jenkins-infra
/
iep
mirror of https://github.com/jenkins-infra/iep
1
0
Fork 0
Code Issues Releases Wiki Activity
iep/iep-008
History
olblak a85143f813 Improve IEP-008 2018-03-20 15:58:31 +01:00
..
README.adoc Improve IEP-008 2018-03-20 15:58:31 +01:00

README.adoc

<html lang="en"> <head> </head>

IEP-008: Ldap on Kubernetes

Table 1. Metadata

IEP

8

Title

Ldap on Kubernetes

Author

Olivier Vernin

Status

💬 In-process

Type

Architecture

Created

2018-01-31

Abstract

As part of the migration to Azure, the Ldap server must be moved. We can take this opportunity to containerize this service and move it on a container orchestrator like the kubernetes cluster. This new architecture change must be done carefully as this is a stateful application with a database that can be corrupted or lead to data loss.

Specification

This IEP document is about running ldap on Kubernetes on Azure. Currently the ldap server is running on a bare metal machine and is configured by puppet. The objective here, is to dockerize this application in order to run it on a kubernetes cluster.

As a stateful application, we must take into consideration following aspect when deploying the ldap server in production.

Access

Ldap must be accessible from inside and outside the kubernetes cluster. In order to reach ldap from the wild, we need a fixed public IP and only allow connection from whitelisted IP. This can be easily done with the kubernetes resource 'service'.

Table 2. Access
Inside Outside

Backup/Restore

The procedure to backup/restore the database should be easy, two scripts are provided by the same docker image that run ldap.
Backups must be stored on an Azure File Storage in order to simplify their access from various location.
Backup name must respect format 'YYYYmmddHHMM'

Backups and restore operation must be done in following situations:

Table 3. Backup/Restore
Backup Restore

  • On daily basis

  • When the application is stopping

  • On demand

  • On demand

Certificate

Letsencrypt can be configured with two different methods

HTTP-01

HTTP-01 configuration needs an Ingress resource that listen on port 443, but this ingress resource cannot be configured to also listening port 389/636. It means that we need a service for listening port 389/636 unfortunately this service don’t handle Letsencrypt certificate requests. Therefor we would need both resources type, and they can’t be configured with the same public IP. So this method doesn’t work.

DNS-01

DNS-01 configuration only works with Google/AWS/Cloudflare.

Conclusion I didn’t find an easy way to use Letsencrypt certificate from kube-lego(deprecated)/cert-manager so we have to go with a manual requested ssl certificate.

Data

The ldap database must be store on a stable storage that can be easily mounted/unmounted. Currently there are no perfect solutions as each solution has advantages and disadvantages.

Dedicated Azure Disk storage

ReadWriteOnce

Table 4. Dedicated Azure Disk Storage
+ -

  • Persistent Data across kubernetes clusters as we only have one container running at the time.

  • We only have to restore a backup once.

  • Complexify cluster upgrade, iep-007, traffic will be redirected to the new server once the old is deleted.

  • It means downtime when we upgrade the container as we must delete the old container before starting the new one.

Dynamic Azure Disk Storage

ReadWriteOnce

Table 5. Dynamic Azure Disk Storage
+ -

  • Persistent data associated to a cluster life cycle

  • Simplify cluster migration, new cluster can be started even if the old cluster is still running

  • We must restore a backup on each new kubernetes cluster deployment

  • While migrating the cluster, we must be sure to put the old cluster in read only mode.

Azure File storage

ReadWriteMany
After running some tests, I noticed bad behaviors while running openldap on CIFS partition. Like 'permission denied issues' even if the blob storage was mounted as a ldap user, or database restore that hangs forever, …​ At the end, I decided to not invest further time into this solution.

Conclusion

Considering that it only takes 5seconds to backup/restore a ldap database, using a dynamic azure disk storage sounds reasonable.

Kubernetes Design

Kubernetes Schema
+----------------------------------------------------------------------------------------------+
| Namespace: Ldap                                                                              |
+----------------------------------------------------------------------------------------------+
|                                                                                              |
|                 +----------------------------------+    +----------------------------------+ |
+---------------+ | Statefulset: Ldap                |    | PersistentVolume: ldap-backup    | |
|Service: Ldap  | +----------------------------------+    +----------------------------------+ |
+---------------+ |   +---------------------------+  |    | * Terraform Lifecycle            | |
| * Ldap (389)  | |   | POD: ldap-0               |  |    | * ReadWriteMany                  | |
| * Ldaps (636) | |   +---------------------------+  |<--------------------------------------+ |
+---------------+ |   | +----------------------+  |  |    +----------------------------------+ |
|      |          |   | | Container: Slapd     |  |  |    | PersistentVolume: ldap-data      | |
|      |          |   | +----------------------+  |  |    +----------------------------------+ |
|      |          |   | | * Ldap server        |  |  |    | * ClusterLife cycle              | |
|      +--------->|   | +----------------------+  |  |<---+ * ReadWriteOnce                  | |
|                 |   |                           |  |    +----------------------------------+ |
|                 |   | +----------------------+  |  |                                         |
|                 |   | | Container: Crond     |  |  |<---+----------------------------------+ |
|                 |   | +----------------------+  |  |    | Secret: Ldap                     | |
|                 |   | | * Backup Task        |  |  |    +----------------------------------+ |
|                 |   | +----------------------+  |  |    | * SSL certificate                | |
|                 |   |                           |  |    | * Blob storage credentials       | |
|                 |   +---------------------------+  |    | * Ldap credentials               | |
|                 +----------------------------------+    +----------------------------------+ |
+----------------------------------------------------------------------------------------------+

Motivation

The motivation here is to benefit from both Kubernetes and Azure services advantages.
What is Kubernetes?

Rationale

Costs

In addition of the Kubernetes cluster that we are already paying for, we’ll need following services

  • Public IP

  • LoadBalancer

  • Azure file storage account for backup

  • Disk Storage account for Data

  • Ssl certificate Ldap.jenkins.io

Last updated 2024-05-03 19:21:05 UTC
</html>