Home 2.14 Shturval Documentation Cluster administrator Services and repositories Services included in the platform Management Cluster Specific Services Authentication module (shturval-auth) LDAP cache (ldap-cache) LDAP cache (ldap-cache)
Раздел «Cluster administrator»: быстрый переход по подразделам
На этой странице
Expand Collapse About the service # Parameter Description System name chart shturval-authComponent sh-ldap-cacheCluster Assignment Sync LDAP user and group data in Redis and HTTP API for viewing, updating and flushing cache. Critical Yes, if LDAP integration is used Namespace shturval-backend
ldap-cache is included in the Helm chart shturval-auth . The cache data is used by backend API , and the LDAP configuration is associated with authn-server .
Contents # Review Architecture Installation/deployment Diagnostics Lifecycle Service parameters 1. Review # Purpose: support fast backend API responses to requests for user and directory group data by updating the Redis cache in the background and monitoring the LDAP configuration from the Secret platform. The /cache/... HTTP layer handles administrative synchronization activities and list fetching.
Features # Contour Purpose User cache controller Background synchronization of user records in Redis users. Group cache controller Background synchronization of groups into a separate Redis. HTTP API Gin Directory cache methods: list, refresh, flush. Watcher Secret ldap-config Updates connection configuration when Secret changes. Cron watcher via /cache/config.json Sets the intervals for synchronization tasks when mounting a file.
Initiation scripts # Event Initiator Effect Start of service pod Ready Redis clients are created. Auto refresh Local cron schedule The data set from LDAP is synchronized. Manual refresh/list/flush backend API Data is updated or read immediately. LDAP Secret changed Administrator Source parameters are reinitialized.
Limitations and implications # Limit Consequence HTTP listens only :8083 The port cannot be changed without a compatible change in delivery. CORS always AllowAllOrigins Consider the service’s network surface. Both Redis required for users and groups The absence of Redis blocks the start. The file /cache/config.json is needed for dynamic cron Check mount if the schedule should be different from defaults.
Place in the chain of command # Backend API accesses the HTTP endpoint of the service in scenarios where retrieval of cached directory entities is needed. In parallel, authn-server uses the directory configuration from Secret for login-flow.
Key Features # Characteristics Description Binar sh-ldap-cacheProcess port 0.0.0.0:8083Helm installation objects helm/auth/templates/dep-ldap-cache.yaml, Service svc-ldap-cacheStorage Two separately configurable Redis: users and groups
2. Architecture # Component Role sh-ldap-cacheGin process and two background cache controllers: users and groups. Redis users/groups Separate storage of user and group caches. Secret watcher Receiving and updating Secret ldap-config. Cron config Timing parameters for synchronization tasks.
3. Installation / deployment # The service is supplied by chart shturval-auth. LDAP, Redis and synchronization schedule settings are changed via ShturvalServicePatch (SSP) shturval-auth.
4. Diagnostics # kubectl get svc -n " ${ NAMESPACE } "
kubectl get pods -n " ${ NAMESPACE } " -o wide
kubectl logs -n " ${ NAMESPACE } " deployment/DEPLOYMENT_LDAP_CACHE --tail= 200
Substitute the Deployment name and NAMESPACE for the actual Helm release.
Symptom Reason Action Pod goes into CrashLoop until ready Redis unavailable Check USER_STORE_ADDR, GROUP_STORE_ADDR and network connectivity. Cache long stale Cron file unavailable or schedule error Restore mount /cache/config.json. LDAP Secret changes were not included in the service Watcher stuck or RBAC unavailable Check service rights and pod events.
5. Life cycle # Step Member Result 1 The process creates Redis stores A connection error causes the pod to restart. 2 Watcher Secret Configures LDAP settings for cache controllers. 3 Cache controller Supports background synchronization tasks. 4 HTTP Layer Serves requests from backend and operator tools.
Stateful reconcile of operator CRs is not performed.
6. Service parameters # Variable Purpose USER_STORE_ADDR, GROUP_STORE_ADDRRedis coordinates. USER_STORE_DB_INDEX, GROUP_STORE_DB_INDEXRedis logical database index. USER_STORE_PASSWD, GROUP_STORE_PASSWDRedis client password. STORE_MASTER, SENTINEL_PASSWDSentinel topology. CACHE_SCAN_SIZE, CACHE_MAX_CONCURRENT_WORKERSCache scanning and LDAP query concurrency options. LDAP_REQUEST_PAGE_SIZE, LDAP_REQUEST_TIMEOUT_SECBehavior of LDAP queries. POD_NAMESPACENamespace pod.
The contents of the Secret ldap-config and the config.json fields define the DN, TLS, and specific parameters for connecting to the directory.
Изменено 2026-05-28 at 14:11