fix(kanidm): prevent ArgoCD from overwriting repl-cert ConfigMap data

Remove the data keys from kanidm-repl-certs in git so ArgoCD never takes SSA ownership of them. Add ignoreDifferences for /data on that ConfigMap in the ApplicationSet template so ArgoCD doesn't flag sidecar-patched cert values as out-of-sync.
feat(kanidm): automate replication cert exchange via native sidecar
2026-05-24 19:42:32 +10:00 · 2026-05-24 19:42:32 +10:00 · 2026-05-24 19:42:32 +10:00 · 2026-05-24 19:42:32 +10:00
24 changed files with 44 additions and 397 deletions
@@ -40,10 +40,3 @@ repos:
        entry: ci/validate-no-secrets.sh
        language: system
        pass_filenames: false
-      - id: conftest_policies
-        name: OPA policy checks (conftest)
-        entry: conftest test --policy policy/
-        language: system
-        types: [yaml]
-        exclude: ".*/charts/.*|.*/templates/.*|\\.woodpecker/.*"
-        pass_filenames: true
@@ -8,9 +8,7 @@ spec:
  hostnames:
    - artifactapi.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: artifactapi
+    - name: artifactapi
      sectionName: http
  rules:
    - filters:
@@ -32,17 +30,12 @@ spec:
  hostnames:
    - artifactapi.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: artifactapi
+    - name: artifactapi
      sectionName: https
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: artifactapi-api
+        - name: artifactapi-api
          port: 80
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -6,6 +6,7 @@ remotes:
    immutable_patterns:
      - "^cloudnative-pg/cloudnative-pg"
      - "^emberstack/helm-charts"
+      - "^kanidm/"
      - "^openvoxproject/"
      - "^stakater/reloader"
      - "^stalwartlabs/stalwart"
@@ -34,7 +35,6 @@ remotes:
      - "^hashicorp/consul"
      - "^hashicorp/vault"
      - "^jfrog/"
-      - "^kanidm/"
      - "^rancher/"
      - "^rspamd/rspamd"
      - "^tozd/postfix"
@@ -8,9 +8,7 @@ spec:
  hostnames:
    - rancher.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: rancher
+    - name: rancher
      sectionName: http
  rules:
    - filters:
@@ -32,17 +30,12 @@ spec:
  hostnames:
    - rancher.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: rancher
+    - name: rancher
      sectionName: https
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: rancher
+        - name: rancher
          port: 80
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -11,9 +11,7 @@ spec:
  hostnames:
    - consul.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: consul
+    - name: consul
      sectionName: http
  rules:
    - filters:
@@ -38,17 +36,12 @@ spec:
  hostnames:
    - consul.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: consul
+    - name: consul
      sectionName: https
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: consul-ui
+        - name: consul-ui
          port: 80
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -66,17 +59,12 @@ spec:
  hostnames:
    - consul.service.consul
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: consul
+    - name: consul
      sectionName: consul-svc
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: consul-ui
+        - name: consul-ui
          port: 80
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -13,9 +13,7 @@ spec:
    - auth.unkin.net
    - au.auth.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: kanidm
+    - name: kanidm
      sectionName: http
  rules:
    - filters:
@@ -36,7 +36,7 @@ spec:
        fsGroup: 1000
      initContainers:
        - name: config-init
-          image: kanidm/server:1.10.3
+          image: ghcr.io/kanidm/server:1.10.3
          command: ["/bin/sh", "-c"]
          args:
            - |
@@ -99,7 +99,7 @@ spec:
            readOnlyRootFilesystem: false
      containers:
        - name: kanidm
-          image: kanidm/server:1.10.3
+          image: ghcr.io/kanidm/server:1.10.3
          command: ["/sbin/kanidmd"]
          args: ["server", "-c", "/config/server.toml"]
          ports:
@@ -76,8 +76,8 @@ spec:
    updateInterval: 30
  resources:
    limits:
-      cpu: "1"
-      memory: 1Gi
+      cpu: 1
+      memory: 1024Mi
    requests:
      cpu: 250m
      memory: 512Mi
@@ -8,9 +8,7 @@ spec:
  hostnames:
    - litellm.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: litellm
+    - name: litellm
      sectionName: http
  rules:
    - filters:
@@ -32,17 +30,12 @@ spec:
  hostnames:
    - litellm.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: litellm
+    - name: litellm
      sectionName: https
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: litellm
+        - name: litellm
          port: 4000
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -8,9 +8,7 @@ spec:
  hostnames:
    - paperclip.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: paperclip
