fix(kanidm): prevent ArgoCD from overwriting repl-cert ConfigMap data

Remove the data keys from kanidm-repl-certs in git so ArgoCD never takes SSA ownership of them. Add ignoreDifferences for /data on that ConfigMap in the ApplicationSet template so ArgoCD doesn't flag sidecar-patched cert values as out-of-sync.
feat(kanidm): automate replication cert exchange via native sidecar
2026-05-24 19:42:32 +10:00 · 2026-05-24 19:42:32 +10:00 · 2026-05-24 19:42:32 +10:00 · 2026-05-24 19:42:32 +10:00
39 changed files with 132 additions and 420 deletions
@@ -1,3 +1,2 @@
 manifests/
 apps/**/charts/
-ci/crd-schemas/
@@ -6,7 +6,7 @@ repos:
      - id: check-executables-have-shebangs
      - id: check-json
      - id: check-added-large-files
-        args: ['--maxkb=2048']
+        args: ['--maxkb=500']
      - id: check-merge-conflict
      - id: check-shebang-scripts-are-executable
      - id: check-symlinks
@@ -2,21 +2,6 @@ when:
  - event: pull_request

 steps:
-  - name: generate-schemas
-    image: git.unkin.net/unkin/almalinux9-kubetest:20260319
-    commands:
-      - make generate-schemas
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 2
-
  - name: kubeconform
    image: git.unkin.net/unkin/almalinux9-kubetest:20260319
    commands:
@@ -11,11 +11,6 @@ kubeconform:
 	@ci/validate-apps.sh && \
 	ci/validate-clusters.sh

-# Generate JSON schemas from CRD definitions for kubeconform
-# Run when CRD versions change, then commit ci/crd-schemas/
-generate-schemas:
-	@ci/generate-crd-schemas.sh
-
 # Clean all generated manifests
 clean:
 	@rm -rf manifests/
@@ -8,9 +8,7 @@ spec:
  hostnames:
    - artifactapi.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: artifactapi
+    - name: artifactapi
      sectionName: http
  rules:
    - filters:
@@ -32,17 +30,12 @@ spec:
  hostnames:
    - artifactapi.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: artifactapi
+    - name: artifactapi
      sectionName: https
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: artifactapi-api
+        - name: artifactapi-api
          port: 80
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -6,7 +6,7 @@ remotes:
    immutable_patterns:
      - "^cloudnative-pg/cloudnative-pg"
      - "^emberstack/helm-charts"
-      - "^open-webui/open-webui"
+      - "^kanidm/"
      - "^openvoxproject/"
      - "^stakater/reloader"
      - "^stalwartlabs/stalwart"
@@ -35,7 +35,6 @@ remotes:
      - "^hashicorp/consul"
      - "^hashicorp/vault"
      - "^jfrog/"
-      - "^kanidm/"
      - "^rancher/"
      - "^rspamd/rspamd"
      - "^tozd/postfix"
@@ -36,7 +36,6 @@ remotes:
      - "neovim/neovim/.*/nvim-linux-x86_64.tar.gz$"
      - "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
      - "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
-      - "open-policy-agent/conftest/.*/conftest_.*_Linux_x86_64.tar.gz$"
      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
      - "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"
@@ -8,9 +8,7 @@ spec:
  hostnames:
    - rancher.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: rancher
+    - name: rancher
      sectionName: http
  rules:
    - filters:
@@ -32,17 +30,12 @@ spec:
  hostnames:
    - rancher.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: rancher
+    - name: rancher
      sectionName: https
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: rancher
+        - name: rancher
          port: 80
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -11,9 +11,7 @@ spec:
  hostnames:
    - consul.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: consul
+    - name: consul
      sectionName: http
  rules:
    - filters:
@@ -38,17 +36,12 @@ spec:
  hostnames:
    - consul.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: consul
+    - name: consul
      sectionName: https
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: consul-ui
+        - name: consul-ui
          port: 80
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -66,17 +59,12 @@ spec:
  hostnames:
    - consul.service.consul
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: consul
+    - name: consul
      sectionName: consul-svc
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: consul-ui
+        - name: consul-ui
          port: 80
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -1,32 +0,0 @@
-# kanidm
-
-Single-replica kanidm identity server deployment.
