Merge branch 'main' into fix-kanidm-replication-config

Reviewed-on: #179

apps/base/artifactapi/httproute.yaml

@@ -8,7 +8,9 @@ spec:
   hostnames:
     - artifactapi.k8s.syd1.au.unkin.net
   parentRefs:
-    - name: artifactapi
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: artifactapi
       sectionName: http
   rules:
     - filters:
@@ -30,12 +32,17 @@ spec:
   hostnames:
     - artifactapi.k8s.syd1.au.unkin.net
   parentRefs:
-    - name: artifactapi
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: artifactapi
       sectionName: https
   rules:
     - backendRefs:
-        - name: artifactapi-api
+        - group: ""
+          kind: Service
+          name: artifactapi-api
           port: 80
+          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/artifactapi/resources/conf.d/remote-docker.yaml

@@ -6,9 +6,10 @@ remotes:
     immutable_patterns:
       - "^cloudnative-pg/cloudnative-pg"
       - "^emberstack/helm-charts"
-      - "^kanidm/"
+      - "^open-webui/open-webui"
       - "^openvoxproject/"
       - "^stakater/reloader"
+      - "^stalwartlabs/stalwart"
       - "^voxpupuli/puppetboard"
       - "^woodpecker-ci/helm"
     cache:
@@ -34,8 +35,12 @@ remotes:
       - "^hashicorp/consul"
       - "^hashicorp/vault"
       - "^jfrog/"
+      - "^kanidm/"
       - "^rancher/"
+      - "^rspamd/rspamd"
+      - "^tozd/postfix"
       - "^traefik/"
+      - "^valkey/valkey"
       - "^ubi9/ubi-minimal"
       - "^victoriametrics/"
       - "^woodpeckerci/"

apps/base/artifactapi/resources/conf.d/remote-generic.yaml

@@ -5,6 +5,7 @@ remotes:
     description: "GitHub releases and files"
     mutable_patterns:
       - ".*/archive/refs/heads/.*.tar.gz$"
+      - "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$"
     immutable_patterns:
       - ".*/archive/refs/tags/.*.tar.gz$"
       - "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
@@ -35,6 +36,7 @@ remotes:
       - "neovim/neovim/.*/nvim-linux-x86_64.tar.gz$"
       - "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
       - "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
+      - "open-policy-agent/conftest/.*/conftest_.*_Linux_x86_64.tar.gz$"
       - "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
       - "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
       - "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"

apps/base/cattle-system/httproute.yaml

@@ -8,7 +8,9 @@ spec:
   hostnames:
     - rancher.k8s.syd1.au.unkin.net
   parentRefs:
-    - name: rancher
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: rancher
       sectionName: http
   rules:
     - filters:
@@ -30,12 +32,17 @@ spec:
   hostnames:
     - rancher.k8s.syd1.au.unkin.net
   parentRefs:
-    - name: rancher
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: rancher
       sectionName: https
   rules:
     - backendRefs:
-        - name: rancher
+        - group: ""
+          kind: Service
+          name: rancher
           port: 80
+          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/consul/httproute.yaml

@@ -11,7 +11,9 @@ spec:
   hostnames:
     - consul.k8s.syd1.au.unkin.net
   parentRefs:
-    - name: consul
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: consul
       sectionName: http
   rules:
     - filters:
@@ -36,12 +38,17 @@ spec:
   hostnames:
     - consul.k8s.syd1.au.unkin.net
   parentRefs:
-    - name: consul
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: consul
       sectionName: https
   rules:
     - backendRefs:
-        - name: consul-ui
+        - group: ""
+          kind: Service
+          name: consul-ui
           port: 80
+          weight: 1
       matches:
         - path:
             type: PathPrefix
@@ -59,12 +66,17 @@ spec:
   hostnames:
     - consul.service.consul
   parentRefs:
-    - name: consul
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: consul
       sectionName: consul-svc
   rules:
     - backendRefs:
-        - name: consul-ui
+        - group: ""
+          kind: Service
+          name: consul-ui
           port: 80
+          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/kanidm/README.md

