接入 LDAP / AD 域账号（Beta）

#!/bin/bash
set -e

host="139.198.111.111:30222"    # 将 host 的值改为实际的服务器 IP 与 端口
managerDN="cn=Administrator,cn=Users,dc=kubesphere,dc=com"  # 值修改为实际的 AD 域的管理账号, 可以为只读账号
managerPWD="123456789"    #  管理账号密码
userSearchBase="cn=Users,dc=kubesphere,dc=com"   # 根据实际配置进行修改
sidecar="kubespheredev/ad-sidecar:v0.0.1"

generate_config() {
cat << EOF
apiVersion: v1
data:
  sync.yaml: |
    sync:
      interval: "300s"
    src:
      host: "${host}"
      managerDN: "${managerDN}"
      managerPWD: "${managerPWD}"
      userSearchBase: "${userSearchBase}"
      usernameAttribute: "sAMAccountName"
      descriptionAttribute: "description"
      mailAttribute: "mail"
    dst:
      host: "openldap.kubesphere-system.svc:389"
      managerDN: "cn=admin,dc=kubesphere,dc=io"
      managerPWD: "admin"
      userSearchBase: "ou=Users,dc=kubesphere,dc=io"
kind: ConfigMap
metadata:
  name: ad-sync-config
  namespace: kubesphere-system
EOF
}

# apply sync config
generate_config | kubectl apply -f -


# inject sidecar
kubectl -n kubesphere-system get deploy ks-account -o json | jq '.spec.template.spec.volumes += [{"configMap":{"name":"ad-sync-config"},"name":"ad-sync-config"}]' | jq '.spec.template.spec.containers += [{"command":["ad-sidecar","--logtostderr=true","--v=2"],"image":"'${sidecar}'","imagePullPolicy":"IfNotPresent","name":"ad-sidecar","ports":[{"containerPort":19090,"protocol":"TCP"}],"volumeMounts":[{"mountPath":"/etc/kubesphere/sync.yaml","name":"ad-sync-config","subPath":"sync.yaml"}]}]' | kubectl apply -f -

# use proxy port
kubectl -n kubesphere-system get svc ks-account -o json | jq '.spec.ports[0].targetPort=19090' | kubectl apply -f -