manifest.conf — profile: platform-engineer
← kembali ke catatan
2026-09-11seri: 389 Directory Server & OpenShift (bagian 3)

Integrasi LDAP/LDAPS dengan OpenShift 4.18: OAuth, RFC2307 Group Sync, dan RBAC

openshiftldapldapsoauthkubernetes

Setelah 389 Directory Server, LDAPS, user/group, service account, dan ACI siap, kita bisa menghubungkannya ke OpenShift 4.18.

Arsitektur

              OpenShift 4.18
                   |
            OAuth / LDAP IDP
                   |
             LDAPS :636
                   |
                   v
          ldap.iqiterate.id
                   |
    +--------------+--------------+
    |              |              |
  users          groups         service
    |              |              |
  iqbal     openshift-admins   openshift-bind
            openshift-users

1. Secret untuk bind account

oc create secret generic ldap-bind-password \
  --from-literal=bindPassword='PASSWORD_OPENSHIFT_BIND' \
  -n openshift-config

Verifikasi:

oc get secret ldap-bind-password -n openshift-config

2. LDAP Identity Provider

Buat oauth-ldap.yaml:

apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - ldap:
      attributes:
        email:
        - mail
        id:
        - dn
        name:
        - cn
        preferredUsername:
        - uid
      bindDN: cn=openshift-bind,ou=service,dc=iqiterate,dc=id
      bindPassword:
        name: ldap-bind-password
      insecure: false
      url: ldaps://ldap.iqiterate.id:636/ou=users,dc=iqiterate,dc=id?uid?sub
    mappingMethod: claim
    name: ldap
    type: LDAP

Apply:

oc apply -f oauth-ldap.yaml

3. Memahami URL LDAP

URL menggunakan format standar LDAP URL:

ldaps://HOST:PORT/BASE_DN?ATTRIBUTE?SCOPE
Bagian Nilai Keterangan
HOST:PORT ldap.iqiterate.id:636 Server dan port LDAPS
BASE_DN ou=users,dc=iqiterate,dc=id Base pencarian user
ATTRIBUTE uid Attribute yang dicocokkan dengan input login
SCOPE sub Cari ke seluruh subtree

Ketika user login dengan iqbal, OpenShift mencari entry dengan uid=iqbal di bawah ou=users.

4. Apa fungsi bindDN?

bindDN adalah service account yang digunakan OpenShift untuk bind dan search ke LDAP — bukan akun login pengguna/personal.

OpenShift OAuth
      |
      | bind sebagai openshift-bind
      v
openshift-bind mencari user: uid=iqbal
      |
      v
authenticate sebagai iqbal

5. Mengapa mappingMethod: claim?

claim mengatur bagaimana identity LDAP dipetakan ke object User OpenShift dan memungkinkan provisioning otomatis saat login pertama.

claim bukan pengaturan role. Authorization tetap ditentukan oleh group dan RBAC.

6. Verify OAuth

oc get clusteroperator authentication

Target kondisi:

AVAILABLE    True
PROGRESSING  False
DEGRADED     False

Cek pod authentication:

oc get pods -n openshift-authentication

Lihat log jika diperlukan:

oc logs -n openshift-authentication \
  -l app=oauth-openshift --tail=100

7. Test login

oc login https://api.<cluster-domain>:6443 -u iqbal
oc whoami

Expected output:

iqbal

8. RFC2307 Group Sync

Authentication tidak otomatis membuat group LDAP menjadi OpenShift Group — perlu group sync terpisah.

Karena group LDAP menggunakan objectClass: groupOfNames dengan member, gunakan konfigurasi RFC2307. Buat rfc2307_config.yaml:

kind: LDAPSyncConfig
apiVersion: v1

url: ldaps://ldap.iqiterate.id:636
insecure: false

bindDN: "cn=openshift-bind,ou=service,dc=iqiterate,dc=id"

bindPassword:
  file: "/etc/ldap-sync/bindPassword"

rfc2307:
  groupsQuery:
    baseDN: "ou=groups,dc=iqiterate,dc=id"
    scope: sub
    derefAliases: never
    filter: "(&(objectClass=groupOfNames)(|(cn=openshift-admins)(cn=openshift-users)))"
    pageSize: 0

  groupUIDAttribute: dn
  groupNameAttributes:
  - cn
  groupMembershipAttributes:
  - member

  usersQuery:
    baseDN: "ou=users,dc=iqiterate,dc=id"
    scope: sub
    derefAliases: never
    filter: "(objectClass=inetOrgPerson)"
    pageSize: 0

  userUIDAttribute: dn
  userNameAttributes:
  - uid

  tolerateMemberNotFoundErrors: false
  tolerateMemberOutOfScopeErrors: false

Filter group dibatasi hanya ke openshift-admins dan openshift-users.

