Helm Chart Completion

[lukidoescode]

Motivation

The Helm chart must be production-ready, configurable, and support the multi- instance deployment pattern.

Definition of Done

• Chart values support:
  • lldap.url — lldap base URL
  • lldap.credentialsSecret — Secret name with admin username/password
  • lldap.instanceLabel — the instance label value this operator manages
  • virtualGroupNamespace — namespace for virtual built-in group CRDs (defaults to release namespace)
  • metrics.enabled, metrics.port — Prometheus metrics toggle
  • resources, nodeSelector, tolerations, affinity — standard
  • podDisruptionBudget.enabled, podDisruptionBudget.minAvailable
  • serviceMonitor.enabled (for Prometheus Operator integration)
• Templates include:
  • Deployment (with health/readiness probes). Strategy MUST be Recreate (hardcoded, not configurable) — two concurrent instances with the same instance label would corrupt state.
  • ServiceAccount + ClusterRole + ClusterRoleBinding
  • PodDisruptionBudget (optional)
  • Service (for metrics endpoint)
  • ServiceMonitor (optional, for Prometheus Operator)
• CRD YAMLs are generated from the Rust crate (via crdgen binary) and stored in charts/lldap-operator/crds/.
• The Deployment template includes a hardened securityContext: runAsNonRoot: true, readOnlyRootFilesystem: true, allowPrivilegeEscalation: false, capabilities: {drop: [ALL]}.
• Default resource requests are set: cpu: 100m, memory: 64Mi (so clusters with LimitRanges don't reject the pod). Limits are configurable.
• The lldap.credentialsSecret is mounted as a volume into the pod. The operator reads credentials from files rather than environment variables, enabling credential rotation without pod restart (see Ticket Operator Credential Rotation Handling #7). The expected Secret keys (username, password) and the mount path are documented in the values file and the Installation chapter.
• Chart lints cleanly (helm lint).
• Documentation: The Installation chapter is completed with step-by-step Helm install instructions, prerequisites, and a quickstart guide. The Multi- Instance Deployment chapter is filled in with examples of deploying multiple operators for different lldap instances. The Configuration Reference includes all Helm values with descriptions and defaults.

Technical Details

• ClusterRole must include permissions for:
  • All four CRDs (get, list, watch, patch, update)
  • Status subresources of all four CRDs (get, patch, update)
  • Secrets (get, list, watch) — for password reading
  • Events (create, patch) — for event recording
  • Leases (get, create, update) — if leader election is added later
• The operator needs cluster-wide watch permissions (ClusterRole) because it watches resources across namespaces (filtered by label).
• Health probe: GET /healthz returns 200 if the controller is running.
• Readiness probe: GET /readyz returns 200 if lldap is reachable and controllers are synced.