diff --git a/config/crd/bases/awx.ansible.com_awxs.yaml b/config/crd/bases/awx.ansible.com_awxs.yaml index b69d164e2..4583b0596 100644 --- a/config/crd/bases/awx.ansible.com_awxs.yaml +++ b/config/crd/bases/awx.ansible.com_awxs.yaml @@ -1862,6 +1862,10 @@ spec: ldap_password_secret: description: Secret where can be found the LDAP bind password type: string + ldap_skip_tls_verify: + description: Skip TLS verification for LDAP + default: false + type: boolean bundle_cacert_secret: description: Secret where can be found the trusted Certificate Authority Bundle type: string diff --git a/config/manifests/bases/awx-operator.clusterserviceversion.yaml b/config/manifests/bases/awx-operator.clusterserviceversion.yaml index add249011..6e5b8768f 100644 --- a/config/manifests/bases/awx-operator.clusterserviceversion.yaml +++ b/config/manifests/bases/awx-operator.clusterserviceversion.yaml @@ -727,6 +727,11 @@ spec: x-descriptors: - urn:alm:descriptor:com.tectonic.ui:advanced - urn:alm:descriptor:io.kubernetes:Secret + - displayName: Skip TLS verification for LDAP? + path: ldap_skip_tls_verify + x-descriptors: + - urn:alm:descriptor:com.tectonic.ui:advanced + - urn:alm:descriptor:com.tectonic.ui:booleanSwitch - displayName: Task Args path: task_args x-descriptors: diff --git a/roles/installer/defaults/main.yml b/roles/installer/defaults/main.yml index 277da25c9..65f8192b3 100644 --- a/roles/installer/defaults/main.yml +++ b/roles/installer/defaults/main.yml @@ -440,6 +440,9 @@ ldap_cacert_secret: '' # Secret to lookup that provides the LDAP bind password ldap_password_secret: '' +# Whether or not to skip TLS verification for LDAP +ldap_skip_tls_verify: false + # Secret to lookup that provides the custom CA trusted bundle bundle_cacert_secret: '' diff --git a/roles/installer/templates/settings/ldap.py.j2 b/roles/installer/templates/settings/ldap.py.j2 index aa50cfcfe..4289cb0fd 100644 --- a/roles/installer/templates/settings/ldap.py.j2 +++ b/roles/installer/templates/settings/ldap.py.j2 @@ -1,6 +1,10 @@ AUTH_LDAP_GLOBAL_OPTIONS = { {% if ldap_cacert_ca_crt %} + {% if ldap_skip_tls_verify %} + ldap.OPT_X_TLS_REQUIRE_CERT: ldap.OPT_X_TLS_NEVER, + {% else %} ldap.OPT_X_TLS_REQUIRE_CERT: True, + {% endif %} ldap.OPT_X_TLS_CACERTFILE: "/etc/openldap/certs/ldap-ca.crt" {% endif %} }