-
-## Initial setup
-
-After the pod starts for the first time, generate the admin and idm_admin credentials:
-
-```bash
-kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account admin
-kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account idm_admin
-```
-
-## Adding replication
-
-If replication is needed in the future:
-
-1. Scale the StatefulSet to 3 replicas and add `podAntiAffinity` to spread across nodes.
-2. Add a `[replication]` section to `configmap.yaml` per pod (origin is pod-specific:
-   `repl://kanidm-N.kanidm-headless.kanidm.svc.cluster.local:8444`).
-3. Add the replication port (8444) back to the StatefulSet container ports and headless service.
-4. Restore `rbac.yaml` for the cert-publisher sidecar, or exchange certificates manually:
-
-```bash
-# On each pod, get its replication certificate
-kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd renew-replication-certificate
-
-# Add each peer's certificate to the other pods' configs under:
-# [replication."repl://<peer-fqdn>:8444"]
-# type = "mutual-pull"
-# partner_cert = "<cert>"
-```
@@ -0,0 +1,40 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kanidm-config
+  namespace: kanidm
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
+data:
+  server.toml: |
+    version = "2"
+
+    domain = "auth.unkin.net"
+    origin = "https://auth.unkin.net"
+    bindaddress = "[::]:8443"
+    db_path = "/data/kanidm.db"
+    db_arc_size = 2048
+    tls_chain = "/data/tls/tls.crt"
+    tls_key = "/data/tls/tls.key"
+    log_level = "info"
+
+    [online_backup]
+    path = "/data/backups/"
+    schedule = "0 22 * * *"
+    versions = 7
+
+    [replication]
+    origin = "__REPL_ORIGIN__"
+    bindaddress = "[::]:8444"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kanidm-repl-certs
+  namespace: kanidm
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
+data: {}
@@ -13,9 +13,7 @@ spec:
    - auth.unkin.net
    - au.auth.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: kanidm
+    - name: kanidm
      sectionName: http
  rules:
    - filters:
@@ -5,23 +5,12 @@ kind: Kustomization
 resources:
  - namespace.yaml
  - serviceaccount.yaml
+  - rbac.yaml
  - certificate.yaml
+  - configmap.yaml
  - service.yaml
  - statefulset.yaml
  - poddisruptionbudget.yaml
  - gateway.yaml
  - httproute.yaml
  - tlsroute.yaml
-
-configMapGenerator:
-  - name: kanidm-config
-    namespace: kanidm
-    options:
-      disableNameSuffixHash: true
-      labels:
-        app.kubernetes.io/name: kanidm
-        app.kubernetes.io/instance: kanidm
-    files:
-      - server-0.toml=resources/server-0.toml
-      - server-1.toml=resources/server-1.toml
-      - server-2.toml=resources/server-2.toml
@@ -1,27 +0,0 @@
-version = "2"
-
-domain = "auth.unkin.net"
-origin = "https://auth.unkin.net"
-bindaddress = "[::]:8443"
-db_path = "/data/kanidm.db"
-db_arc_size = 2048
-tls_chain = "/data/tls/tls.crt"
-tls_key = "/data/tls/tls.key"
-log_level = "info"
-
-[online_backup]
-path = "/data/backups/"
-schedule = "0 22 * * *"
-versions = 7
-
-[replication]
-origin = "repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"
-bindaddress = "[::]:8444"
-
-[replication."repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"]
-type = "mutual-pull"
