Pre-build ldap-server image for integration test

Build a dedicated container image for the in-memory LDAP server used by
the integration test instead of performing a live 'pip install ldaptor twisted'
on every test run.

New files:
- integration-tests/images/ldap-server/server.py: the in-memory LDAP server
  script, listening on port 1389 as an arbitrary UID (OpenShift restricted-v2
  SCC compatible).
- integration-tests/images/ldap-server/Containerfile: builds a
  fedora-minimal:44-based image that installs ldaptor and twisted via pip3.
- .tekton/ldap-server-pull-request.yaml: Konflux build PipelineRun for pull
  requests; triggers only when files under integration-tests/images/ldap-server/
  change (pathChanged() CEL filter). Sets image-expires-after to 5d.
- .tekton/ldap-server-push.yaml: Konflux build PipelineRun for pushes to main.
  Same path filter.

Modified:
- .tekton/integration-test-eaas.yaml: parse-snapshot now emits a
  ldap-server-present result; when ldap-server is absent from the Snapshot
  (no stable build yet, and not triggered for this PR), every downstream task
  is skipped via a 'when' condition and the finally task emits 'skipped' instead
  of failing.

Generated-By: OpenCode (google-vertex-anthropic/claude-sonnet-4-6@default)

Author: Agent

.tekton/integration-test-eaas.yaml

@@ -22,6 +22,10 @@ spec:
       results:
       - name: image-url
         description: Container image URL to test
+      - name: ldap-server-image-url
+        description: Container image URL for the pre-built LDAP server
+      - name: ldap-server-present
+        description: Whether the ldap-server component is present in the Snapshot
       - name: git-url
         description: Git repository URL
       - name: git-revision
@@ -42,6 +46,24 @@ spec:
           echo ""
           echo "Image to test: $IMAGE_URL"
 
+          # Extract ldap-server image URL. If the ldap-server component is absent
+          # from the Snapshot (e.g. no ldap-server build was triggered for this PR
+          # because no relevant files changed, and no stable build exists yet), set
+          # ldap-server-present to "false" so the test pipeline is skipped rather
+          # than trying to pull a non-existent image.
+          LDAP_SERVER_IMAGE_URL=$(echo "$SNAPSHOT" | jq -r '(.components[] | select(.name=="ldap-server") | .containerImage) // empty')
+          if [ -z "$LDAP_SERVER_IMAGE_URL" ]; then
+            echo "ldap-server not found in Snapshot; skipping integration test"
+            echo -n "" | tee $(results.ldap-server-image-url.path)
+            echo -n "false" | tee $(results.ldap-server-present.path)
+          else
+            echo -n "$LDAP_SERVER_IMAGE_URL" | tee $(results.ldap-server-image-url.path)
+            echo -n "true" | tee $(results.ldap-server-present.path)
+          fi
+          echo ""
+          echo "LDAP server image: $LDAP_SERVER_IMAGE_URL"
+          echo ""
+
           # Extract git repository URL
           GIT_URL=$(echo "$SNAPSHOT" | jq -r '.components[] | select(.name=="cts") | .source.git.url')
           echo -n "$GIT_URL" | tee $(results.git-url.path)
@@ -60,6 +82,11 @@ spec:
   - name: provision-environment
     runAfter:
     - parse-snapshot
+    when:
+    - input: $(tasks.parse-snapshot.results.ldap-server-present)
+      operator: in
+      values:
+      - "true"
     taskRef:
       params:
       - name: name
@@ -80,10 +107,17 @@ spec:
   - name: deploy-openldap
     runAfter:
     - provision-environment
+    when:
+    - input: $(tasks.parse-snapshot.results.ldap-server-present)
+      operator: in
+      values:
+      - "true"
     taskSpec:
       params:
       - name: kubeconfig-secret
         type: string
+      - name: ldap-server-image
+        type: string
       steps:
       - name: create-openldap
         image: quay.io/konflux-ci/appstudio-utils:latest
@@ -96,89 +130,13 @@ spec:
           export KUBECONFIG
 
           echo "=========================================="
-          echo "Deploying LDAP Server (Python/ldaptor)"
+          echo "Deploying LDAP Server (pre-built image)"
           echo "=========================================="
 
-          # Deploy a Python-based in-memory LDAP server using ldaptor.
-          # osixia/openldap:1.5.0 requires root and fails in OpenShift's
-          # restricted-v2 SCC.  ldaptor runs as an arbitrary UID on a
-          # non-privileged port (1389), so no SCC changes are needed.
+          LDAP_IMAGE="$(params.ldap-server-image)"
+          echo "Using LDAP server image: $LDAP_IMAGE"
 
