4 Commits

Author	SHA1	Message	Date
unkinben	db7f8f63a3	feat(kanidm): vault-managed replication certs with auto-restart ... - Store per-pod replication certs in Vault (kv/kubernetes/namespace/kanidm/default/repl-certs) - VaultAuth + VaultStaticSecret sync certs to kanidm-repl-certs Secret - busybox config-init init container injects peer certs from Secret into server.toml at startup - Remove hardcoded partner_cert entries from per-pod server.toml templates - Add automatic_refresh = true to all replication configs - Add reloader.stakater.com/auto annotation to trigger rolling restart on ConfigMap/Secret changes - Document domain UUID mismatch resolution and cert rotation in README	2026-05-30 22:53:38 +10:00
unkinben	201e601737	feat: update kanidm replicaiton (#169) ... - split to per-server configs - remove init containers that attempted to automate the replication config - add README.md Reviewed-on: #169	2026-05-25 23:25:48 +10:00
unkinben	6815b66010	fix(kanidm): use dockerhub image instead of ghcr.io (#161) ... ## Summary - Changes both `config-init` init container and `kanidm` container images from `ghcr.io/kanidm/server:1.10.3` to `kanidm/server:1.10.3` ## Why `kanidm/server` is published on Docker Hub, not ghcr.io. RKE2 rewrites dockerhub pulls through the artifactapi mirror automatically. ## Test plan - [ ] Pods roll successfully after ArgoCD sync - [ ] Verify kanidm cluster replication still healthy Reviewed-on: #161	2026-05-24 20:27:21 +10:00
unkinben	3756208ccd	benvin/kanidm (#159) ... Reviewed-on: #159	2026-05-24 19:55:22 +10:00