Skip to content

Commit 4656a36

Browse files
pratdash-orclpratdash-orcl
authored
Initial checkin for OID on kubernetes (#80)
1 parent e11e425 commit 4656a36

File tree

28 files changed

+2378
-0
lines changed

28 files changed

+2378
-0
lines changed

‎CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
* @rdas0405
55
/OracleAccessManagement/ @pratdash-orcl
66
/OracleIdentityGovernance/ @rishiagarwal-oracle
7+
/OracleInternetDirectory/ @pratdash-orcl @kuldeepbshah
78
/OracleSOASuite/ @sbattagi
89
/OracleUnifiedDirectory/ @kuldeepbshah @surya902 @pratdash-orcl
910
/OracleUnifiedDirectorySM/ @kuldeepbshah @surya902 @pratdash-orcl

‎OracleInternetDirectory/kubernetes/README.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
## Oracle Internet Directory (OID) on Kubernetes
2+
3+
Oracle Internet Directory provides a comprehensive Directory Solution for robust Identity Management.
4+
Oracle Internet Directory is an all-in-one directory solution with storage, proxy, synchronization and virtualization capabilities. While unifying the approach, it provides all the services required for high-performance Enterprise and carrier-grade environments. Oracle Internet Directory ensures scalability to billions of entries, ease of installation, elastic deployments, enterprise manageability and effective monitoring.
5+
6+
This project supports deployment of Oracle Internet Directory (OID) Docker images based on the 12cPS4 (12.2.1.4.0) release within a Kubernetes environment. The OID Docker Image refers to binaries for OID Release 12.2.1.4.0.
7+
8+
This project has several key features to assist you with deploying and managing Oracle Internet Directory in a Kubernetes environment. You can:
9+
10+
* Create Oracle Internet Directory instances in a Kubernetes persistent volume (PV). This PV can reside in an NFS file system or other Kubernetes volume types.
11+
* Start servers based on declarative startup parameters and desired states.
12+
* Expose the Oracle Internet Directory services for external access.
13+
* Scale Oracle Internet Directory by starting and stopping servers on demand.
14+
15+
Follow the instructions in this guide to set up Oracle Internet Directory on Kubernetes.
16+
17+
### Getting started
18+
19+
For detailed information about deploying OID on Kubernetes refer to the [Oracle Internet Directory on Kubernetes](https://oracle.github.io/fmw-kubernetes/oid/) documentation.
20+
21+
### Current release
22+
23+
The current supported release of Oracle Internet Directory is OID 12c PS4 (12.2.1.4.0)
24+

‎OracleInternetDirectory/kubernetes/helm/.helmignore‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#
2+
# Copyright (c) 2021, Oracle and/or its affiliates.
3+
#
4+
# Licensed under the Universal Permissive License v 1.0 as shown at
5+
# https://oss.oracle.com/licenses/upl
6+
#
7+
# Patterns to ignore when building packages.
8+
# This supports shell glob matching, relative path matching, and
9+
# negation (prefixed with !). Only one pattern per line.
10+
.DS_Store
11+
# Common VCS dirs
12+
.git/
13+
.gitignore
14+
.bzr/
15+
.bzrignore
16+
.hg/
17+
.hgignore
18+
.svn/
19+
# Common backup files
20+
*.swp
21+
*.bak
22+
*.tmp
23+
*.orig
24+
*~
25+
# Various IDEs
26+
.project
27+
.idea/
28+
*.tmproj
29+
.vscode/
30+
.#*

‎OracleInternetDirectory/kubernetes/helm/oid/Chart.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#
2+
# Copyright (c) 2021, Oracle and/or its affiliates.
3+
#
4+
# Licensed under the Universal Permissive License v 1.0 as shown at
5+
# https://oss.oracle.com/licenses/upl
6+
#
7+
apiVersion: v2
8+
name: oid
9+
description: A Helm chart for deployment of OID instances on Kubernetes. This chart will deploy an OID instance as base with configured sample entries and multiple OID instances/pods/services based on the specified replicaCount.
10+
11+
# A chart can be either an 'application' or a 'library' chart.
12+
#
13+
# Application charts are a collection of templates that can be packaged into versioned archives
14+
# to be deployed.
15+
#
16+
# Library charts provide useful utilities or functions for the chart developer. They're included as
17+
# a dependency of application charts to inject those utilities and functions into the rendering
18+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
19+
type: application
20+
21+
# This is the chart version. This version number should be incremented each time you make changes
22+
# to the chart and its templates, including the app version.
23+
version: 0.1
24+
25+
# This is the version number of the application being deployed. This version number should be
26+
# incremented each time you make changes to the application.
27+
appVersion: 12.2.1.4.0

