fix(kanidm): prevent ArgoCD from overwriting repl-cert ConfigMap data

Remove the data keys from kanidm-repl-certs in git so ArgoCD never takes SSA ownership of them. Add ignoreDifferences for /data on that ConfigMap in the ApplicationSet template so ArgoCD doesn't flag sidecar-patched cert values as out-of-sync.
feat(kanidm): automate replication cert exchange via native sidecar
2026-05-24 00:07:02 +10:00 · 2026-05-24 00:02:40 +10:00 · 2026-05-23 23:49:30 +10:00 · 2026-05-23 23:16:52 +10:00 · 2026-05-23 23:12:52 +10:00
10 changed files with 10 additions and 26 deletions
@@ -31,7 +31,6 @@ spec:
      protocol: HTTPS
      tls:
        certificateRefs:
-          - group: ""
+          - kind: Secret
            kind: Secret
            name: artifactapi-tls
        mode: Terminate
@@ -6,10 +6,8 @@ remotes:
    immutable_patterns:
      - "^cloudnative-pg/cloudnative-pg"
      - "^emberstack/helm-charts"
      - "^kanidm/"
      - "^openvoxproject/"
      - "^stakater/reloader"
      - "^stalwartlabs/stalwart"
      - "^voxpupuli/puppetboard"
      - "^woodpecker-ci/helm"
    cache:
@@ -36,10 +34,7 @@ remotes:
      - "^hashicorp/vault"
      - "^jfrog/"
      - "^rancher/"
      - "^rspamd/rspamd"
      - "^tozd/postfix"
      - "^traefik/"
      - "^valkey/valkey"
      - "^ubi9/ubi-minimal"
      - "^victoriametrics/"
      - "^woodpeckerci/"
@@ -5,7 +5,6 @@ remotes:
    description: "GitHub releases and files"
    mutable_patterns:
      - ".*/archive/refs/heads/.*.tar.gz$"
      - "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$"
    immutable_patterns:
      - ".*/archive/refs/tags/.*.tar.gz$"
      - "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
@@ -31,7 +31,6 @@ spec:
      protocol: HTTPS
      tls:
        certificateRefs:
-          - group: ""
+          - kind: Secret
            kind: Secret
            name: rancher-tls
        mode: Terminate
@@ -35,8 +35,7 @@ spec:
      tls:
        mode: Terminate
        certificateRefs:
-          - group: ""
+          - kind: Secret
            kind: Secret
            name: consul-tls
    - name: consul-svc
      port: 443
@@ -48,6 +47,5 @@ spec:
      tls:
        mode: Terminate
        certificateRefs:
-          - group: ""
+          - kind: Secret
            kind: Secret
            name: consul-tls
@@ -31,7 +31,6 @@ spec:
      protocol: HTTPS
      tls:
        certificateRefs:
-          - group: ""
+          - kind: Secret
            kind: Secret
            name: litellm-tls
        mode: Terminate
@@ -31,7 +31,6 @@ spec:
      protocol: HTTPS
      tls:
        certificateRefs:
-          - group: ""
+          - kind: Secret
            kind: Secret
            name: paperclip-tls
        mode: Terminate
@@ -35,7 +35,6 @@ spec:
      protocol: HTTPS
      tls:
        certificateRefs:
-          - group: ""
+          - kind: Secret
            kind: Secret
            name: puppetboard-tls
        mode: Terminate
@@ -28,7 +28,6 @@ spec:
      protocol: HTTPS
      tls:
        certificateRefs:
-          - group: ""
+          - kind: Secret
            kind: Secret
            name: puppetdb-tls
        mode: Terminate
@@ -35,8 +35,7 @@ spec:
      tls:
        mode: Terminate
        certificateRefs:
-          - group: ""
+          - kind: Secret
            kind: Secret
            name: vault-tls
    - name: vault-direct
      port: 8200
@@ -47,6 +46,5 @@ spec:
      tls:
        mode: Terminate
        certificateRefs:
-          - group: ""
+          - kind: Secret
            kind: Secret
            name: vault-tls
Author	SHA1	Message	Date
