OpenShift pod certificate installation

Question

I have an OpenShift PHP pod running an application and I need to authenticate a user account against an Active Directory server. The LDAP bind is failing with a certificate error

LDAP Error (authenticateUser), Cannot bind to LDAP : error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (unable to get local issuer certificate) - ldap_bind failed

It was suggested I need to install the AD servers certificate into the pod. The certificate has now been copied into the Git repository. I thought I may be able to use a Life Cycle Hook to install the certificate into /etc/openldap/certs/

rollingParams:
  post:
    execNewPod:
      command:
        - /bin/sh
        - '-c'
        - >-
          /usr/bin/cp
          /opt/app-root/src/certificates/certificate.pem
          /etc/openldap/certs/
      containerName: application
    failurePolicy: Ignore

However there is a permissions error - I assume that the deployment is not running as root so the directory is not accessible.

/usr/bin/cp: cannot create regular file '/etc/openldap/certs/certificate.pem': Permission denied

Is it possible to copy this certificate using the DeploymentConfig or is there a better way to do this?

Answer 1

I managed to resolve this. You need to add the ldap.conf and the certificate to ConfigMaps.

 oc create configmap configmap_name --from-file=filenam=path and filename 

Then you need to mount the ConfigMaps:

  volumeMounts:
        - mountPath: /etc/openldap/ldap.conf
          name: openldap-ad-config-volume
          subPath: ldap.conf
        - mountPath: /etc/openldap/certs/certificate.pem
          name: ad-certificate-volume
          subPath: certificate.pem

  volumes:
    - configMap:
        defaultMode: 292
        name: openldap-ad-config
      name: openldap-ad-config-volume
    - configMap:
        defaultMode: 292
        name: ad-certificate
      name: ad-certificate-volume

Property subPath is used so that the rest of the contents of the directory are not excluded as mounting normally mounts the whole of the directory. Property defaultMode is used otherwise the files will be world read/write.