+    - name: paperclip
      sectionName: http
  rules:
    - filters:
@@ -32,17 +30,12 @@ spec:
  hostnames:
    - paperclip.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: paperclip
+    - name: paperclip
      sectionName: https
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: paperclip
+        - name: paperclip
          port: 3100
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -150,7 +150,7 @@ spec:
              memory: 350Mi
              cpu: 100m
            limits:
-              memory: 1Gi
+              memory: 1024Mi
              cpu: 500m
          securityContext:
            runAsNonRoot: true
@@ -35,7 +35,7 @@ spec:
          imagePullPolicy: IfNotPresent
          resources:
            limits:
-              cpu: "1"
+              cpu: 1
              memory: 1536Mi
            requests:
              cpu: 250m
@@ -31,11 +31,11 @@ spec:
        imagePullPolicy: IfNotPresent
        resources:
          limits:
-            cpu: "2"
-            memory: 3Gi
+            cpu: 2
+            memory: 3072Mi
          requests:
            cpu: 500m
-            memory: 1Gi
+            memory: 1024Mi
        ports:
        - containerPort: 8140
          name: puppetserver
@@ -35,11 +35,11 @@ spec:
          imagePullPolicy: IfNotPresent
          resources:
            limits:
-              cpu: "2"
+              cpu: 2
              memory: 3500Mi
            requests:
              cpu: 250m
-              memory: 1Gi
+              memory: 1024Mi
          ports:
            - containerPort: 8140
              name: puppetserver
@@ -13,9 +13,7 @@ spec:
  hostnames:
    - puppetboard.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: puppetboard
+    - name: puppetboard
      sectionName: http
  rules:
    - filters:
@@ -42,17 +40,12 @@ spec:
  hostnames:
    - puppetboard.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: puppetboard
+    - name: puppetboard
      sectionName: https
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: puppetboard
+        - name: puppetboard
          port: 80
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -13,17 +13,12 @@ spec:
  hostnames:
    - puppetdb.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: puppetdb
+    - name: puppetdb
      sectionName: https
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: puppetdb
+        - name: puppetdb
          port: 8080
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -53,7 +53,7 @@ spec:
                  cpu: 500m
                  memory: 1Gi
                limits:
-                  cpu: "2"
+                  cpu: 2000m
                  memory: 4Gi
              volumeMounts:
                - name: repodata
@@ -56,7 +56,7 @@ spec:
                  cpu: 500m
                  memory: 1Gi
                limits:
-                  cpu: "2"
+                  cpu: 2000m
                  memory: 4Gi
              volumeMounts:
                - name: repodata
@@ -53,7 +53,7 @@ spec:
                  cpu: 500m
                  memory: 1Gi
                limits:
-                  cpu: "2"
+                  cpu: 2000m
                  memory: 4Gi
              volumeMounts:
                - name: repodata
@@ -52,7 +52,7 @@ spec:
                  cpu: 500m
                  memory: 1Gi
                limits:
-                  cpu: "2"
+                  cpu: 2000m
                  memory: 4Gi
              volumeMounts:
                - name: repodata
@@ -11,9 +11,7 @@ spec:
  hostnames:
    - vault.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: vault
+    - name: vault
      sectionName: http
  rules:
    - filters:
@@ -38,17 +36,12 @@ spec:
  hostnames:
    - vault.k8s.syd1.au.unkin.net
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: vault
+    - name: vault
      sectionName: https
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: vault
+        - name: vault
          port: 8200
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -67,17 +60,12 @@ spec:
    - vault.service.consul
    - vault.query.consul
  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: vault
+    - name: vault
      sectionName: vault-direct
  rules:
    - backendRefs:
-        - group: ""
-          kind: Service
-          name: vault
+        - name: vault
          port: 8200
-          weight: 1
      matches:
        - path:
            type: PathPrefix
@@ -1,94 +0,0 @@
-package main
-
-# Gateway API resources require several fields to be set explicitly even though
-# the Gateway API controller defaults them. ArgoCD diffs desired vs live by
-# string comparison, so any field the controller defaults that is absent from
-# the git manifest causes a permanent OutOfSync.