‎OracleInternetDirectory/kubernetes/helm/oid/templates/_helpers.tpl‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
#
2+
# Copyright (c) 2021, Oracle and/or its affiliates.
3+
#
4+
# Licensed under the Universal Permissive License v 1.0 as shown at
5+
# https://oss.oracle.com/licenses/upl
6+
#
7+
{{/* vim: set filetype=mustache: */}}
8+
{{/*
9+
Expand the name of the chart.
10+
*/}}
11+
{{- define "oid.name" -}}
12+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
13+
{{- end -}}
14+
15+
{{/*
16+
Create a default fully qualified app name.
17+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
18+
If release name contains chart name it will be used as a full name.
19+
*/}}
20+
{{- define "oid.fullname" -}}
21+
{{- if .Values.fullnameOverride -}}
22+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
23+
{{- else -}}
24+
{{- $name := default .Chart.Name .Values.nameOverride -}}
25+
{{- if contains $name .Release.Name -}}
26+
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
27+
{{- else -}}
28+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
29+
{{- end -}}
30+
{{- end -}}
31+
{{- end -}}
32+
33+
{{/*
34+
Create chart name and version as used by the chart label.
35+
*/}}
36+
{{- define "oid.chart" -}}
37+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
38+
{{- end -}}
39+
40+
{{/*
41+
Common labels
42+
*/}}
43+
{{- define "oid.labels" -}}
44+
helm.sh/chart: {{ include "oid.chart" . }}
45+
{{ include "oid.selectorLabels" . }}
46+
{{- if .Chart.AppVersion }}
47+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
48+
{{- end }}
49+
app.kubernetes.io/managed-by: {{ .Release.Service }}
50+
{{- end -}}
51+
52+
{{/*
53+
Selector labels
54+
*/}}
55+
{{- define "oid.selectorLabels" -}}
56+
app.kubernetes.io/name: {{ include "oid.name" . }}
57+
app.kubernetes.io/instance: {{ .Release.Name }}
58+
{{- end -}}
59+
60+
{{/*
61+
Create the name of the service account to use
62+
*/}}
63+
{{- define "oid.serviceAccountName" -}}
64+
{{- if .Values.serviceAccount.create -}}
65+
{{ default (include "oid.fullname" .) .Values.serviceAccount.name }}
66+
{{- else -}}
67+
{{ default "default" .Values.serviceAccount.name }}
68+
{{- end -}}
69+
{{- end -}}
70+
71+
{{/*
72+
Generate Self-signed Certificates for oid
73+
Ref: sprig's crypto
74+
*/}}
75+
{{- define "oid.gen-selfsigned-certs" -}}
76+
{{- $altNames := list ( printf "%s.%s" (include "oid.name" .) .Release.Namespace ) ( printf "%s.%s.svc" (include "oid.name" .) .Release.Namespace ) -}}
77+
{{- $certCN := default ( include "oid.fullname" . ) (.Values.ingress.certCN) -}}
78+
{{- $cert := genSelfSignedCert $certCN nil $altNames (.Values.ingress.certValidityDays | int) -}}
79+
tls.crt: {{ $cert.Cert | b64enc }}
80+
tls.key: {{ $cert.Key | b64enc }}
81+
{{- end -}}

