LldapUser

An LldapUser resource declares an lldap user account managed by the operator.

Each resource must carry the lldap-operator.lukidoescode.com/lldap-instance label whose value selects which lldap instance the user belongs to. The operator ignores resources without this label.

Example

apiVersion: lldap-operator.lukidoescode.com/v1alpha1
kind: LldapUser
metadata:
  name: alice
  labels:
    lldap-operator.lukidoescode.com/lldap-instance: default
spec:
  username: "alice.smith"
  email: "alice.smith@example.com"
  displayName: "Alice Smith"
  firstName: "Alice"
  lastName: "Smith"
  passwordPolicy: Manage
  passwordSecretRef:
    name: alice-password
    key: password
  attributes:
    - name: department
      value:
        - "Engineering"
---
apiVersion: v1
kind: Secret
metadata:
  name: alice-password
type: Opaque
stringData:
  password: "change-me-on-first-login"

Spec Fields

Validation Rules

The following rules are enforced at admission time by the Kubernetes API server via CRD-embedded CEL expressions (requires Kubernetes 1.25+).

• Instance label required — rejected with:

  metadata.labels must include 'lldap-operator.lukidoescode.com/lldap-instance' with a non-empty value

  The label must be set to a non-empty string identifying which lldap instance owns this user.

• Password secret required for managed policies — rejected with:

  spec.passwordSecretRef is required when spec.passwordPolicy is 'Manage' or 'InitialOnly' (only 'Ignore' permits omitting it)

  When passwordPolicy is Manage (the default) or InitialOnly, the operator needs a Secret reference to source the password from. Only Ignore permits omitting passwordSecretRef.

Group memberships are not declared on LldapUser. Use LldapMembership to attach users to groups.

Status