-#
-# Affected resources:
-#   HTTPRoute / TLSRoute — parentRefs and backendRefs (see PR #162, #165)
-#   Gateway              — listeners[*].tls.certificateRefs (see PR #153)
-
-_route_kinds := {"HTTPRoute", "TLSRoute"}
-
-# ---- parentRefs: group must be "gateway.networking.k8s.io" ----
-
-deny contains msg if {
-    _route_kinds[input.kind]
-    ref := input.spec.parentRefs[i]
-    object.get(ref, "group", null) != "gateway.networking.k8s.io"
-    msg := sprintf(
-        "%s %s/%s parentRefs[%d]: add 'group: gateway.networking.k8s.io' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
-        [input.kind, input.metadata.namespace, input.metadata.name, i],
-    )
-}
-
-# ---- parentRefs: kind must be "Gateway" ----
-
-deny contains msg if {
-    _route_kinds[input.kind]
-    ref := input.spec.parentRefs[i]
-    object.get(ref, "kind", null) != "Gateway"
-    msg := sprintf(
-        "%s %s/%s parentRefs[%d]: add 'kind: Gateway' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
-        [input.kind, input.metadata.namespace, input.metadata.name, i],
-    )
-}
-
-# ---- backendRefs: group must be present (may be empty string "") ----
-
-deny contains msg if {
-    _route_kinds[input.kind]
-    rule := input.spec.rules[ri]
-    ref := rule.backendRefs[bi]
-    not _has_key(ref, "group")
-    msg := sprintf(
-        "%s %s/%s rules[%d].backendRefs[%d]: add 'group: \"\"' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
-        [input.kind, input.metadata.namespace, input.metadata.name, ri, bi],
-    )
-}
-
-# ---- backendRefs: kind must be "Service" ----
-
-deny contains msg if {
-    _route_kinds[input.kind]
-    rule := input.spec.rules[ri]
-    ref := rule.backendRefs[bi]
-    object.get(ref, "kind", null) != "Service"
-    msg := sprintf(
-        "%s %s/%s rules[%d].backendRefs[%d]: add 'kind: Service' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
-        [input.kind, input.metadata.namespace, input.metadata.name, ri, bi],
-    )
-}
-
-# ---- backendRefs: weight must be present ----
-
-deny contains msg if {
-    _route_kinds[input.kind]
-    rule := input.spec.rules[ri]
-    ref := rule.backendRefs[bi]
-    not _has_key(ref, "weight")
-    msg := sprintf(
-        "%s %s/%s rules[%d].backendRefs[%d]: add 'weight: 1' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
-        [input.kind, input.metadata.namespace, input.metadata.name, ri, bi],
-    )
-}
-
-# ---- Gateway certificateRefs: group must be present (may be empty string "") ----
-
-deny contains msg if {
-    input.kind == "Gateway"
-    listener := input.spec.listeners[li]
-    ref := listener.tls.certificateRefs[ci]
-    not _has_key(ref, "group")
-    msg := sprintf(
-        "Gateway %s/%s listeners[%d].tls.certificateRefs[%d]: add 'group: \"\"' — admission webhook defaults this field, causing ArgoCD OutOfSync when omitted",
-        [input.metadata.namespace, input.metadata.name, li, ci],
-    )
-}
-
-# ---- Helper: key presence check (works for null, "", and any defined value) ----
-
-_has_key(obj, key) if {
-    _ = obj[key]
-}
@@ -1,13 +0,0 @@
-package main
-
-# Deny all Kubernetes Ingress resources.