@@ -0,0 +1,51 @@
+# kanidm
+
+Three-replica kanidm identity server with Vault-managed replication certificates.
+
+## Architecture
+
+- Per-pod `server-N.toml` in `resources/` — each has its own replication origin hardcoded
+- `config-init` busybox init container copies the right config and injects peer certs from the
+  vault-synced `kanidm-repl-certs` Secret at pod startup
+- `reloader.stakater.com/auto: "true"` triggers a rolling restart when the ConfigMap or Secret changes
+- Vault path: `kv/kubernetes/namespace/kanidm/default/repl-certs`
+  - Keys: `kanidm-0`, `kanidm-1`, `kanidm-2` — each holds that pod's replication certificate
+
+## Initial setup
+
+After the first pod starts, generate the admin credentials:
+
+```bash
+kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account -c /config/server.toml admin
+kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account -c /config/server.toml idm_admin
+```
+
+## Replication certificate rotation
+
+When certs need to be renewed, update vault and reloader will roll the StatefulSet:
+
+```bash
+# Get new cert from a pod
+kubectl exec -it -n kanidm kanidm-N -- /sbin/kanidmd renew-replication-certificate -c /config/server.toml
+
+# Write updated cert to vault (reloader triggers restart automatically)
+vault kv patch kv/kubernetes/namespace/kanidm/default/repl-certs "kanidm-N=<cert>"
+```
+
+## Resolving domain UUID mismatch
+
+If pods initialized independently (each with a different domain UUID), replication will fail with
+`Consumer Domain UUID does not match`. Fix by resetting kanidm-1 and kanidm-2 to sync from
+kanidm-0 (the authoritative node):
+
+```bash
+# Scale down to avoid split-brain during reset
+kubectl scale statefulset -n kanidm kanidm --replicas=1
+
+# Delete the stale PVCs for the replica pods
+kubectl delete pvc -n kanidm data-kanidm-1 data-kanidm-2
+
+# Scale back up — replicas start with empty DBs and automatic_refresh=true
+# will trigger a full sync from kanidm-0 once TLS peer certs are verified
+kubectl scale statefulset -n kanidm kanidm --replicas=3
+```

apps/base/kanidm/certificate.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: kanidm-tls
+  namespace: kanidm
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
+spec:
+  secretName: kanidm-tls
+  issuerRef:
+    kind: ClusterIssuer
+    name: vault-issuer
+  commonName: auth.unkin.net
+  dnsNames:
+    - auth.unkin.net
+    - au.auth.unkin.net
+    - kanidm.k8s.syd1.au.unkin.net
+    - kanidm.kanidm.svc.cluster.local
+    - kanidm-0.kanidm-headless.kanidm.svc.cluster.local
+    - kanidm-1.kanidm-headless.kanidm.svc.cluster.local
+    - kanidm-2.kanidm-headless.kanidm.svc.cluster.local
+  privateKey:
+    algorithm: RSA
+    size: 4096

apps/base/kanidm/gateway.yaml

@@ -0,0 +1,30 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: kanidm
+  namespace: kanidm
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
+    traefik.io/instance: internal
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: kanidm.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https-passthrough
+      port: 443
+      protocol: TLS
+      tls:
+        mode: Passthrough
+      allowedRoutes:
+        namespaces:
+          from: Same

apps/base/kanidm/httproute.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: kanidm-http-redirect
+  namespace: kanidm
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
+spec:
+  hostnames:
+    - kanidm.k8s.syd1.au.unkin.net
+    - auth.unkin.net
+    - au.auth.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: kanidm
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/base/kanidm/kustomization.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - serviceaccount.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+  - certificate.yaml
+  - service.yaml
+  - statefulset.yaml
+  - poddisruptionbudget.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - tlsroute.yaml
+
+configMapGenerator:
+  - name: kanidm-config
+    namespace: kanidm
+    options:
+      disableNameSuffixHash: true
+      labels:
+        app.kubernetes.io/name: kanidm
+        app.kubernetes.io/instance: kanidm
+    files:
+      - server-0.toml=resources/server-0.toml
+      - server-1.toml=resources/server-1.toml
+      - server-2.toml=resources/server-2.toml

apps/base/kanidm/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: mailgateway
+  name: kanidm

apps/base/kanidm/poddisruptionbudget.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: kanidm
+  namespace: kanidm
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kanidm
+      app.kubernetes.io/instance: kanidm

apps/base/kanidm/rbac.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: kanidm-repl
+  namespace: kanidm
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["pods/exec"]
+    verbs: ["create"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["kanidm-repl-certs"]
+    verbs: ["get", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: kanidm-repl
+  namespace: kanidm
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
+subjects:
+  - kind: ServiceAccount
+    name: kanidm
+    namespace: kanidm
+roleRef:
+  kind: Role
+  name: kanidm-repl
+  apiGroup: rbac.authorization.k8s.io

apps/base/kanidm/resources/server-0.toml

@@ -0,0 +1,19 @@
+version = "2"
+
+domain = "auth.unkin.net"
+origin = "https://auth.unkin.net"
+bindaddress = "[::]:8443"
+db_path = "/data/kanidm.db"
+db_arc_size = 2048
+tls_chain = "/data/tls/tls.crt"
+tls_key = "/data/tls/tls.key"
+log_level = "info"
+
+[online_backup]
+path = "/data/backups/"
+schedule = "0 22 * * *"
+versions = 7
+
+[replication]
+origin = "repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"
+bindaddress = "[::]:8444"

apps/base/kanidm/resources/server-1.toml

@@ -0,0 +1,19 @@
+version = "2"
+
+domain = "auth.unkin.net"
+origin = "https://auth.unkin.net"
+bindaddress = "[::]:8443"
+db_path = "/data/kanidm.db"
+db_arc_size = 2048
+tls_chain = "/data/tls/tls.crt"
+tls_key = "/data/tls/tls.key"
+log_level = "info"
+
+[online_backup]
+path = "/data/backups/"
+schedule = "0 22 * * *"
+versions = 7
+
+[replication]
+origin = "repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"
+bindaddress = "[::]:8444"

