Pre-build ldap-server image for integration test

Add a Containerfile and server.py under integration-tests/images/ldap-server/
so the LDAP server used in integration tests can be pre-built as a container
image instead of performing a live pip install on every test run.

Add two Tekton PipelineRun files (.tekton/ldap-server-pull-request.yaml and
.tekton/ldap-server-push.yaml) that build and push the ldap-server image using
the Konflux build pipeline. Both pipelines are scoped to trigger only when
files under integration-tests/images/ldap-server/ change, using the
pathChanged() CEL expression. The push pipeline applies the 'main' tag on
push to main.

Update .tekton/integration-test-eaas.yaml to:
- Extract the ldap-server component image URL from the Snapshot in parse-snapshot
- Replace the deploy-openldap task's inline ConfigMap, pip install, and volume
  mount approach with a direct reference to the pre-built image from the Snapshot

Closes #89

Generated-By: OpenCode (google-vertex-anthropic/claude-sonnet-4-6@default)

Author: Agent

.tekton/integration-test-eaas.yaml

@@ -22,6 +22,8 @@ spec:
       results:
       - name: image-url
         description: Container image URL to test
+      - name: ldap-server-image-url
+        description: Container image URL for the pre-built LDAP server
       - name: git-url
         description: Git repository URL
       - name: git-revision
@@ -42,6 +44,12 @@ spec:
           echo ""
           echo "Image to test: $IMAGE_URL"
 
+          # Extract ldap-server image URL
+          LDAP_SERVER_IMAGE_URL=$(echo "$SNAPSHOT" | jq -r '.components[] | select(.name=="ldap-server") | .containerImage')
+          echo -n "$LDAP_SERVER_IMAGE_URL" | tee $(results.ldap-server-image-url.path)
+          echo ""
+          echo "LDAP server image: $LDAP_SERVER_IMAGE_URL"
+
           # Extract git repository URL
           GIT_URL=$(echo "$SNAPSHOT" | jq -r '.components[] | select(.name=="cts") | .source.git.url')
           echo -n "$GIT_URL" | tee $(results.git-url.path)
@@ -84,6 +92,8 @@ spec:
       params:
       - name: kubeconfig-secret
         type: string
+      - name: ldap-server-image
+        type: string
       steps:
       - name: create-openldap
         image: quay.io/konflux-ci/appstudio-utils:latest
@@ -96,89 +106,13 @@ spec:
           export KUBECONFIG
 
           echo "=========================================="
-          echo "Deploying LDAP Server (Python/ldaptor)"
+          echo "Deploying LDAP Server (pre-built image)"
           echo "=========================================="
 
-          # Deploy a Python-based in-memory LDAP server using ldaptor.
-          # osixia/openldap:1.5.0 requires root and fails in OpenShift's
-          # restricted-v2 SCC.  ldaptor runs as an arbitrary UID on a
-          # non-privileged port (1389), so no SCC changes are needed.
+          LDAP_IMAGE="$(params.ldap-server-image)"
+          echo "Using LDAP server image: $LDAP_IMAGE"
 
-          kubectl apply -f - <<'EOFYAML'
-          apiVersion: v1
-          kind: ConfigMap
-          metadata:
-            name: ldap-server-script
-          data:
-            server.py: |
-              """
-              Minimal in-memory LDAP server using ldaptor.
-
-              Serves posixGroup entries under ou=groups,dc=example,dc=com with
-              anonymous-read access so that CTS's query_ldap_groups() can
-              retrieve group membership without a bind DN.
-              """
-              import io
-              from twisted.internet import reactor
-              from twisted.internet.protocol import ServerFactory
-              from twisted.python.components import registerAdapter
-              from ldaptor.inmemory import fromLDIFFile
-              from ldaptor.interfaces import IConnectedLDAPEntry
-              from ldaptor.protocols.ldap.ldapserver import LDAPServer
-
-              LDIF = b"""\
-              dn: dc=example,dc=com
-              dc: example
-              objectClass: top
-              objectClass: domain
-
-              dn: ou=groups,dc=example,dc=com
-              ou: groups
-              objectClass: top
-              objectClass: organizationalUnit
-
-              dn: cn=cts-builders,ou=groups,dc=example,dc=com
-              cn: cts-builders
-              objectClass: top
-              objectClass: posixGroup
-              gidNumber: 5501
-              memberUid: builder@example.com
-
-              dn: cn=readonly-users,ou=groups,dc=example,dc=com
-              cn: readonly-users
-              objectClass: top
-              objectClass: posixGroup
-              gidNumber: 5502
-              memberUid: readonly@example.com
-
-              """
-
-              class LDAPServerFactory(ServerFactory):
-                  protocol = LDAPServer
-
-                  def __init__(self, root):
-                      self.root = root
-
-                  def buildProtocol(self, addr):
-                      proto = self.protocol()
-                      proto.factory = self
-                      return proto
-
-              registerAdapter(
-                  lambda f: f.root, LDAPServerFactory, IConnectedLDAPEntry
-              )
-
-              def start(root):
-                  factory = LDAPServerFactory(root)
-                  reactor.listenTCP(1389, factory, interface="0.0.0.0")
-                  print("LDAP server listening on port 1389", flush=True)
-
-              d = fromLDIFFile(io.BytesIO(LDIF))
-              d.addCallback(start)
-              reactor.run()
-          EOFYAML
-
-          kubectl apply -f - <<'EOFYAML'
+          kubectl apply -f - <<EOFYAML
           apiVersion: apps/v1
           kind: Deployment
           metadata:
@@ -197,18 +131,7 @@ spec:
               spec:
                 containers:
                 - name: openldap
-                  image: quay.io/konflux-ci/appstudio-utils:latest
-                  command: ["/bin/bash", "-c"]
-                  args:
-                  - |
-                    set -e
-                    export HOME=/tmp
-                    echo "Installing ldaptor and twisted..."
-                    python3 -m ensurepip
-                    python3 -m pip install --target /tmp/ldap-deps --quiet ldaptor twisted
-                    echo "Starting LDAP server..."
-                    export PYTHONPATH=/tmp/ldap-deps
-                    exec python3 /scripts/server.py
+                  image: $LDAP_IMAGE
                   ports:
                   - containerPort: 1389
                     name: ldap
@@ -226,14 +149,6 @@ spec:
                     limits:
                       memory: "256Mi"
                       cpu: "200m"
-                  volumeMounts:
-                  - name: ldap-script
-                    mountPath: /scripts
-                    readOnly: true
-                volumes:
-                - name: ldap-script
-                  configMap:
-                    name: ldap-server-script
           ---
           apiVersion: v1
           kind: Service
@@ -262,6 +177,8 @@ spec:
     params:
     - name: kubeconfig-secret
       value: $(tasks.provision-environment.results.secretRef)
+    - name: ldap-server-image
+      value: $(tasks.parse-snapshot.results.ldap-server-image-url)
 
   - name: deploy-dex
     runAfter: