sslLdapPort: 636  # Only used if tls.enabled is true
  type: NodePort
tls:
  enabled: true
ltb-passwd:
  enabled : false
phpldapadmin:
  enabled: true
  ingress:
    enabled: true
    ## Ingress Host
    hosts:
    - phpldapadmin.example.com
  env:
    PHPLDAPADMIN_LDAP_HOSTS: "openldap.openldap"

replicaCount: 2
# Define deployment strategy - IMPORTANT: use rollingUpdate: null when use Recreate strategy.
# It prevents from merging with existing map keys which are forbidden.
strategy: {}
  # type: RollingUpdate
  # rollingUpdate:
  #   maxSurge: 1
  #   maxUnavailable: 0
  #
  # or
  #
  # type: Recreate
  # rollingUpdate: null
image:
  repository: osixia/openldap
  tag: latest
  pullPolicy: IfNotPresent
  pullSecret: harbor

# Spcifies an existing secret to be used for admin and config user passwords
existingSecret: ""

# settings for enabling TLS with custom certificate
tls:
  enabled: false
  secret: ""  # The name of a kubernetes.io/tls type secret to use for TLS
  CA:
    enabled: false
    secret: ""  # The name of a generic secret to use for custom CA certificate (ca.crt)

extraLabels: {}

podAnnotations: {}
service:
  annotations: {}
  ldapPort: 389
  sslLdapPort: 636
  externalIPs: [300.2.0.1]

  loadBalancerIP: ""
  loadBalancerSourceRanges: []
  type: ClusterIP
  #type: NodePort

# Default configuration for openldap as environment variables. These get injected directly in the container.
# Use the env variables from https://github.com/osixia/docker-openldap#beginner-guide
env:
  LDAP_LOG_LEVEL: "256"
  LDAP_ORGANISATION: "Example Inc."
  LDAP_DOMAIN: "example.org"
  LDAP_READONLY_USER: "false"
  LDAP_READONLY_USER_USERNAME: "readonly"
  LDAP_READONLY_USER_PASSWORD: "readonly"
  LDAP_RFC2307BIS_SCHEMA: "false"
  LDAP_BACKEND: "mdb"
  LDAP_TLS: "false"
  LDAP_TLS_CRT_FILENAME: "ldap.crt"
  LDAP_TLS_KEY_FILENAME: "ldap.key"
  LDAP_TLS_DH_PARAM_FILENAME: "dhparam.pem"
  LDAP_TLS_CA_CRT_FILENAME: "ca.crt"
  LDAP_TLS_ENFORCE: "false"
  CONTAINER_LOG_LEVEL: "1"
  LDAP_TLS_REQCERT: "never"
  KEEP_EXISTING_CONFIG: "false"
  LDAP_REMOVE_CONFIG_AFTER_SETUP: "true"
  LDAP_SSL_HELPER_PREFIX: "ldap"
  LDAP_TLS_VERIFY_CLIENT: "never"
  LDAP_TLS_PROTOCOL_MIN: "3.0"
  LDAP_TLS_CIPHER_SUITE: "NORMAL"
  LOGLEVEL: "DEBUG"

# Default Passwords to use, stored as a secret. If unset, passwords are auto-generated.
# You can override these at install time with
# helm install openldap --set openldap.adminPassword=<passwd>,openldap.configPassword=<passwd>
# adminPassword: admin
# configPassword: config

replication:
  enabled: true
## Persist data to a persistent volume
persistence:
  enabled: true
  storageClass: "rook-ceph-block"
  accessModes:
    - ReadWriteOnce
  size: 60Mi

resources: {}

nodeSelector: {}

tolerations: []

# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
affinityTemplate: |
  podAntiAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    - labelSelector:
        matchExpressions:
        - key: release
          operator: In
          values: [{{ .Release.Name | quote }}]
        - key: app
          operator: In
          values: [{{ template "openldap.name" . }}]
      topologyKey: kubernetes.io/hostname

## test container details
test:
  enabled: false
  image:
    repository: dduportal/bats
    tag: 0.4.0
ltb-passwd:
  enabled : false
  ingress:
    enabled: true
    annotations: {}
    path: /pas
    ## Ingress Host
    hosts:
    - "demo-ldap.test.test"
  ldap:
    server: ldaps://openldap.ldap.svc.cluster.local
    searchBase: dc=example,dc=org
    binduserSecret: openldap
  env:
  - name: LDAP_BINDDN
    value: "cn=admin,dc=example,dc=org"
  - name: LDAP_BINDPASS
    value: "pass1"
  - name: SECRETEKEY
    value: "LDAP_ADMIN_PASSWORD"
  - name: LDAP_LOGIN_ATTRIBUTE
    value: "cn"

phpldapadmin:
  enabled: true
  ingress:
    enabled: true
    annotations:
      certmanager.k8s.io/cluster-issuer: letsencrypt-prod
      kubernetes.io/ingress.class: nginx
      kubernetes.io/tls-acme: "true"
      nginx.ingress.kubernetes.io/rewrite-target: /$2
      nginx.ingress.kubernetes.io/proxy-body-size: 8m
    path: /ldap(/|$)(.*)
    ## Ingress Host
    hosts:
    - "demo-ldap.test.test"
  env:
    PHPLDAPADMIN_LDAP_HOSTS: openldap.ldap.svc.cluster.local

LDAP_ADMIN_PASSWORD: {{ .Values.adminPassword | default (randAlphaNum 32) | b64enc | quote }}
  LDAP_CONFIG_PASSWORD: {{ .Values.configPassword | default (randAlphaNum 32) | b64enc | quote }}

tls:
  enabled: true