-partner_cert = "MIIB-TCCAZ-gAwIBAgIRASqOpORz60wiv7wF_7oBOxQwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkMmE4ZWE0ZTQtNzNlYi00YzIyLWJmYmMtMDVmZmJhMDEzYjE0MRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMyODM5WhcNMzAwNTI1MTMyODM5WjBMMS0wKwYDVQQDDCQyYThlYTRlNC03M2ViLTRjMjItYmZiYy0wNWZmYmEwMTNiMTQxGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFQP3zpFRt7TCOhzrUpOJBojn-sC2LmqZUub8P2ymVdIQbmoAyh4Q8Me0hNWJFyuFDnnqO06dt5I2iv0910-X6KjYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMS5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0gAMEUCIGjl58U6apcDjMEPIca8Wwg_JMfuMvV-uVcJI49Gl_9GAiEA2tFdb9rnFeBI7mwysScf5UsmY3ZziMD3UVm1vWN2IKs"
-
-[replication."repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"]
-type = "mutual-pull"
-partner_cert = "MIIB-TCCAZ-gAwIBAgIRAeFGUAJbCkJ2vzf_Vv4qjeUwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkZTE0NjUwMDItNWIwYS00Mjc2LWJmMzctZmY1NmZlMmE4ZGU1MRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMyOTEwWhcNMzAwNTI1MTMyOTEwWjBMMS0wKwYDVQQDDCRlMTQ2NTAwMi01YjBhLTQyNzYtYmYzNy1mZjU2ZmUyYThkZTUxGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCrncHSbDNSV3_aOSZ14plbVfrvSXQQL9MOqvrDKlf_Q6WbcA8OrTUjs3Jt0Q2beWjC3Z5-5c9fGu8M_k2iVWf-jYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMi5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0gAMEUCIQDHY5Yl-bhDTuJaYnHSMSiSAEWPrDcRVzvfmOJukuJ1QQIgSwgyeSG3K0MY87DI1RDYAdZlpP1YOK3Yatj7-YSXPC0"
@@ -1,27 +0,0 @@
-version = "2"
-
-domain = "auth.unkin.net"
-origin = "https://auth.unkin.net"
-bindaddress = "[::]:8443"
-db_path = "/data/kanidm.db"
-db_arc_size = 2048
-tls_chain = "/data/tls/tls.crt"
-tls_key = "/data/tls/tls.key"
-log_level = "info"
-
-[online_backup]
-path = "/data/backups/"
-schedule = "0 22 * * *"
-versions = 7
-
-[replication]
-origin = "repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"
-bindaddress = "[::]:8444"
-
-[replication."repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"]
-type = "mutual-pull"
-partner_cert = "MIIB-jCCAZ-gAwIBAgIRAVKuoPDpF0IBnvFjCwdK41EwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkNTJhZWEwZjAtZTkxNy00MjAxLTllZjEtNjMwYjA3NGFlMzUxMRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMzNzQ5WhcNMzAwNTI1MTMzNzQ5WjBMMS0wKwYDVQQDDCQ1MmFlYTBmMC1lOTE3LTQyMDEtOWVmMS02MzBiMDc0YWUzNTExGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGejqjk0Eet-RILHI236wHYqISdnPlebqnkuUTh4W2mCzkmqKibyjxGIUOs8LBrUeTR2DxVR1VV6H2rYQk2wdROjYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMC5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0kAMEYCIQCSkFj2A-KVWv2tKJLFzb18J5eWWKtsvWewZTn-FVnRnQIhAKJbt84IoZ9oXxgfp0VOLyVZiAgUgwMFS6JOfno3D-Nw"
-
-[replication."repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"]
-type = "mutual-pull"
-partner_cert = "MIIB-TCCAZ-gAwIBAgIRAeFGUAJbCkJ2vzf_Vv4qjeUwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkZTE0NjUwMDItNWIwYS00Mjc2LWJmMzctZmY1NmZlMmE4ZGU1MRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMyOTEwWhcNMzAwNTI1MTMyOTEwWjBMMS0wKwYDVQQDDCRlMTQ2NTAwMi01YjBhLTQyNzYtYmYzNy1mZjU2ZmUyYThkZTUxGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCrncHSbDNSV3_aOSZ14plbVfrvSXQQL9MOqvrDKlf_Q6WbcA8OrTUjs3Jt0Q2beWjC3Z5-5c9fGu8M_k2iVWf-jYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMi5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0gAMEUCIQDHY5Yl-bhDTuJaYnHSMSiSAEWPrDcRVzvfmOJukuJ1QQIgSwgyeSG3K0MY87DI1RDYAdZlpP1YOK3Yatj7-YSXPC0"
@@ -1,27 +0,0 @@
-version = "2"
-
-domain = "auth.unkin.net"
-origin = "https://auth.unkin.net"
-bindaddress = "[::]:8443"
-db_path = "/data/kanidm.db"
-db_arc_size = 2048
-tls_chain = "/data/tls/tls.crt"
-tls_key = "/data/tls/tls.key"
-log_level = "info"
-
-[online_backup]
