Docker-openldap: Startup fails upon reboot when using volumes for persistence

[adambom]

Even when using the --copy-service flag, when I reboot a container that has its data stored on a mounted volume, startup fails with this error:

*** CONTAINER_LOG_LEVEL = 3 (info)
*** Copy /container/service to /container/run/service
*** Search service in CONTAINER_SERVICE_DIR = /container/run/service :
*** link /container/run/service/:ssl-tools/startup.sh to /container/run/startup/:ssl-tools
*** link /container/run/service/slapd/startup.sh to /container/run/startup/slapd
*** link /container/run/service/slapd/process.sh to /container/run/process/slapd/run
*** Set environment for startup files
*** Environment files will be proccessed in this order : 
Caution: previously defined variables will not be overriden.
/container/environment/99-default/default.startup.yaml
/container/environment/99-default/default.yaml

To see how this files are processed and environment variables values,
run this container with '--loglevel debug'
*** Running /container/run/startup/:ssl-tools...
*** Running /container/run/startup/slapd...
unable to load DH parameters
140127211935376:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:696:Expecting: DH PARAMETERS
*** /container/run/startup/slapd failed with status 1

*** Killing all processes...

[osixia]

Hello,
Please provide more information like the command run, Docker compose file, kubernetes yaml?
Witch version you used? If you mount an old version persistant volume with a newer?
What leads to this error obviously the log is not enough.
And on what OS? Thanks

[adambom]

We are running on CoreOS, using the latest version of the docker-openldap image. This setup will run without issue, but if I ever stop and start the pod, e.g.

kubectl delete deploy ldap
kubectl apply -f kubernetes.yaml

The container fails to start with the error above.

Here is the kubernetes.yaml file:

kind: StorageClass
apiVersion: storage.k8s.io/v1beta1
metadata:
  name: gp2
provisioner: kubernetes.io/aws-ebs
parameters:
  type: gp2
  zone: us-west-2a
  encrypted: "true"

---

# For some reason yaml doesn't work here
{
  "kind": "PersistentVolumeClaim",
  "apiVersion": "v1",
  "metadata": {
    "name": "ldap-db",
    "annotations": {
        "volume.beta.kubernetes.io/storage-class": "gp2"
    }
  },
  "spec": {
    "accessModes": [
      "ReadWriteOnce"
    ],
    "resources": {
      "requests": {
        "storage": "5Gi"
      }
    }
  }
}

---

# For some reason yaml doesn't work here
{
  "kind": "PersistentVolumeClaim",
  "apiVersion": "v1",
  "metadata": {
    "name": "ldap-cfg",
    "annotations": {
        "volume.beta.kubernetes.io/storage-class": "gp2"
    }
  },
  "spec": {
    "accessModes": [
      "ReadWriteOnce"
    ],
    "resources": {
      "requests": {
        "storage": "1Gi"
      }
    }
  }
}

---

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: ldap
  labels:
    app: ldap
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: ldap
    spec:
      volumes:
      - name: ldap-db
        persistentVolumeClaim:
          claimName: ldap-db

      - name: ldap-cfg
        persistentVolumeClaim:
          claimName: ldap-cfg

      - name: ldap-certs
        secret:
          secretName: ldap-certificates

      containers:

      ###############
      # OpenLDAP
      ###############
      - name: openldap
        image: osixia/openldap:1.1.6

        args:
        - --copy-service

        env:
        - name: LDAP_ORGANISATION
          value: Example

        - name: LDAP_DOMAIN
          value: example.com

        - name: LDAP_ADMIN_PASSWORD
          valueFrom:
            secretKeyRef:
              name: ldap-secrets
              key: ldap-admin-password

        - name: LDAP_CONFIG_PASSWORD
          valueFrom:
            secretKeyRef:
              name: ldap-secrets
              key: ldap-config-password

        - name: LDAP_TLS_VERIFY_CLIENT
          value: "never"

        - name: LDAP_TLS
          value: "true"

        - name: LDAP_TLS_CRT_FILENAME
          value: certificate.pem

        - name: LDAP_TLS_KEY_FILENAME
          value: key.pem

        - name: LDAP_TLS_CA_CRT_FILENAME
          value: cacertificate.pem

        volumeMounts:
        - name: ldap-db
          mountPath: /var/lib/ldap
        - name: ldap-cfg
          mountPath: /etc/ldap/slapd.d
        - name: ldap-certs
          mountPath: /container/service/slapd/assets/certs

        ports:
        - containerPort: 389
          name: ldap

When I remove the ldap-certs volumeMount, such that docker-openldap generates its own self-signed certs, startup succeeds.

[osixia]

Thanks,
Is there any dhparam.pem file in the volume mounted to /container/service/slapd/assets/certs ?

If yes test this file with:

 openssl dhparam -in /container/service/slapd/assets/certs/dhparam.pem -text -noout

If it fail generate a new one with:

 openssl dhparam -out  /container/service/slapd/assets/certs/dhparam.pem 2048

[adambom]

I don't specifically mount that file. Here's the secret that gets mounted:

apiVersion: v1
kind: Secret
metadata:
  name: ldap-certificates
type: Opaque
data:
  cacertificate.pem: <redacted>
  certificate.pem: <redacted>
  key.pem: <redacted>

Should I just create the dhparam.pem file and mount that as well?

[osixia]

This may solve the issue yes,
but i try to figure out what happens

[adambom]

It looks like it worked. Here's what the ldap-certificates secret looks like now:

apiVersion: v1
kind: Secret
metadata:
  name: ldap-certificates
type: Opaque
data:
  cacertificate.pem: <redacted>
  certificate.pem: <redacted>
  key.pem: <redacted>
  dhparam.pem: <redacted>

Should we add a recommendation to add this file in the docs?

[osixia]

Yes, i will had a note if i can't figure out what happened.
The container should generate this file, i may had a test on this and if the file is not valid the container generate a new one.

[ragaar]

Confirmed using:
docker exec <container> openssl dhparam -out /etc/letsencrypt/path/to/certs/dhparam.pem 4096

Created a dhparam and the service started prompted once this was included in the persistent volume.

[ragaar]

Just include dhparam in the certs/ CERT_NAME folder and you should "good".

I got a lot more red text after that, but things are working and I'm guessing that'll be a new issue.

[robbyoconnor]

Still an issue

[michidk]

Still an issue with 1.2.3-dev. Creating the dhparam file didn't work for me. Using lets encrypt certificates.
Edit: if the file permissions are right, the dhparam file is created anyways. But the same error occurs with the file.