LldapMembership

An LldapMembership resource binds an lldap user to an lldap group.

Each resource must carry the lldap-operator.lukidoescode.com/lldap-instance label whose value selects which lldap instance the membership applies to.

The userName and groupName fields reference the lldap-side identifiers (the spec.username of an LldapUser and the spec.displayName of an LldapGroup), not Kubernetes metadata.name values.

Example

apiVersion: lldap-operator.lukidoescode.com/v1alpha1
kind: LldapMembership
metadata:
  name: alice-engineering
  labels:
    lldap-operator.lukidoescode.com/lldap-instance: default
spec:
  userName: "alice.smith"
  groupName: "Engineering"

Spec Fields

Validation Rules

Admission-time validation (CEL)

• Instance label required — rejected with:

  metadata.labels must include 'lldap-operator.lukidoescode.com/lldap-instance' with a non-empty value

  The label must be set to a non-empty string identifying which lldap instance the membership belongs to.

Reconcile-time validation (reference checks)

The reconciler verifies cross-resource references before applying a membership:

• The referenced LldapUser (matched by spec.username equal to this resource’s spec.userName) must exist in the same namespace as the membership.
• The referenced LldapGroup (matched by spec.displayName equal to this resource’s spec.groupName) must exist in the same namespace as the membership.
• All three resources (user, group, membership) must carry the same lldap-operator.lukidoescode.com/lldap-instance label value.

On failure the reconciler returns a hard error and the membership’s Ready condition is set to False with one of these reasons: UserNotFound, GroupNotFound, MissingNamespace, MissingInstanceLabel.

Note: the reconciler is not yet wired up. The validation function (validate_membership_references) is implemented in lldap-operator-reconciler and will be invoked once the reconciler is built.

Status