5 Commits

Author	SHA1	Message	Date
unkinben	60f1f3130b	fix(kanidm): replicate 1/2 from 0 only with automatic_refresh (#181) ... kanidm-0 is the authoritative supplier; kanidm-1 and kanidm-2 pull from kanidm-0 only. automatic_refresh = true on the kanidm-0 peer entry for kanidm-1/2 so fresh nodes auto-sync domain UUID on restart. Reviewed-on: #181	2026-05-31 00:20:30 +10:00
unkinben	4d594fbde7	feat(kanidm): vault-managed replication certs with auto-restart (#176) ... - Store per-pod replication certs in Vault (kv/kubernetes/namespace/kanidm/default/repl-certs) - VaultAuth + VaultStaticSecret sync certs to kanidm-repl-certs Secret - busybox config-init init container injects peer certs from Secret into server.toml at startup - Remove hardcoded partner_cert entries from per-pod server.toml templates - Add automatic_refresh = true to all replication configs - Add reloader.stakater.com/auto annotation to trigger rolling restart on ConfigMap/Secret changes - Document domain UUID mismatch resolution and cert rotation in README Reviewed-on: #176	2026-05-30 23:00:46 +10:00
unkinben	201e601737	feat: update kanidm replicaiton (#169) ... - split to per-server configs - remove init containers that attempted to automate the replication config - add README.md Reviewed-on: #169	2026-05-25 23:25:48 +10:00
unkinben	6815b66010	fix(kanidm): use dockerhub image instead of ghcr.io (#161) ... ## Summary - Changes both `config-init` init container and `kanidm` container images from `ghcr.io/kanidm/server:1.10.3` to `kanidm/server:1.10.3` ## Why `kanidm/server` is published on Docker Hub, not ghcr.io. RKE2 rewrites dockerhub pulls through the artifactapi mirror automatically. ## Test plan - [ ] Pods roll successfully after ArgoCD sync - [ ] Verify kanidm cluster replication still healthy Reviewed-on: #161	2026-05-24 20:27:21 +10:00
unkinben	3756208ccd	benvin/kanidm (#159) ... Reviewed-on: #159	2026-05-24 19:55:22 +10:00