-# This cluster uses Gateway API (HTTPRoute + Gateway) for ingress routing.
-# Ingress is the legacy API and must not be added.
-
-deny contains msg if {
-    input.kind == "Ingress"
-    msg := sprintf(
-        "%s/%s: Ingress resources are forbidden — use Gateway API HTTPRoute instead",
-        [input.metadata.namespace, input.metadata.name],
-    )
-}
@@ -1,173 +0,0 @@
-package main
-
-# Kubernetes normalizes resource quantity values on write. ArgoCD diffs by
-# string comparison, so a non-canonical value in git will always differ from
-# the live object, causing permanent OutOfSync.
-#
-# Rules enforced here:
-#   CPU integers  — k8s converts integer 1 to string "1" (see PR #163)
-#   CPU milliCPU  — k8s converts 1000m → "1", 2000m → "2", etc. (PR #164)
-#   Memory Mi→Gi  — k8s converts 1024Mi → 1Gi, 2048Mi → 2Gi, etc. (PR #163)
-#   clusterIP null — k8s assigns a real IP; null in git always differs
-#                    from the live assigned value (see PR #166)
-
-# ---- Container helpers ----
-# Extracts containers from Deployment/StatefulSet/DaemonSet/Job/CronJob/Pod
-
-_containers contains c if { c := input.spec.template.spec.containers[_] }
-_containers contains c if { c := input.spec.template.spec.initContainers[_] }
-_containers contains c if { c := input.spec.containers[_] }
-_containers contains c if { c := input.spec.initContainers[_] }
-_containers contains c if { c := input.spec.jobTemplate.spec.template.spec.containers[_] }
-
-# ---- CPU: must not be an integer ----
-# YAML `cpu: 1` (unquoted) parses as JSON integer; k8s stores as string "1".
-
-deny contains msg if {
-    c := _containers[_]
-    cpu := c.resources.limits.cpu
-    is_number(cpu)
-    msg := sprintf(
-        "%s container %q: cpu limit %v is an unquoted integer — use \"%v\" (string) to prevent ArgoCD OutOfSync",
-        [input.kind, c.name, cpu, cpu],
-    )
-}
-
-deny contains msg if {
-    c := _containers[_]
-    cpu := c.resources.requests.cpu
-    is_number(cpu)
-    msg := sprintf(
-        "%s container %q: cpu request %v is an unquoted integer — use \"%v\" (string) to prevent ArgoCD OutOfSync",
-        [input.kind, c.name, cpu, cpu],
-    )
-}
-
-deny contains msg if {
-    input.kind == "Cluster"
-    cpu := input.spec.resources.limits.cpu
-    is_number(cpu)
-    msg := sprintf(
-        "Cluster %s/%s: cpu limit %v is an unquoted integer — use \"%v\" (string) to prevent ArgoCD OutOfSync",
-        [input.metadata.namespace, input.metadata.name, cpu, cpu],
-    )
-}
-
-deny contains msg if {
-    input.kind == "Cluster"
-    cpu := input.spec.resources.requests.cpu
-    is_number(cpu)
-    msg := sprintf(
-        "Cluster %s/%s: cpu request %v is an unquoted integer — use \"%v\" (string) to prevent ArgoCD OutOfSync",
-        [input.metadata.namespace, input.metadata.name, cpu, cpu],
-    )
-}
-
-# ---- CPU: milliCPU divisible by 1000 normalizes to a whole number ----
-# k8s converts 1000m → "1", 2000m → "2". Use the canonical whole-number form.