-path = "/data/backups/"
-schedule = "0 22 * * *"
-versions = 7
-
-[replication]
-origin = "repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"
-bindaddress = "[::]:8444"
-
-[replication."repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"]
-type = "mutual-pull"
-partner_cert = "MIIB-jCCAZ-gAwIBAgIRAVKuoPDpF0IBnvFjCwdK41EwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkNTJhZWEwZjAtZTkxNy00MjAxLTllZjEtNjMwYjA3NGFlMzUxMRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMzNzQ5WhcNMzAwNTI1MTMzNzQ5WjBMMS0wKwYDVQQDDCQ1MmFlYTBmMC1lOTE3LTQyMDEtOWVmMS02MzBiMDc0YWUzNTExGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGejqjk0Eet-RILHI236wHYqISdnPlebqnkuUTh4W2mCzkmqKibyjxGIUOs8LBrUeTR2DxVR1VV6H2rYQk2wdROjYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMC5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0kAMEYCIQCSkFj2A-KVWv2tKJLFzb18J5eWWKtsvWewZTn-FVnRnQIhAKJbt84IoZ9oXxgfp0VOLyVZiAgUgwMFS6JOfno3D-Nw"
-
-[replication."repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"]
-type = "mutual-pull"
-partner_cert = "MIIB-TCCAZ-gAwIBAgIRASqOpORz60wiv7wF_7oBOxQwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkMmE4ZWE0ZTQtNzNlYi00YzIyLWJmYmMtMDVmZmJhMDEzYjE0MRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMyODM5WhcNMzAwNTI1MTMyODM5WjBMMS0wKwYDVQQDDCQyYThlYTRlNC03M2ViLTRjMjItYmZiYy0wNWZmYmEwMTNiMTQxGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFQP3zpFRt7TCOhzrUpOJBojn-sC2LmqZUub8P2ymVdIQbmoAyh4Q8Me0hNWJFyuFDnnqO06dt5I2iv0910-X6KjYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMS5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0gAMEUCIGjl58U6apcDjMEPIca8Wwg_JMfuMvV-uVcJI49Gl_9GAiEA2tFdb9rnFeBI7mwysScf5UsmY3ZziMD3UVm1vWN2IKs"
@@ -36,10 +36,24 @@ spec:
        fsGroup: 1000
      initContainers:
        - name: config-init
-          image: busybox:1.36
+          image: ghcr.io/kanidm/server:1.10.3
          command: ["/bin/sh", "-c"]
          args:
-            - cp "/config-template/server-${POD_NAME##*-}.toml" /config/server.toml
+            - |
+              set -e
+              REPL_ORIGIN="repl://${POD_NAME}.kanidm-headless.kanidm.svc.cluster.local:8444"
+              sed "s|__REPL_ORIGIN__|${REPL_ORIGIN}|g" /config-template/server.toml > /config/server.toml
+              for peer in kanidm-0 kanidm-1 kanidm-2; do
+                if [ "${peer}" = "${POD_NAME}" ]; then
+                  continue
+                fi
+                cert_file="/repl-certs/${peer}"
+                if [ -s "${cert_file}" ]; then
+                  fqdn="${peer}.kanidm-headless.kanidm.svc.cluster.local"
+                  printf '\n[replication."repl://%s:8444"]\ntype = "mutual-pull"\npartner_cert = "%s"\n' \
+                    "${fqdn}" "$(cat ${cert_file})" >> /config/server.toml
+                fi
+              done
          env:
            - name: POD_NAME
              valueFrom:
@@ -48,15 +62,44 @@ spec:
          volumeMounts:
            - name: config-template
              mountPath: /config-template
-              readOnly: true
            - name: config
              mountPath: /config
+            - name: repl-certs
+              mountPath: /repl-certs
+              readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
+        - name: repl-cert-publisher
+          image: bitnami/kubectl:1.33
+          restartPolicy: Always
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              until kubectl exec "${POD_NAME}" -c kanidm -- /sbin/kanidmd renew-replication-certificate 2>/dev/null | grep -q '^# certificate:'; do
