feat(kanidm): scale down to single replica, remove replication

Drop from 3 replicas to 1. Remove init container, repl-certs secret,
replication port, podAntiAffinity, server-1/2 configs, and replication
stanza from server-0.toml. Mount configmap directly via subPath.

apps/base/kanidm/statefulset.yaml

@@ -11,7 +11,7 @@ metadata:
     app.kubernetes.io/instance: kanidm
 spec:
   serviceName: kanidm-headless
-  replicas: 3
+  replicas: 1
   selector:
     matchLabels:
       app.kubernetes.io/name: kanidm
@@ -23,61 +23,11 @@ spec:
         app.kubernetes.io/instance: kanidm
     spec:
       serviceAccountName: kanidm
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchLabels:
-                  app.kubernetes.io/name: kanidm
-                  app.kubernetes.io/instance: kanidm
-              topologyKey: kubernetes.io/hostname
       securityContext:
         runAsUser: 1000
         runAsGroup: 1000
         runAsNonRoot: true
         fsGroup: 1000
-      initContainers:
-        - name: config-init
-          image: busybox:1.36
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -e
-              cp "/config-template/server-${POD_NAME##*-}.toml" /config/server.toml
-              if [ "${POD_NAME}" = "kanidm-0" ]; then
-                peers="kanidm-1 kanidm-2"
-              else
-                peers="kanidm-0"
-              fi
-              for peer in ${peers}; do
-                cert_file="/repl-certs/${peer}"
-                [ -s "${cert_file}" ] || continue
-                fqdn="${peer}.kanidm-headless.kanidm.svc.cluster.local"
-                if [ "${peer}" = "kanidm-0" ]; then
-                  printf '\n[replication."repl://%s:8444"]\ntype = "mutual-pull"\npartner_cert = "%s"\nautomatic_refresh = true\n' \
-                    "${fqdn}" "$(cat ${cert_file})" >> /config/server.toml
-                else
-                  printf '\n[replication."repl://%s:8444"]\ntype = "mutual-pull"\npartner_cert = "%s"\n' \
-                    "${fqdn}" "$(cat ${cert_file})" >> /config/server.toml
-                fi
-              done
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-          volumeMounts:
-            - name: config-template
-              mountPath: /config-template
-              readOnly: true
-            - name: config
-              mountPath: /config
-            - name: repl-certs
-              mountPath: /repl-certs
-              readOnly: true
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
       containers:
         - name: kanidm
           image: kanidm/server:1.10.3
@@ -87,14 +37,12 @@ spec:
             - name: https
               containerPort: 8443
               protocol: TCP
-            - name: replication
-              containerPort: 8444
-              protocol: TCP
           volumeMounts:
             - name: data
               mountPath: /data
             - name: config
-              mountPath: /config
+              mountPath: /config/server.toml
+              subPath: server-0.toml
               readOnly: true
             - name: tls
               mountPath: /data/tls
@@ -120,14 +68,9 @@ spec:
             initialDelaySeconds: 30
             periodSeconds: 30
       volumes:
-        - name: config-template
+        - name: config
           configMap:
             name: kanidm-config
-        - name: config
-          emptyDir: {}
-        - name: repl-certs
-          secret:
-            secretName: kanidm-repl-certs
         - name: tls
           secret:
             secretName: kanidm-tls