feat(kanidm): automate replication cert exchange via native sidecar

Add a native sidecar (bitnami/kubectl, restartPolicy: Always) that runs
kanidmd renew-replication-certificate on each pod and patches the result
into the kanidm-repl-certs ConfigMap (certs are public keys, not secrets).
The config-init init container reads peer certs from the ConfigMap at
startup, building the replication stanza automatically — no manual cert
exchange required after first deploy.

Add RBAC (Role + RoleBinding) granting the kanidm service account
pods/exec and configmap patch permissions scoped to the kanidm namespace.

apps/base/kanidm/statefulset.yaml

@@ -43,9 +43,17 @@ spec:
               set -e
               REPL_ORIGIN="repl://${POD_NAME}.kanidm-headless.kanidm.svc.cluster.local:8444"
               sed "s|__REPL_ORIGIN__|${REPL_ORIGIN}|g" /config-template/server.toml > /config/server.toml
-              if [ -s /repl-peers/peers.toml ]; then
-                cat /repl-peers/peers.toml >> /config/server.toml
-              fi
+              for peer in kanidm-0 kanidm-1 kanidm-2; do
+                if [ "${peer}" = "${POD_NAME}" ]; then
+                  continue
+                fi
+                cert_file="/repl-certs/${peer}"
+                if [ -s "${cert_file}" ]; then
+                  fqdn="${peer}.kanidm-headless.kanidm.svc.cluster.local"
+                  printf '\n[replication."repl://%s:8444"]\ntype = "mutual-pull"\npartner_cert = "%s"\n' \
+                    "${fqdn}" "$(cat ${cert_file})" >> /config/server.toml
+                fi
+              done
           env:
             - name: POD_NAME
               valueFrom:
@@ -56,11 +64,39 @@ spec:
               mountPath: /config-template
             - name: config
               mountPath: /config
-            - name: repl-peers
-              mountPath: /repl-peers
+            - name: repl-certs
+              mountPath: /repl-certs
+              readOnly: true
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
+        - name: repl-cert-publisher
+          image: bitnami/kubectl:1.33
+          restartPolicy: Always
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              until kubectl exec "${POD_NAME}" -c kanidm -- /sbin/kanidmd renew-replication-certificate 2>/dev/null | grep -q '^# certificate:'; do
+                sleep 30
+              done
+              while true; do
+                cert=$(kubectl exec "${POD_NAME}" -c kanidm -- /sbin/kanidmd renew-replication-certificate 2>/dev/null \
+                  | grep '^# certificate:' | sed 's/^# certificate: "\(.*\)"$/\1/')
+                if [ -n "${cert}" ]; then
+                  kubectl patch configmap kanidm-repl-certs \
+                    --type=merge \
+                    -p "{\"data\":{\"${POD_NAME}\":\"${cert}\"}}"
+                fi
+                sleep 3600
+              done
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
       containers:
         - name: kanidm
           image: ghcr.io/kanidm/server:1.10.3
@@ -108,9 +144,9 @@ spec:
             name: kanidm-config
         - name: config
           emptyDir: {}
-        - name: repl-peers
+        - name: repl-certs
           configMap:
-            name: kanidm-repl-peers
+            name: kanidm-repl-certs
         - name: tls
           secret:
             secretName: kanidm-tls