+                sleep 30
+              done
+              while true; do
+                cert=$(kubectl exec "${POD_NAME}" -c kanidm -- /sbin/kanidmd renew-replication-certificate 2>/dev/null \
+                  | grep '^# certificate:' | sed 's/^# certificate: "\(.*\)"$/\1/')
+                if [ -n "${cert}" ]; then
+                  kubectl patch configmap kanidm-repl-certs \
+                    --type=merge \
+                    -p "{\"data\":{\"${POD_NAME}\":\"${cert}\"}}"
+                fi
+                sleep 3600
+              done
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
      containers:
        - name: kanidm
-          image: kanidm/server:1.10.3
+          image: ghcr.io/kanidm/server:1.10.3
          command: ["/sbin/kanidmd"]
          args: ["server", "-c", "/config/server.toml"]
          ports:
@@ -101,6 +144,9 @@ spec:
            name: kanidm-config
        - name: config
          emptyDir: {}
+        - name: repl-certs
+          configMap:
+            name: kanidm-repl-certs
        - name: tls
          secret:
            secretName: kanidm-tls
@@ -13,14 +13,9 @@ spec:
    - auth.unkin.net
    - au.auth.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: kanidm
+    - name: kanidm
      sectionName: https-passthrough
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: kanidm
+        - name: kanidm
          port: 8443
-          weight: 1
@@ -76,8 +76,8 @@ spec:
    updateInterval: 30
  resources:
    limits:
-      cpu: "1"
-      memory: 1Gi
+      cpu: 1
+      memory: 1024Mi
    requests:
      cpu: 250m
      memory: 512Mi
@@ -8,9 +8,7 @@ spec:
  hostnames:
    - litellm.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: litellm
+    - name: litellm
      sectionName: http
  rules:
    - filters:
@@ -32,17 +30,12 @@ spec:
  hostnames:
    - litellm.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: litellm
+    - name: litellm
      sectionName: https
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: litellm
+        - name: litellm
          port: 4000
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -8,9 +8,7 @@ spec:
  hostnames:
    - paperclip.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: paperclip
+    - name: paperclip
      sectionName: http
  rules:
    - filters:
@@ -32,17 +30,12 @@ spec:
  hostnames:
    - paperclip.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: paperclip
+    - name: paperclip
      sectionName: https
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: paperclip
+        - name: paperclip
          port: 3100
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - priorityclasses.yaml
@@ -1,36 +0,0 @@
---
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: low
-value: 100
-preemptionPolicy: Never
-globalDefault: false
-description: "Low-importance workloads. Can be evicted under pressure but will not preempt other pods."
---
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: power
-value: 100
-preemptionPolicy: Never
-globalDefault: false
-description: "Compute-heavy workloads with low scheduling importance. Evictable under pressure."
---
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: medium
-value: 10000
-preemptionPolicy: PreemptLowerPriority
-globalDefault: false
-description: "Standard workloads. Will preempt low-priority pods if the cluster is under pressure."
