From 949b7d908c1d907321cc3fb5bad063bf10c59971 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sun, 31 May 2026 00:23:18 +1000
Subject: [PATCH] fix(kanidm): fix automatic_refresh toml generation in init
 container

The \n escape in a shell variable wasn't interpreted as a newline when
passed as a printf %s argument, causing automatic_refresh to be appended
to the partner_cert string on the same line, breaking TOML parsing.
Use separate printf calls per peer type instead.
---
 apps/base/kanidm/statefulset.yaml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/apps/base/kanidm/statefulset.yaml b/apps/base/kanidm/statefulset.yaml
index 2c89414..3fe8f2c 100644
--- a/apps/base/kanidm/statefulset.yaml
+++ b/apps/base/kanidm/statefulset.yaml
@@ -53,10 +53,13 @@ spec:
                 cert_file="/repl-certs/${peer}"
                 [ -s "${cert_file}" ] || continue
                 fqdn="${peer}.kanidm-headless.kanidm.svc.cluster.local"
-                refresh=""
-                [ "${peer}" = "kanidm-0" ] && refresh="\nautomatic_refresh = true"
-                printf '\n[replication."repl://%s:8444"]\ntype = "mutual-pull"\npartner_cert = "%s"%s\n' \
-                  "${fqdn}" "$(cat ${cert_file})" "${refresh}" >> /config/server.toml
+                if [ "${peer}" = "kanidm-0" ]; then
+                  printf '\n[replication."repl://%s:8444"]\ntype = "mutual-pull"\npartner_cert = "%s"\nautomatic_refresh = true\n' \
+                    "${fqdn}" "$(cat ${cert_file})" >> /config/server.toml
+                else
+                  printf '\n[replication."repl://%s:8444"]\ntype = "mutual-pull"\npartner_cert = "%s"\n' \
+                    "${fqdn}" "$(cat ${cert_file})" >> /config/server.toml
+                fi
               done
           env:
             - name: POD_NAME