unkinben	0fd269ed9a	fix(kanidm): prevent ArgoCD from overwriting repl-cert ConfigMap data Remove the data keys from kanidm-repl-certs in git so ArgoCD never takes SSA ownership of them. Add ignoreDifferences for /data on that ConfigMap in the ApplicationSet template so ArgoCD doesn't flag sidecar-patched cert values as out-of-sync.	2026-05-24 00:07:02 +10:00
unkinben	1112309a60	feat(kanidm): automate replication cert exchange via native sidecar Add a native sidecar (bitnami/kubectl, restartPolicy: Always) that runs kanidmd renew-replication-certificate on each pod and patches the result into the kanidm-repl-certs ConfigMap (certs are public keys, not secrets). The config-init init container reads peer certs from the ConfigMap at startup, building the replication stanza automatically — no manual cert exchange required after first deploy. Add RBAC (Role + RoleBinding) granting the kanidm service account pods/exec and configmap patch permissions scoped to the kanidm namespace.	2026-05-24 00:02:40 +10:00
unkinben	b87844b4cc	feat(kanidm): 3 replicas, PDB maxUnavailable=1, host anti-affinity - Increase replicas from 2 to 3 - Add kanidm-2 headless DNS SAN to TLS certificate - Add PodDisruptionBudget (maxUnavailable: 1) to maintain quorum during node drains - Add requiredDuringSchedulingIgnoredDuringExecution pod anti-affinity on kubernetes.io/hostname to spread replicas across distinct hosts - Update replication peers comment to include kanidm-2 cert exchange step	2026-05-23 23:49:30 +10:00
unkinben	2ddd2173e3	fix(argocd): add consul and vault to platform project destinations Same fix as benvin/fix-platform-destinations applied to this branch.	2026-05-23 23:16:52 +10:00
unkinben	1e88102a46	feat(kanidm): deploy Kanidm 1.10.3 with 2-replica replication ## Summary - Deploys Kanidm 1.10.3 (ghcr.io/kanidm/server:1.10.3) as a 2-replica StatefulSet with built-in replication enabled - Domain: auth.unkin.net (primary WebAuthn origin); au.auth.unkin.net is an additional hostname for this au-syd1 instance - TLS: cert-manager Certificate (vault-issuer) covering auth.unkin.net, au.auth.unkin.net, kanidm.k8s.syd1.au.unkin.net, and internal headless pod DNS names — Kanidm terminates TLS itself (passthrough) - Gateway: TLS passthrough on port 443 via TLSRoute; HTTP on port 80 redirects to HTTPS; external-dns creates kanidm.k8s.syd1.au.unkin.net (not used in server.toml; canonical origin is auth.unkin.net only) - Replication: init container generates per-pod server.toml with the correct repl:// origin (kanidm-{N}.kanidm-headless.kanidm.svc); populate kanidm-repl-peers ConfigMap post-deployment after running `kanidmd show-replication-certificate` on each pod - Storage: 10Gi cephrbd-fast-delete PVC per pod via volumeClaimTemplates - Security: runAsUser/runAsGroup 1000, runAsNonRoot, no privilege escalation, allowPrivilegeEscalation=false - ArgoCD: platform ApplicationSet and Project updated for kanidm namespace ## Requires - PR benvin/kanidm-artifactapi (add ^kanidm/ to ghcr immutable patterns) to be merged first so artifactapi can cache ghcr.io/kanidm/server ## Post-deployment steps 1. Wait for both pods to reach Running state 2. Exchange replication certificates between pods: kubectl exec -n kanidm kanidm-0 -- kanidmd show-replication-certificate kubectl exec -n kanidm kanidm-1 -- kanidmd show-replication-certificate 3. Edit kanidm-repl-peers ConfigMap with both nodes' certs (see template in configmap.yaml comments) 4. kubectl rollout restart statefulset/kanidm -n kanidm ## Test plan - [x] Sandbox tested in sandbox-kanidm: all 11 resources server dry-run OK - [ ] After merge: ArgoCD syncs kanidm namespace - [ ] Verify auth.unkin.net and au.auth.unkin.net reachable via Gateway - [ ] Verify kanidm.k8s.syd1.au.unkin.net DNS record created by external-dns - [ ] Complete replication cert exchange and verify replication active	2026-05-23 23:12:52 +10:00