---
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: high
-value: 100000
-preemptionPolicy: PreemptLowerPriority
-globalDefault: false
-description: "High-importance services. Will preempt medium- and low-priority pods if necessary."
@@ -13,9 +13,7 @@ spec:
  hostnames:
    - puppetboard.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: puppetboard
+    - name: puppetboard
      sectionName: http
  rules:
    - filters:
@@ -42,17 +40,12 @@ spec:
  hostnames:
    - puppetboard.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: puppetboard
+    - name: puppetboard
      sectionName: https
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: puppetboard
+        - name: puppetboard
          port: 80
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -13,17 +13,12 @@ spec:
  hostnames:
    - puppetdb.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: puppetdb
+    - name: puppetdb
      sectionName: https
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: puppetdb
+        - name: puppetdb
          port: 8080
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -9,6 +9,7 @@ metadata:
  name: puppetdb
  namespace: puppet
 spec:
+  clusterIP: null
  ports:
  - name: pdb-http
    port: 8080
@@ -11,9 +11,7 @@ spec:
  hostnames:
    - vault.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: vault
+    - name: vault
      sectionName: http
  rules:
    - filters:
@@ -38,17 +36,12 @@ spec:
  hostnames:
    - vault.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: vault
+    - name: vault
      sectionName: https
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: vault
+        - name: vault
          port: 8200
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -67,17 +60,12 @@ spec:
    - vault.service.consul
    - vault.query.consul
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: vault
+    - name: vault
      sectionName: vault-direct
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: vault
+        - name: vault
          port: 8200
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -6,4 +6,3 @@ resources:
  - namespace.yaml
  - gateway.yaml
  - httproute.yaml
-  - role_k8s-service-registration.yaml
@@ -1,24 +0,0 @@
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: vault-k8s-service-registration
-  namespace: vault
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "update", "patch"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: vault-k8s-service-registration
-  namespace: vault
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: vault-k8s-service-registration
-subjects:
-  - kind: ServiceAccount
-    name: vault
-    namespace: vault
@@ -37,7 +37,7 @@ server:
      cpu: 100m
    limits:
      memory: 2Gi
-      cpu: "1"
+      cpu: 1000m

 client:
  enabled: false
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/priority-classes
@@ -40,7 +40,9 @@ server:
          }
        }

-        service_registration "kubernetes" {}
+        service_registration "consul" {
+          address = "consul-server.consul.svc.cluster.local:8500"
+        }

  dataStorage:
    enabled: true
@@ -48,14 +50,6 @@ server:
    storageClass: cephrbd-fast-delete
    accessMode: ReadWriteOnce

-  extraEnv:
-    - name: VAULT_K8S_NAMESPACE
-      value: vault
-    - name: VAULT_K8S_POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-
  statefulSet:
    securityContext:
      container:
@@ -2,7 +2,6 @@ agent:
  replicaCount: 3
  env:
    WOODPECKER_MAX_WORKFLOWS: "8"
-    WOODPECKER_BACKEND_K8S_PRIORITY_CLASS: power
    WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete
    WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G
    WOODPECKER_BACKEND_K8S_STORAGE_RWX: false
@@ -22,7 +22,6 @@ spec:
      - path: apps/overlays/*/jfrog
      - path: apps/overlays/*/kanidm
      - path: apps/overlays/*/node-feature-discovery
-      - path: apps/overlays/*/priority-classes
      - path: apps/overlays/*/puppet
      - path: apps/overlays/*/purelb
      - path: apps/overlays/*/reflector-system
@@ -31,8 +31,6 @@ spec:
      server: https://kubernetes.default.svc
    - namespace: 'node-feature-discovery'
      server: https://kubernetes.default.svc
-    - namespace: 'priority-classes'
-      server: https://kubernetes.default.svc
    - namespace: 'purelb'
      server: https://kubernetes.default.svc
    - namespace: 'puppet'
@@ -1,49 +0,0 @@
-#!/usr/bin/env -S uv run
-# /// script
-# requires-python = ">=3.11"
-# dependencies = ["pyyaml"]
-# ///
-"""
-Extract OpenAPI v3 schemas from CRD YAML on stdin and write JSON schema files
-to the output directory for use with kubeconform.