9. Secret dan ConfigMap untuk sync

Secret bind password:

oc create secret generic ldap-sync-secret \
  --from-literal=bindPassword='PASSWORD_OPENSHIFT_BIND' \
  -n openshift-config

ConfigMap config file:

oc create configmap ldap-sync-config \
  --from-file=rfc2307_config.yaml=rfc2307_config.yaml \
  -n openshift-config

10. Test sync manual

Sebelum automation, test manual dulu:

oc adm groups sync \
  --sync-config=rfc2307_config.yaml \
  --confirm

Cek group yang terbentuk:

oc get groups

Expected:

openshift-admins
openshift-users

Detail membership:

oc describe group openshift-admins

Expected terdapat iqbal di bagian Users.

11. Mapping group ke RBAC

LDAP group tidak otomatis memiliki role di OpenShift. Mapping role dilakukan secara eksplisit menggunakan policy binding:

A. Assign Cluster Role ke Masing-Masing Group

# 1. openshift-admins -> Full Administrator (cluster-admin)
oc adm policy add-cluster-role-to-group \
  cluster-admin \
  openshift-admins

# 2. openshift-users -> View Only / Read-Only (view)
oc adm policy add-cluster-role-to-group \
  view \
  openshift-users

Catatan: Role view memberikan izin membaca (read-only) seluruh resource klaster seperti Pods, Services, dan Logs tanpa izin mengubah atau menghapus resource. Jika ingin membatasi akses view hanya ke project/namespace tertentu, gunakan add-role-to-group dengan parameter -n <project-name>.

B. Verifikasi Hak Akses (Auth Can-I)

Uji izin akses user biasa (anggota openshift-users):

# Cek izin melihat pod (diharapkan: yes)
oc auth can-i get pods -A --as=user-biasa

# Cek izin membuat atau menghapus pod (diharapkan: no)
oc auth can-i delete pods -A --as=user-biasa

Alur mapping authorization:

LDAP Groups               OpenShift Groups         Roles (RBAC)
openshift-admins   ───►   openshift-admins   ───►  cluster-admin (Full Access)
openshift-users    ───►   openshift-users    ───►  view (View Only / Read-Only)

12. CronJob group sync

Setelah manual sync berhasil, buat CronJob untuk automation. Buat ldap-sync-cronjob.yaml:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: ldap-group-sync
  namespace: openshift-config
spec:
  schedule: "0 */2 * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3

  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: cluster-admin
          restartPolicy: OnFailure

          containers:
          - name: sync
            image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest
            command:
            - /bin/bash
            - -c
            - |
              oc adm groups sync \
                --sync-config=/etc/config/rfc2307_config.yaml \
                --confirm

            volumeMounts:
            - name: config-vol
              mountPath: /etc/config
            - name: secret-vol
              mountPath: /etc/ldap-sync

          volumes:
          - name: config-vol
            configMap:
              name: ldap-sync-config
          - name: secret-vol
            secret:
              secretName: ldap-sync-secret

Apply:

oc apply -f ldap-sync-cronjob.yaml

Verifikasi:

oc get cronjob -n openshift-config

13. Test CronJob tanpa menunggu schedule

oc create job \
  --from=cronjob/ldap-group-sync \
  ldap-group-sync-manual \
  -n openshift-config

Cek status job:

oc get jobs -n openshift-config

Lihat log:

oc logs -n openshift-config job/ldap-group-sync-manual

14. User lifecycle: LDAP vs OpenShift

Perlu dipahami bahwa LDAP user dan OpenShift User object adalah dua entitas berbeda:

Kondisi Akibat
User dihapus dari LDAP Authentication berikutnya gagal, tapi object User di OpenShift tidak otomatis terhapus
User dibuat ulang di LDAP dengan DN sama Dapat kembali login, object User OpenShift yang lama tetap terikat
Group sync dijalankan Membership group di OpenShift diperbarui sesuai LDAP

LDAP sebaiknya diperlakukan sebagai source of truth untuk users, groups, dan authentication.

15. Arsitektur final

                     LDAP / LDAPS
                          |
                          v
                389 Directory Server
                          |
          +---------------+---------------+
          |               |               |
        users           groups          service
          |               |               |
        iqbal      openshift-admins   openshift-bind
                   openshift-users
                          |
                          v
                OpenShift Group Sync
                          |
                          v
                     OCP Groups
                          |
                          v
                         RBAC
                          |
               +----------+----------+
               |                     |
         cluster-admin              view
       (openshift-admins)     (openshift-users)

Dengan pola ini, satu identity LDAP dapat digunakan lintas platform, sedangkan service account dan mapping group dapat dipisahkan per aplikasi.