lldap-operator

A Kubernetes operator that manages lldap users and groups as native Kubernetes resources via Custom Resource Definitions (CRDs).

Note: This project is in early development. APIs are not stable.

Features

• Declare lldap users and groups as Kubernetes CRDs
• Reconcile desired state with lldap via its GraphQL API
• Password management through Kubernetes Secret references
• Standard operator patterns: status conditions, finalizers, observed generation

Installation

Install using Helm:

helm repo add lldap-operator https://lukidoescode.github.io/lldap-operator
helm install lldap-operator lldap-operator/lldap-operator

Usage

Creating a group

apiVersion: lldap-operator.lukidoescode.com/v1alpha1kind: LldapGroupmetadata:
name: my-groupspec:
displayName: "My Group"

Creating a user

apiVersion: lldap-operator.lukidoescode.com/v1alpha1kind: LldapUsermetadata:
name: my-userspec:
username: "my.user"email: "my.user@example.com"displayName: "My User"firstName: "My"lastName: "User"groups:
- "my-group"passwordSecretRef:
name: my-user-passwordkey: password

Architecture

The operator is built in Rust using kube-rs and organized as a Cargo workspace:

Crate	Purpose
lldap-operator	Operator binary
lldap-operator-crds	CRD type definitions
lldap-operator-traits	Trait definitions for lldap operations
lldap-operator-client	GraphQL client for lldap
lldap-operator-reconciler	Reconciliation business logic

Development

Prerequisites

• Rust 1.88+
• Docker
• kind
• Helm
• kubectl

Local setup

./scripts/local-dev-setup.sh

This creates a kind cluster, deploys an lldap test instance, and installs the CRDs.

License

MIT