homelab-v/k8s/infra/auth/lldap/deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: lldap
  namespace: lldap
spec:
  selector:
    matchLabels:
      app: lldap
  strategy:
    type: Recreate
  template:
    metadata:
      namespace: lldap
      labels:
        app: lldap
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        runAsGroup: 1001
        fsGroup: 1001
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: lldap
          image: docker.io/lldap/lldap:v0.6.1-alpine-rootless # renovate: docker=docker.io/lldap/lldap
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: [ ALL ]
          envFrom:
            - configMapRef: { name: lldap-config }
            - secretRef: { name: lldap-crypto }
            - secretRef: { name: lldap-credentials }
            - secretRef: { name: smtp-credentials }
          env:
            - name: LLDAP_DATABASE_URL
              valueFrom:
                secretKeyRef: { name: lldap-postgres-app, key: uri }
          ports:
            - { name: ldap, containerPort: 3890 }
            - { name: ldaps, containerPort: 6360 }
            - { name: web, containerPort: 17170 }
          volumeMounts:
            - { name: lldap-data, mountPath: /data }
            - { name: cert, mountPath: /cert }
      volumes:
        - name: cert
          secret:
            secretName: cert
            items: [ { key: tls.key, path: tls.key }, { key: tls.crt, path: tls.crt } ]
        - name: lldap-data
          emptyDir: { }