‎OracleInternetDirectory/kubernetes/helm/oid/templates/cluster-rolebinding.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#
2+
# Copyright (c) 2021, Oracle and/or its affiliates.
3+
#
4+
# Licensed under the Universal Permissive License v 1.0 as shown at
5+
# https://oss.oracle.com/licenses/upl
6+
#
7+
{{- if .Values.serviceAccount.create -}}
8+
#
9+
apiVersion: rbac.authorization.k8s.io/v1beta1
10+
kind: ClusterRoleBinding
11+
metadata:
12+
name: {{ include "oid.fullname" . }}-admin
13+
roleRef:
14+
apiGroup: rbac.authorization.k8s.io
15+
kind: ClusterRole
16+
name: {{ include "oid.fullname" . }}-cluster-admin
17+
subjects:
18+
- kind: ServiceAccount
19+
name: {{ include "oid.serviceAccountName" . }}
20+
namespace: {{ .Release.Namespace }}
21+
{{- end }}

‎OracleInternetDirectory/kubernetes/helm/oid/templates/clusterrole.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#
2+
# Copyright (c) 2021, Oracle and/or its affiliates.
3+
#
4+
# Licensed under the Universal Permissive License v 1.0 as shown at
5+
# https://oss.oracle.com/licenses/upl
6+
#
7+
{{- if .Values.serviceAccount.create -}}
8+
#
9+
apiVersion: rbac.authorization.k8s.io/v1
10+
kind: ClusterRole
11+
metadata:
12+
name: {{ include "oid.fullname" . }}-cluster-admin
13+
rules:
14+
- apiGroups: ["rbac.authorization.k8s.io"]
15+
resources: ["*"]
16+
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
17+
{{- end -}}

‎OracleInternetDirectory/kubernetes/helm/oid/templates/ingress-nginx.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
#
2+
# Copyright (c) 2021, Oracle and/or its affiliates.
3+
#
4+
# Licensed under the Universal Permissive License v 1.0 as shown at
5+
# https://oss.oracle.com/licenses/upl
6+
#
7+
{{- if and (.Values.ingress.enabled) (eq .Values.ingress.type "nginx") -}}
8+
{{- $fullName := include "oid.fullname" . -}}
9+
{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }}
10+
apiVersion: networking.k8s.io/v1beta1
11+
{{- else }}
12+
apiVersion: extensions/v1beta1
13+
{{- end }}
14+
kind: Ingress
15+
metadata:
16+
name: {{ $fullName }}-ingress-nginx
17+
labels:
18+
{{- include "oid.labels" . | nindent 4 }}
19+
annotations:
20+
{{- if (.Values.ingress.tlsEnabled) }}
21+
{{- with .Values.ingress.admin.nginxAnnotationsTLS }}
22+
{{- toYaml . | nindent 4 }}
23+
{{- end }}
24+
{{- else }}
25+
{{- with .Values.ingress.admin.nginxAnnotations }}
26+
{{- toYaml . | nindent 4 }}
27+
{{- end }}
28+
{{- end }}
29+
spec:
30+
tls:
31+
{{- if (.Values.ingress.tlsSecret) }}
32+
- secretName: {{ .Values.ingress.tlsSecret }}
33+
{{- else }}
34+
- secretName: {{ include "oid.fullname" . }}-tls-cert
35+
{{- end }}
36+
hosts:
37+
- {{ include "oid.fullname" . }}
38+
rules:
39+
- http:
40+
paths:
41+
- path: /odsm
42+
backend:
43+
serviceName: {{ include "oid.fullname" . }}host1
44+
servicePort: {{ .Values.ingress.http.backendPort }}
45+
- path: /console
46+
backend:
47+
serviceName: {{ include "oid.fullname" . }}host1
48+
servicePort: {{ .Values.ingress.http.backendPort }}
49+
{{- end }}