-
-_milli_whole(cpu) := n if {
-    is_string(cpu)
-    endswith(cpu, "m")
-    val := to_number(substring(cpu, 0, count(cpu) - 1))
-    val % 1000 == 0
-    val > 0
-    n := val / 1000
-}
-
-deny contains msg if {
-    c := _containers[_]
-    n := _milli_whole(c.resources.limits.cpu)
-    msg := sprintf(
-        "%s container %q: cpu limit %q normalizes to \"%v\" — use canonical form to prevent ArgoCD OutOfSync",
-        [input.kind, c.name, c.resources.limits.cpu, n],
-    )
-}
-
-deny contains msg if {
-    c := _containers[_]
-    n := _milli_whole(c.resources.requests.cpu)
-    msg := sprintf(
-        "%s container %q: cpu request %q normalizes to \"%v\" — use canonical form to prevent ArgoCD OutOfSync",
-        [input.kind, c.name, c.resources.requests.cpu, n],
-    )
-}
-
-deny contains msg if {
-    input.kind == "Cluster"
-    n := _milli_whole(input.spec.resources.limits.cpu)
-    msg := sprintf(
-        "Cluster %s/%s: cpu limit %q normalizes to \"%v\" — use canonical form to prevent ArgoCD OutOfSync",
-        [input.metadata.namespace, input.metadata.name, input.spec.resources.limits.cpu, n],
-    )
-}
-
-deny contains msg if {
-    input.kind == "Cluster"
-    n := _milli_whole(input.spec.resources.requests.cpu)
-    msg := sprintf(
-        "Cluster %s/%s: cpu request %q normalizes to \"%v\" — use canonical form to prevent ArgoCD OutOfSync",
-        [input.metadata.namespace, input.metadata.name, input.spec.resources.requests.cpu, n],
-    )
-}
-
-# ---- Memory: Mi values divisible by 1024 normalize to Gi ----
-# k8s converts 1024Mi → 1Gi, 2048Mi → 2Gi, etc.
-
-_mi_canonical(mem) := canonical if {
-    endswith(mem, "Mi")
-    val := to_number(substring(mem, 0, count(mem) - 2))
-    val % 1024 == 0
-    val > 0
-    canonical := sprintf("%vGi", [val / 1024])
-}
-
-deny contains msg if {
-    c := _containers[_]
-    canonical := _mi_canonical(c.resources.limits.memory)
-    msg := sprintf(
-        "%s container %q: memory limit %q normalizes to %q — use canonical form to prevent ArgoCD OutOfSync",
-        [input.kind, c.name, c.resources.limits.memory, canonical],
-    )
-}
-
-deny contains msg if {
-    c := _containers[_]
-    canonical := _mi_canonical(c.resources.requests.memory)
-    msg := sprintf(
-        "%s container %q: memory request %q normalizes to %q — use canonical form to prevent ArgoCD OutOfSync",
-        [input.kind, c.name, c.resources.requests.memory, canonical],
-    )
-}
-
-deny contains msg if {
-    input.kind == "Cluster"
-    canonical := _mi_canonical(input.spec.resources.limits.memory)
-    msg := sprintf(
-        "Cluster %s/%s: memory limit %q normalizes to %q — use canonical form to prevent ArgoCD OutOfSync",
-        [input.metadata.namespace, input.metadata.name, input.spec.resources.limits.memory, canonical],
-    )
-}
-
-deny contains msg if {
-    input.kind == "Cluster"
-    canonical := _mi_canonical(input.spec.resources.requests.memory)
-    msg := sprintf(
-        "Cluster %s/%s: memory request %q normalizes to %q — use canonical form to prevent ArgoCD OutOfSync",
-        [input.metadata.namespace, input.metadata.name, input.spec.resources.requests.memory, canonical],
-    )
-}
-
-# ---- Service: clusterIP must not be null ----
-# k8s assigns a real IP on creation; clusterIP is immutable afterward.
-# Setting null in git means desired=null vs live=10.x.x.x → permanent OutOfSync.
-# Remove the field and let k8s own it.
