Tiered LDAP groups

tests/example-vars.yml

@@ -4,6 +4,15 @@ www_hostname: www.eom.dev
 www_membership_image: registry.example.org/www-membership:2026-10-23
 www_repo_version: refs/heads/main
 www_membership_secret_name: www-membership-credentials
+# Examples only: create dedicated groupOfUniqueNames entries and ACLs first.
+# No automatic inheritance: include each group at every permitted level.
+www_membership_service_groups:
+  "0": ["cn=community-chat,ou=membership-services,dc=eom,dc=dev"]
+  "1": ["cn=community-chat,ou=membership-services,dc=eom,dc=dev"]
+  "2": ["cn=community-chat,ou=membership-services,dc=eom,dc=dev", "cn=game-servers,ou=membership-services,dc=eom,dc=dev"]
+  "3": ["cn=community-chat,ou=membership-services,dc=eom,dc=dev", "cn=game-servers,ou=membership-services,dc=eom,dc=dev"]
+  "4": ["cn=community-chat,ou=membership-services,dc=eom,dc=dev", "cn=game-servers,ou=membership-services,dc=eom,dc=dev"]
+  "5": ["cn=community-chat,ou=membership-services,dc=eom,dc=dev", "cn=game-servers,ou=membership-services,dc=eom,dc=dev"]
 www_membership_shkeeper_enabled: true
 www_membership_environment_overrides:
   # Optional plaintext LDAP for a trusted cluster only; sends passwords unencrypted.

tests/render.yml

@@ -11,6 +11,9 @@
     - name: Supply nonsecret fixture settings
       ansible.builtin.set_fact:
         www_membership_image: registry.example.org/www-membership:release-test
+        www_membership_service_groups:
+          "0": ["cn=free-service,ou=groups,dc=example,dc=org"]
+          "2": ["cn=paid-service,ou=groups,dc=example,dc=org", "cn=second-service,ou=groups,dc=example,dc=org"]
         _www_membership_revision: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
         www_membership_environment: "{{ www_membership_environment | combine({'MEMBERSHIP_PUBLIC_URL': 'https://' ~ www_hostname, 'LDAP_BIND_DN': 'cn=membership,dc=example,dc=org', 'LDAP_PASSWORD_SCHEME': '{ARGON2}', 'EMAIL_HOST': 'smtp.example.org', 'STRIPE_PORTAL_CONFIGURATION': 'bpc_test'}) }}"
     - name: Render Apache proxy fixture

tests/validate_manifests.py

@@ -51,6 +51,10 @@ assert plaintext_config["LDAP_URL"] == "ldap://openldap.openldap.svc.cluster.loc
 assert all(isinstance(value, str) for value in plaintext_config.values())
 assert "MEMBERSHIP_SECRET_KEY" not in config and "SHKEEPER_API_KEY" not in config
 tiers = json.loads(find(all_objects, "ConfigMap", "membership-tiers")["data"]["tiers.json"])
+service_groups = json.loads(find(all_objects, "ConfigMap", "membership-tiers")["data"]["service-groups.json"])
+assert config["MEMBERSHIP_SERVICE_GROUPS_FILE"] == "/etc/membership/tiers/service-groups.json"
+assert service_groups["0"] == ["cn=free-service,ou=groups,dc=example,dc=org"]
+assert len(service_groups["2"]) == 2
 assert len(tiers) == 5 and tiers["level-5"]["usd_amount"] == "64.00"
 assert [tiers[f"level-{level}"]["level"] for level in range(1, 6)] == list(range(1, 6))
 for name in ["membership", "membership-worker"]:
@@ -76,6 +80,9 @@ apache = find(all_objects, "ConfigMap", "httpd")["data"]
 assert "http://membership:8000/members/" in apache["membership.conf"]
 assert "X-Forwarded-Proto" in apache["membership.conf"]
 assert "Require all denied" in apache["membership.conf"]
+assert "LimitRequestBody 262144" in apache["membership.conf"]
+assert '<Location "/members/profile/">' in apache["membership.conf"]
+assert "LimitRequestBody 2097152" in apache["membership.conf"]
 assert "env=!membership_sensitive" in apache["httpd.conf"]
 assert "LoadModule proxy_http_module" in apache["httpd.conf"]
 source = find(all_objects, "Deployment", "httpd")["spec"]["template"]["spec"]["initContainers"][0]
@@ -83,6 +90,7 @@ assert "rm -rf" not in source["command"][-1]
 assert 'cp -a /tmp/www/htdocs/. /data/' in source["command"][-1]
 ingress = find(all_objects, "Ingress", "www")
 assert ingress["metadata"]["annotations"]["nginx.ingress.kubernetes.io/enable-access-log"] == "false"
+assert ingress["metadata"]["annotations"]["nginx.ingress.kubernetes.io/proxy-body-size"] == "2m"
 assert ingress["spec"]["rules"][0]["http"]["paths"][0]["backend"]["service"]["name"] == "httpd"
 for obj in docs("external-membership-workloads"):
     if obj["kind"] == "Deployment":