-
-Usage: kustomize build ... | ci/generate-crd-schemas.py <output-dir>
-"""
-import sys
-import json
-import os
-
-import yaml
-
-
-def main() -> int:
-    output_dir = sys.argv[1] if len(sys.argv) > 1 else "ci/crd-schemas"
-    count = 0
-
-    for doc in yaml.safe_load_all(sys.stdin):
-        if not doc or doc.get("kind") != "CustomResourceDefinition":
-            continue
-
-        group = doc["spec"]["group"]
-        kind = doc["spec"]["names"]["kind"]
-        group_dir = os.path.join(output_dir, group)
-        os.makedirs(group_dir, exist_ok=True)
-
-        for ver in doc["spec"].get("versions", []):
-            if not ver.get("served", True):
-                continue
-            schema = ver.get("schema", {}).get("openAPIV3Schema")
-            if not schema:
-                continue
-            fname = os.path.join(group_dir, f"{kind.lower()}_{ver['name']}.json")
-            with open(fname, "w") as f:
-                json.dump({"$schema": "http://json-schema.org/schema#", **schema}, f, indent=2)
-                f.write("\n")
-            print(f"  wrote {fname}", file=sys.stderr)
-            count += 1
-
-    return count
-
-
-if __name__ == "__main__":
-    print(main())
@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-# Extract OpenAPI v3 schemas from CRD definitions in all kustomize overlays
-# and write JSON schema files to ci/crd-schemas/ for kubeconform validation.
-#
-# Run this script whenever CRD versions change, then commit the output.
-# Usage: ci/generate-crd-schemas.sh [output-dir]
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-OUTPUT_DIR="${1:-${SCRIPT_DIR}/crd-schemas}"
-mkdir -p "$OUTPUT_DIR"
-
-total=0
-
-while IFS= read -r -d "" k; do
-  dir="$(dirname "$k")"
-  n=$(kustomize build --enable-helm "$dir" 2>/dev/null \
-    | "$SCRIPT_DIR/generate-crd-schemas.py" "$OUTPUT_DIR") || continue
-  total=$((total + n))
-done < <(find apps/overlays clusters -name kustomization.yaml -print0 | sort -z)
-
-echo "Generated ${total} schema(s) in ${OUTPUT_DIR}" >&2
@@ -6,7 +6,6 @@ KUBE_VERSION="1.33.7"
 schema_args=(
  -schema-location "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/{{.NormalizedKubernetesVersion}}-standalone{{.StrictSuffix}}/{{.ResourceKind}}{{.KindSuffix}}.json"
  -schema-location "https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
-  -schema-location "file://${PWD}/ci/crd-schemas/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
 )

 while IFS= read -r -d "" k; do
@@ -19,6 +18,6 @@ while IFS= read -r -d "" k; do
        -summary \
        -output pretty \
        -verbose \
-        -skip GpuDevicePlugin,LBNodeAgent,ServiceGroup \
+        -skip CustomResourceDefinition,GpuDevicePlugin,LBNodeAgent,ServiceGroup \
        "${schema_args[@]}"
 done < <(find apps/overlays -name kustomization.yaml -print0)
@@ -6,7 +6,6 @@ KUBE_VERSION="1.33.7"
 schema_args=(
  -schema-location "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/{{.NormalizedKubernetesVersion}}-standalone{{.StrictSuffix}}/{{.ResourceKind}}{{.KindSuffix}}.json"
  -schema-location "https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
-  -schema-location "file://${PWD}/ci/crd-schemas/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
 )

 while IFS= read -r -d "" k; do
Author	SHA1	Message	Date
unkinben	7d2e0dfa0f	fix(kanidm): prevent ArgoCD from overwriting repl-cert ConfigMap data ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details Remove the data keys from kanidm-repl-certs in git so ArgoCD never takes SSA ownership of them. Add ignoreDifferences for /data on that ConfigMap in the ApplicationSet template so ArgoCD doesn't flag sidecar-patched cert values as out-of-sync.	2026-05-24 19:42:32 +10:00