-          kubectl apply -f - <<'EOFYAML'
-          apiVersion: v1
-          kind: ConfigMap
-          metadata:
-            name: ldap-server-script
-          data:
-            server.py: |
-              """
-              Minimal in-memory LDAP server using ldaptor.
-
-              Serves posixGroup entries under ou=groups,dc=example,dc=com with
-              anonymous-read access so that CTS's query_ldap_groups() can
-              retrieve group membership without a bind DN.
-              """
-              import io
-              from twisted.internet import reactor
-              from twisted.internet.protocol import ServerFactory
-              from twisted.python.components import registerAdapter
-              from ldaptor.inmemory import fromLDIFFile
-              from ldaptor.interfaces import IConnectedLDAPEntry
-              from ldaptor.protocols.ldap.ldapserver import LDAPServer
-
-              LDIF = b"""\
-              dn: dc=example,dc=com
-              dc: example
-              objectClass: top
-              objectClass: domain
-
-              dn: ou=groups,dc=example,dc=com
-              ou: groups
-              objectClass: top
-              objectClass: organizationalUnit
-
-              dn: cn=cts-builders,ou=groups,dc=example,dc=com
-              cn: cts-builders
-              objectClass: top
-              objectClass: posixGroup
-              gidNumber: 5501
-              memberUid: builder@example.com
-
-              dn: cn=readonly-users,ou=groups,dc=example,dc=com
-              cn: readonly-users
-              objectClass: top
-              objectClass: posixGroup
-              gidNumber: 5502
-              memberUid: readonly@example.com
-
-              """
-
-              class LDAPServerFactory(ServerFactory):
-                  protocol = LDAPServer
-
-                  def __init__(self, root):
-                      self.root = root
-
-                  def buildProtocol(self, addr):
-                      proto = self.protocol()
-                      proto.factory = self
-                      return proto
-
-              registerAdapter(
-                  lambda f: f.root, LDAPServerFactory, IConnectedLDAPEntry
-              )
-
-              def start(root):
-                  factory = LDAPServerFactory(root)
-                  reactor.listenTCP(1389, factory, interface="0.0.0.0")
-                  print("LDAP server listening on port 1389", flush=True)
-
-              d = fromLDIFFile(io.BytesIO(LDIF))
-              d.addCallback(start)
-              reactor.run()
-          EOFYAML
-
-          kubectl apply -f - <<'EOFYAML'
+          kubectl apply -f - <<EOFYAML
           apiVersion: apps/v1
           kind: Deployment
           metadata:
@@ -197,18 +155,7 @@ spec:
               spec:
                 containers:
                 - name: openldap
-                  image: quay.io/konflux-ci/appstudio-utils:latest
-                  command: ["/bin/bash", "-c"]
-                  args:
-                  - |
-                    set -e
-                    export HOME=/tmp
-                    echo "Installing ldaptor and twisted..."
-                    python3 -m ensurepip
-                    python3 -m pip install --target /tmp/ldap-deps --quiet ldaptor twisted
-                    echo "Starting LDAP server..."
-                    export PYTHONPATH=/tmp/ldap-deps
-                    exec python3 /scripts/server.py
+                  image: $LDAP_IMAGE
                   ports:
                   - containerPort: 1389
                     name: ldap
@@ -226,14 +173,6 @@ spec:
                     limits:
                       memory: "256Mi"
                       cpu: "200m"
-                  volumeMounts:
-                  - name: ldap-script
-                    mountPath: /scripts
-                    readOnly: true
-                volumes:
-                - name: ldap-script
-                  configMap:
-                    name: ldap-server-script
           ---
           apiVersion: v1
           kind: Service
@@ -262,10 +201,17 @@ spec:
     params:
     - name: kubeconfig-secret
       value: $(tasks.provision-environment.results.secretRef)
+    - name: ldap-server-image
+      value: $(tasks.parse-snapshot.results.ldap-server-image-url)
 
   - name: deploy-dex
     runAfter:
     - provision-environment
+    when:
+    - input: $(tasks.parse-snapshot.results.ldap-server-present)
+      operator: in
+      values:
+      - "true"
     taskSpec:
       params:
       - name: kubeconfig-secret
@@ -460,6 +406,11 @@ spec:
   - name: deploy-database
     runAfter:
     - provision-environment
+    when:
+    - input: $(tasks.parse-snapshot.results.ldap-server-present)
+      operator: in
+      values:
+      - "true"
     taskSpec:
       params:
       - name: kubeconfig-secret
@@ -597,6 +548,11 @@ spec:
     - deploy-database
     - deploy-openldap
     - deploy-dex
+    when:
+    - input: $(tasks.parse-snapshot.results.ldap-server-present)
+      operator: in
+      values:
+      - "true"
     taskSpec:
       params:
       - name: kubeconfig-secret
@@ -851,6 +807,11 @@ spec:
   - name: run-tests
     runAfter:
     - deploy-cts
+    when:
+    - input: $(tasks.parse-snapshot.results.ldap-server-present)
+      operator: in
+      values:
+      - "true"
     taskSpec:
       params:
       - name: kubeconfig-secret
@@ -969,6 +930,35 @@ spec:
     - name: git-revision
       value: $(tasks.parse-snapshot.results.git-revision)
 
+  finally:
+  - name: report-result
+    params:
+    - name: ldap-server-present
+      value: $(tasks.parse-snapshot.results.ldap-server-present)
+    - name: test-result
+      value: $(tasks.run-tests.results.test-result)
+    taskSpec:
+      params:
+      - name: ldap-server-present
+        type: string
+      - name: test-result
+        type: string
+        default: ""
+      results:
+      - name: test-output
+        description: Final test output result
+      steps:
+      - name: emit-result
+        image: quay.io/konflux-ci/appstudio-utils:latest
+        script: |
+          #!/usr/bin/env bash
+          if [ "$(params.ldap-server-present)" = "false" ]; then
+            echo "ldap-server image was not available in the Snapshot; test skipped."
+            echo -n "skipped" | tee $(results.test-output.path)
+          else
+            echo -n "$(params.test-result)" | tee $(results.test-output.path)
+          fi
+
   results:
   - name: TEST_OUTPUT
-    value: $(tasks.run-tests.results.test-result)
+    value: $(finally.report-result.results.test-output)