klap is a Kubernetes operator that declaratively manages LDAP directory entries via custom resources.

klap reconciles Kubernetes custom resources with remote LDAP directories. Define your directory entries as Kubernetes objects and let the operator handle creates, updates and deletes.

Two CRDs are provided:

Key features:

• Declarative LDAP entry lifecycle (create, update, prune on delete)
• TLS and StartTLS support with custom CA bundles
• DN validation via admission webhooks
• Supports OpenLDAP and Active Directory (beta)
• Remote entry UUID/GUID tracked in resource status
• Helm chart available as OCI artifact

• Kubernetes cluster with admission webhook support
• cert-manager (required for webhook certificates)
• Helm 3

helm install klap oci://ghcr.io/ripolin/helm/klap --version <version> \
  --namespace klap-system \
  --create-namespace

kubectl apply -k config/default

apiVersion: klap.ripolin.github.com/v1alpha1
kind: Server
metadata:
  name: ldap-server
  namespace: default
spec:
  url: ldap://ldap.openldap.svc.cluster.local
  baseDN: dc=example,dc=org
  bindDN: cn=admin,dc=example,dc=org
  passwordSecretRef:
    name: ldap-passwd
    namespace: default
  implementation: openldap  # or activedirectory (beta)
  startTLS: false

kubectl create secret generic ldap-passwd \
  --from-literal=password=<your-password>

apiVersion: klap.ripolin.github.com/v1alpha1
kind: Entry
metadata:
  name: joe
  namespace: default
spec:
  dn: cn=joe,dc=example,dc=org
  prune: true       # delete LDAP entry when this resource is deleted
  force: false      # allow destructive attribute changes
  attributes:
    objectClass:
      - inetOrgPerson
    sn:
      - Doe
    mail:
      - joe@example.org
  serverRef:
    name: ldap-server
    namespace: default

Once applied, klap creates or updates the corresponding entry in the LDAP directory. The remote entry UUID is stored in status.guid.

By default passwordSecretRef reads the password key and tlsSecretRef reads ca.crt. Both can be overridden:

spec:
  tlsSecretRef:
    name: ldap-tls
    namespace: default
    key: myBundle

• Go (see go.mod)
• Docker
• kubectl and a local cluster (e.g. kind)

make docker-build IMG=<registry>/klap:dev  # build the controller image
make install                               # install CRDs
make deploy IMG=<registry>/klap:dev        # deploy via Kustomize
make helm-deploy IMG=<registry>/klap:dev   # deploy via Helm
make test                                  # run unit tests
make test-e2e                              # run e2e tests (requires a cluster)
make undeploy && make uninstall            # cleanup

Ready-to-use manifests are available in config/samples/.

Issues and pull requests are welcome. Please follow the existing commit convention (used to generate the changelog via git-cliff).

Apache 2.0 — see LICENSE.