LDAP can't connect to server issue due to missing packages?

[Ryaden]

I have been debugging an interesting issue using LDAP bind+search with any cloudnative-pg postgresql container image.

I started with the following, just use the container image straight from github:

apiVersion: postgresql.cnpg.io/v1
kind: ImageCatalog
metadata:
  name: postgresql-catalog

spec:
  images:
    - major: 17
      image: ghcr.io/cloudnative-pg/postgresql:17.5-21-bookworm

And the ldap part of the Cluster yml is:

ldap:
      server: my-server # hidden because it's a private LDAP server
      scheme: ldaps
      port: 636
      bindSearchAuth:
        baseDN: my-BaseDN
        bindDN: my-bindDN
        bindPassword:
          name: ldap-bind-secret
          key: bindPW
        searchAttribute: uid

So nothing special really.

This resulted in the following error when trying to connect through LDAP:

"message":"could not perform initial LDAP bind for ldapbinddn"
"details": "Can't contact LDAP server"

Then I tried a lot of different variants, ending up with figuring out that this line:

apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false

in the cloudnative-pg postgresql Dockerfile seem to remove the following packages in my pods:

• libldap-common
• lbsasl2-modules

console logs tell me:

The following packages will be REMOVED:
  libldap-common* libsasl2-modules*

I created a Dockerfile that basically just installs those packages back:

FROM ghcr.io/cloudnative-pg/postgresql:17.5-21-bookworm

USER root

RUN apt-get update && \
    apt-get upgrade -y && \
    apt-get install -y libsasl2-modules libldap-common && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

USER 26

And using that image with those two packages installed again LDAP works!
I didn't find anyone else with this issue, so I am really wondering why the default cloudnative-pg postgresql packages seem to uninstall these packages.

[dosubot]

Hi @Ryaden! I'm Dosu and I’m helping the postgres-containers team.

The missing libldap-common and libsasl2-modules packages in the default CloudNativePG PostgreSQL images are a side effect of the image minimization strategy. The Dockerfile uses apt-get install with --no-install-recommends and aggressive autoremove/purge steps to keep the image lean, which can result in the removal or absence of packages that are not explicitly listed as required—even if they are needed for features like LDAP authentication. This is not an intentional removal of LDAP support, but rather a consequence of minimizing dependencies and image size. There is no official documentation or guidance about LDAP support or required packages in these images, and no issues or pull requests discuss this topic specifically. The best practice for now is to use a custom Dockerfile, as you did, to add the necessary packages for LDAP support on top of the official image cite cite.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[sxd]

@mnencia @NiccoloFei we should set some priority on this, what do you think?