-
-deny contains msg if {
-    input.kind == "Service"
-    input.spec.clusterIP == null
-    msg := sprintf(
-        "Service %s/%s has 'clusterIP: null' — remove this field; Kubernetes assigns the IP on creation and it causes ArgoCD OutOfSync",
-        [input.metadata.namespace, input.metadata.name],
-    )
-}
Author	SHA1	Message	Date
unkinben	7d2e0dfa0f	fix(kanidm): prevent ArgoCD from overwriting repl-cert ConfigMap data ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details Remove the data keys from kanidm-repl-certs in git so ArgoCD never takes SSA ownership of them. Add ignoreDifferences for /data on that ConfigMap in the ApplicationSet template so ArgoCD doesn't flag sidecar-patched cert values as out-of-sync.	2026-05-24 19:42:32 +10:00
unkinben	11286a1f89	feat(kanidm): automate replication cert exchange via native sidecar Add a native sidecar (bitnami/kubectl, restartPolicy: Always) that runs kanidmd renew-replication-certificate on each pod and patches the result into the kanidm-repl-certs ConfigMap (certs are public keys, not secrets). The config-init init container reads peer certs from the ConfigMap at startup, building the replication stanza automatically — no manual cert exchange required after first deploy. Add RBAC (Role + RoleBinding) granting the kanidm service account pods/exec and configmap patch permissions scoped to the kanidm namespace.	2026-05-24 19:42:32 +10:00
unkinben	e91fe554eb	feat(kanidm): 3 replicas, PDB maxUnavailable=1, host anti-affinity - Increase replicas from 2 to 3 - Add kanidm-2 headless DNS SAN to TLS certificate - Add PodDisruptionBudget (maxUnavailable: 1) to maintain quorum during node drains - Add requiredDuringSchedulingIgnoredDuringExecution pod anti-affinity on kubernetes.io/hostname to spread replicas across distinct hosts - Update replication peers comment to include kanidm-2 cert exchange step	2026-05-24 19:42:32 +10:00
unkinben	ee76ec199b	feat(kanidm): deploy Kanidm 1.10.3 with 2-replica replication ## Summary - Deploys Kanidm 1.10.3 (ghcr.io/kanidm/server:1.10.3) as a 2-replica StatefulSet with built-in replication enabled - Domain: auth.unkin.net (primary WebAuthn origin); au.auth.unkin.net is an additional hostname for this au-syd1 instance - TLS: cert-manager Certificate (vault-issuer) covering auth.unkin.net, au.auth.unkin.net, kanidm.k8s.syd1.au.unkin.net, and internal headless pod DNS names — Kanidm terminates TLS itself (passthrough) - Gateway: TLS passthrough on port 443 via TLSRoute; HTTP on port 80 redirects to HTTPS; external-dns creates kanidm.k8s.syd1.au.unkin.net (not used in server.toml; canonical origin is auth.unkin.net only) - Replication: init container generates per-pod server.toml with the correct repl:// origin (kanidm-{N}.kanidm-headless.kanidm.svc); populate kanidm-repl-peers ConfigMap post-deployment after running `kanidmd show-replication-certificate` on each pod - Storage: 10Gi cephrbd-fast-delete PVC per pod via volumeClaimTemplates - Security: runAsUser/runAsGroup 1000, runAsNonRoot, no privilege escalation, allowPrivilegeEscalation=false - ArgoCD: platform ApplicationSet and Project updated for kanidm namespace ## Requires - PR benvin/kanidm-artifactapi (add ^kanidm/ to ghcr immutable patterns) to be merged first so artifactapi can cache ghcr.io/kanidm/server ## Post-deployment steps 1. Wait for both pods to reach Running state 2. Exchange replication certificates between pods: kubectl exec -n kanidm kanidm-0 -- kanidmd show-replication-certificate kubectl exec -n kanidm kanidm-1 -- kanidmd show-replication-certificate 3. Edit kanidm-repl-peers ConfigMap with both nodes' certs (see template in configmap.yaml comments) 4. kubectl rollout restart statefulset/kanidm -n kanidm ## Test plan - [x] Sandbox tested in sandbox-kanidm: all 11 resources server dry-run OK - [ ] After merge: ArgoCD syncs kanidm namespace - [ ] Verify auth.unkin.net and au.auth.unkin.net reachable via Gateway - [ ] Verify kanidm.k8s.syd1.au.unkin.net DNS record created by external-dns - [ ] Complete replication cert exchange and verify replication active	2026-05-24 19:42:32 +10:00