Merge branch 'main' into fix-kanidm-replication-config

apps/base/kanidm/kustomization.yaml

@@ -25,3 +25,5 @@ configMapGenerator:
         app.kubernetes.io/instance: kanidm
     files:
       - server-0.toml=resources/server-0.toml
+      - server-1.toml=resources/server-1.toml
+      - server-2.toml=resources/server-2.toml

apps/base/kanidm/resources/server-0.toml

@@ -13,3 +13,7 @@ log_level = "info"
 path = "/data/backups/"
 schedule = "0 22 * * *"
 versions = 7
+
+[replication]
+origin = "repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"
+bindaddress = "[::]:8444"

apps/base/kanidm/resources/server-1.toml

@@ -0,0 +1,19 @@
+version = "2"
+
+domain = "auth.unkin.net"
+origin = "https://auth.unkin.net"
+bindaddress = "[::]:8443"
+db_path = "/data/kanidm.db"
+db_arc_size = 2048
+tls_chain = "/data/tls/tls.crt"
+tls_key = "/data/tls/tls.key"
+log_level = "info"
+
+[online_backup]
+path = "/data/backups/"
+schedule = "0 22 * * *"
+versions = 7
+
+[replication]
+origin = "repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"
+bindaddress = "[::]:8444"

apps/base/kanidm/resources/server-2.toml

@@ -0,0 +1,19 @@
+version = "2"
+
+domain = "auth.unkin.net"
+origin = "https://auth.unkin.net"
+bindaddress = "[::]:8443"
+db_path = "/data/kanidm.db"
+db_arc_size = 2048
+tls_chain = "/data/tls/tls.crt"
+tls_key = "/data/tls/tls.key"
+log_level = "info"
+
+[online_backup]
+path = "/data/backups/"
+schedule = "0 22 * * *"
+versions = 7
+
+[replication]
+origin = "repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"
+bindaddress = "[::]:8444"

apps/base/kanidm/service.yaml

@@ -9,10 +9,6 @@ metadata:
     app.kubernetes.io/instance: kanidm
 spec:
   type: ClusterIP
-  sessionAffinity: ClientIP
-  sessionAffinityConfig:
-    clientIP:
-      timeoutSeconds: 10800
   ports:
     - name: https
       port: 8443
@@ -38,6 +34,10 @@ spec:
       port: 8443
       targetPort: https
       protocol: TCP
+    - name: replication
+      port: 8444
+      targetPort: replication
+      protocol: TCP
   selector:
     app.kubernetes.io/name: kanidm
     app.kubernetes.io/instance: kanidm

apps/base/kanidm/statefulset.yaml

@@ -11,7 +11,7 @@ metadata:
     app.kubernetes.io/instance: kanidm
 spec:
   serviceName: kanidm-headless
-  replicas: 1
+  replicas: 3
   selector:
     matchLabels:
       app.kubernetes.io/name: kanidm
@@ -23,11 +23,52 @@ spec:
         app.kubernetes.io/instance: kanidm
     spec:
       serviceAccountName: kanidm
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: kanidm
+                  app.kubernetes.io/instance: kanidm
+              topologyKey: kubernetes.io/hostname
       securityContext:
         runAsUser: 1000
         runAsGroup: 1000
         runAsNonRoot: true
         fsGroup: 1000
+      initContainers:
+        - name: config-init
+          image: busybox:1.36
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              set -e
+              cp "/config-template/server-${POD_NAME##*-}.toml" /config/server.toml
+              for peer in kanidm-0 kanidm-1 kanidm-2; do
+                [ "${peer}" = "${POD_NAME}" ] && continue
+                cert_file="/repl-certs/${peer}"
+                [ -s "${cert_file}" ] || continue
+                fqdn="${peer}.kanidm-headless.kanidm.svc.cluster.local"
+                printf '\n[replication."repl://%s:8444"]\ntype = "mutual-pull"\npartner_cert = "%s"\n' \
+                  "${fqdn}" "$(cat ${cert_file})" >> /config/server.toml
+              done
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          volumeMounts:
+            - name: config-template
+              mountPath: /config-template
+              readOnly: true
+            - name: config
+              mountPath: /config
+            - name: repl-certs
+              mountPath: /repl-certs
+              readOnly: true
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
       containers:
         - name: kanidm
           image: kanidm/server:1.10.3
@@ -37,12 +78,14 @@ spec:
             - name: https
               containerPort: 8443
               protocol: TCP
+            - name: replication
+              containerPort: 8444
+              protocol: TCP
           volumeMounts:
             - name: data
               mountPath: /data
             - name: config
-              mountPath: /config/server.toml
-              subPath: server-0.toml
+              mountPath: /config
               readOnly: true
             - name: tls
               mountPath: /data/tls
@@ -68,9 +111,14 @@ spec:
             initialDelaySeconds: 30
             periodSeconds: 30
       volumes:
-        - name: config
+        - name: config-template
           configMap:
             name: kanidm-config
+        - name: config
+          emptyDir: {}
+        - name: repl-certs
+          secret:
+            secretName: kanidm-repl-certs
         - name: tls
           secret:
             secretName: kanidm-tls

apps/base/kanidm/vaultstaticsecret.yaml

@@ -18,6 +18,3 @@ spec:
     create: true
     overwrite: true
   hmacSecretData: true
-  rolloutRestartTargets:
-    - kind: StatefulSet
-      name: kanidm