‎OracleInternetDirectory/kubernetes/helm/oid/templates/ingress-voyager.yaml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
#
2+
# Copyright (c) 2021, Oracle and/or its affiliates.
3+
#
4+
# Licensed under the Universal Permissive License v 1.0 as shown at
5+
# https://oss.oracle.com/licenses/upl
6+
#
7+
{{- $root := . -}}
8+
{{- if and (.Values.ingress.enabled) (eq .Values.ingress.type "voyager") -}}
9+
{{- $fullName := include "oid.fullname" . -}}
10+
{{- $svcPort := .Values.service.port -}}
11+
{{- $svcSslPort := .Values.service.sslPort -}}
12+
{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }}
13+
# apiVersion: networking.k8s.io/v1beta1
14+
apiVersion: voyager.appscode.com/v1beta1
15+
{{- else }}
16+
apiVersion: extensions/v1beta1
17+
{{- end }}
18+
kind: Ingress
19+
metadata:
20+
name: {{ $fullName }}-ingress-voyager
21+
labels:
22+
{{- include "oid.labels" . | nindent 4 }}
23+
annotations:
24+
{{- if (.Values.ingress.tlsEnabled) }}
25+
{{- with .Values.ingress.voyagerAnnotationsTLS }}
26+
{{- toYaml . | nindent 4 }}
27+
{{- end }}
28+
{{- else }}
29+
{{- with .Values.ingress.voyagerAnnotations }}
30+
{{- toYaml . | nindent 4 }}
31+
{{- end }}
32+
{{- end }}
33+
spec:
34+
frontendRules:
35+
- port: {{ .Values.ingress.voyagerHttpsPort }}
36+
rules:
37+
- http-request del-header WL-Proxy-Client-IP
38+
- http-request del-header WL-Proxy-SSL
39+
- http-request set-header WL-Proxy-SSL true
40+
tls:
41+
{{- if (.Values.ingress.tlsSecret) }}
42+
- secretName: {{ .Values.ingress.tlsSecret }}
43+
hosts:
44+
- '*'
45+
{{- else }}
46+
- secretName: {{ include "oid.fullname" . }}-tls-cert
47+
hosts:
48+
- '*'
49+
{{- end }}
50+
rules:
51+
- host: '*'
52+
http:
53+
paths:
54+
- path: /odsm
55+
backend:
56+
serviceName: {{ include "oid.fullname" . }}host1
57+
servicePort: {{ .Values.ingress.http.backendPort }}
58+
- path: /console
59+
backend:
60+
serviceName: {{ include "oid.fullname" . }}host1
61+
servicePort: {{ .Values.ingress.http.backendPort }}
62+
- host: '{{ include "oid.fullname" . }}*'
63+
tcp:
64+
port: {{ .Values.oidPorts.ldap }}
65+
noTLS: true
66+
backend:
67+
serviceName: {{ include "oid.fullname" . }}-lbr-ldap
68+
servicePort: {{ .Values.oidPorts.ldap }}
69+
- host: '{{ include "oid.fullname" . }}*'
70+
tcp:
71+
port: {{ .Values.oidPorts.ldaps }}
72+
backend:
73+
serviceName: {{ include "oid.fullname" . }}-lbr-ldap
74+
servicePort: {{ .Values.oidPorts.ldaps }}
75+
76+
{{- $ldapPort := .Values.ingress.voyagerTcpPortPrefix.ldap }}
77+
{{- $ldapsPort := .Values.ingress.voyagerTcpPortPrefix.ldaps }}
78+
79+
- host: {{ include "oid.fullname" . }}host1
80+
tcp:
81+
port: {{ $ldapPort }}1
82+
noTLS: true
83+
backend:
84+
serviceName: {{ include "oid.fullname" . }}host1
85+
servicePort: ldap
86+
- host: {{ include "oid.fullname" . }}host1
87+
tcp:
88+
port: {{ $ldapsPort }}1
89+
backend:
90+
serviceName: {{ include "oid.fullname" . }}host1
91+
servicePort: ldaps
92+
93+
{{- range $replicaIndex, $replicaN := until (.Values.replicaCount|int) }}
94+
{{- $replicaIndx := (add $replicaIndex 2) }}
95+
- host: {{ include "oid.fullname" $root }}host{{ $replicaIndx }}
96+
tcp:
97+
port: {{ $ldapPort }}{{ $replicaIndx }}
98+
noTLS: true
99+
backend:
100+
serviceName: {{ include "oid.fullname" $root }}host{{ $replicaIndx }}
101+
servicePort: ldap
102+
- host: {{ include "oid.fullname" $root }}host{{ $replicaIndx }}
103+
tcp:
104+
port: {{ $ldapsPort }}{{ $replicaIndx }}
105+
backend:
106+
serviceName: {{ include "oid.fullname" $root }}host{{ $replicaIndx }}
107+
servicePort: ldaps
108+
{{- end }}
109+
{{- end }}

0 commit comments

Comments
 (0)