unkinben	11286a1f89	feat(kanidm): automate replication cert exchange via native sidecar Add a native sidecar (bitnami/kubectl, restartPolicy: Always) that runs kanidmd renew-replication-certificate on each pod and patches the result into the kanidm-repl-certs ConfigMap (certs are public keys, not secrets). The config-init init container reads peer certs from the ConfigMap at startup, building the replication stanza automatically — no manual cert exchange required after first deploy. Add RBAC (Role + RoleBinding) granting the kanidm service account pods/exec and configmap patch permissions scoped to the kanidm namespace.	2026-05-24 19:42:32 +10:00
unkinben	e91fe554eb	feat(kanidm): 3 replicas, PDB maxUnavailable=1, host anti-affinity - Increase replicas from 2 to 3 - Add kanidm-2 headless DNS SAN to TLS certificate - Add PodDisruptionBudget (maxUnavailable: 1) to maintain quorum during node drains - Add requiredDuringSchedulingIgnoredDuringExecution pod anti-affinity on kubernetes.io/hostname to spread replicas across distinct hosts - Update replication peers comment to include kanidm-2 cert exchange step	2026-05-24 19:42:32 +10:00
unkinben	ee76ec199b	feat(kanidm): deploy Kanidm 1.10.3 with 2-replica replication ## Summary - Deploys Kanidm 1.10.3 (ghcr.io/kanidm/server:1.10.3) as a 2-replica StatefulSet with built-in replication enabled - Domain: auth.unkin.net (primary WebAuthn origin); au.auth.unkin.net is an additional hostname for this au-syd1 instance - TLS: cert-manager Certificate (vault-issuer) covering auth.unkin.net, au.auth.unkin.net, kanidm.k8s.syd1.au.unkin.net, and internal headless pod DNS names — Kanidm terminates TLS itself (passthrough) - Gateway: TLS passthrough on port 443 via TLSRoute; HTTP on port 80 redirects to HTTPS; external-dns creates kanidm.k8s.syd1.au.unkin.net (not used in server.toml; canonical origin is auth.unkin.net only) - Replication: init container generates per-pod server.toml with the correct repl:// origin (kanidm-{N}.kanidm-headless.kanidm.svc); populate kanidm-repl-peers ConfigMap post-deployment after running `kanidmd show-replication-certificate` on each pod - Storage: 10Gi cephrbd-fast-delete PVC per pod via volumeClaimTemplates - Security: runAsUser/runAsGroup 1000, runAsNonRoot, no privilege escalation, allowPrivilegeEscalation=false - ArgoCD: platform ApplicationSet and Project updated for kanidm namespace ## Requires - PR benvin/kanidm-artifactapi (add ^kanidm/ to ghcr immutable patterns) to be merged first so artifactapi can cache ghcr.io/kanidm/server ## Post-deployment steps 1. Wait for both pods to reach Running state 2. Exchange replication certificates between pods: kubectl exec -n kanidm kanidm-0 -- kanidmd show-replication-certificate kubectl exec -n kanidm kanidm-1 -- kanidmd show-replication-certificate 3. Edit kanidm-repl-peers ConfigMap with both nodes' certs (see template in configmap.yaml comments) 4. kubectl rollout restart statefulset/kanidm -n kanidm ## Test plan - [x] Sandbox tested in sandbox-kanidm: all 11 resources server dry-run OK - [ ] After merge: ArgoCD syncs kanidm namespace - [ ] Verify auth.unkin.net and au.auth.unkin.net reachable via Gateway - [ ] Verify kanidm.k8s.syd1.au.unkin.net DNS record created by external-dns - [ ] Complete replication cert exchange and verify replication active	2026-05-24 19:42:32 +10:00