apps/base/kanidm/resources/server-2.toml

@@ -0,0 +1,19 @@
+version = "2"
+
+domain = "auth.unkin.net"
+origin = "https://auth.unkin.net"
+bindaddress = "[::]:8443"
+db_path = "/data/kanidm.db"
+db_arc_size = 2048
+tls_chain = "/data/tls/tls.crt"
+tls_key = "/data/tls/tls.key"
+log_level = "info"
+
+[online_backup]
+path = "/data/backups/"
+schedule = "0 22 * * *"
+versions = 7
+
+[replication]
+origin = "repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"
+bindaddress = "[::]:8444"

apps/base/kanidm/service.yaml

@@ -0,0 +1,43 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: kanidm
+  namespace: kanidm
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
+spec:
+  type: ClusterIP
+  ports:
+    - name: https
+      port: 8443
+      targetPort: https
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: kanidm-headless
+  namespace: kanidm
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
+spec:
+  type: ClusterIP
+  clusterIP: None
+  ports:
+    - name: https
+      port: 8443
+      targetPort: https
+      protocol: TCP
+    - name: replication
+      port: 8444
+      targetPort: replication
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm

apps/base/kanidm/serviceaccount.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kanidm
+  namespace: kanidm
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm

apps/base/kanidm/statefulset.yaml

@@ -0,0 +1,133 @@
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: kanidm
+  namespace: kanidm
+  annotations:
+    reloader.stakater.com/auto: "true"
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
+spec:
+  serviceName: kanidm-headless
+  replicas: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kanidm
+      app.kubernetes.io/instance: kanidm
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: kanidm
+        app.kubernetes.io/instance: kanidm
+    spec:
+      serviceAccountName: kanidm
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: kanidm
+                  app.kubernetes.io/instance: kanidm
+              topologyKey: kubernetes.io/hostname
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        fsGroup: 1000
+      initContainers:
+        - name: config-init
+          image: busybox:1.36
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              set -e
+              cp "/config-template/server-${POD_NAME##*-}.toml" /config/server.toml
+              for peer in kanidm-0 kanidm-1 kanidm-2; do
+                [ "${peer}" = "${POD_NAME}" ] && continue
+                cert_file="/repl-certs/${peer}"
+                [ -s "${cert_file}" ] || continue
+                fqdn="${peer}.kanidm-headless.kanidm.svc.cluster.local"
+                printf '\n[replication."repl://%s:8444"]\ntype = "mutual-pull"\npartner_cert = "%s"\n' \
+                  "${fqdn}" "$(cat ${cert_file})" >> /config/server.toml
+              done
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          volumeMounts:
+            - name: config-template
+              mountPath: /config-template
+              readOnly: true
+            - name: config
+              mountPath: /config
+            - name: repl-certs
+              mountPath: /repl-certs
+              readOnly: true
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+      containers:
+        - name: kanidm
+          image: kanidm/server:1.10.3
+          command: ["/sbin/kanidmd"]
+          args: ["server", "-c", "/config/server.toml"]
+          ports:
+            - name: https
+              containerPort: 8443
+              protocol: TCP
+            - name: replication
+              containerPort: 8444
+              protocol: TCP
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: config
+              mountPath: /config
+              readOnly: true
+            - name: tls
+              mountPath: /data/tls
+              readOnly: true
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
+          resources:
+            requests:
+              memory: 256Mi
+              cpu: 100m
+            limits:
+              memory: 1Gi
+              cpu: 500m
+          readinessProbe:
+            tcpSocket:
+              port: 8443
+            initialDelaySeconds: 15
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              port: 8443
+            initialDelaySeconds: 30
+            periodSeconds: 30
+      volumes:
+        - name: config-template
+          configMap:
+            name: kanidm-config
+        - name: config
+          emptyDir: {}
+        - name: repl-certs
+          secret:
+            secretName: kanidm-repl-certs
+        - name: tls
+          secret:
+            secretName: kanidm-tls
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: [ReadWriteOnce]
+        storageClassName: cephrbd-fast-delete
+        resources:
+          requests:
+            storage: 10Gi

apps/base/kanidm/tlsroute.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: TLSRoute
+metadata:
+  name: kanidm
+  namespace: kanidm
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
+spec:
+  hostnames:
+    - kanidm.k8s.syd1.au.unkin.net
+    - auth.unkin.net
+    - au.auth.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: kanidm
+      sectionName: https-passthrough
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: kanidm
+          port: 8443
+          weight: 1

apps/base/kanidm/vaultauth.yaml

@@ -3,10 +3,10 @@ apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultAuth
 metadata:
   name: default
-  namespace: mailgateway
+  namespace: kanidm
 spec:
   allowedNamespaces:
-    - mailgateway
+    - kanidm
   kubernetes:
     audiences:
       - vault

apps/base/kanidm/vaultstaticsecret.yaml

@@ -2,16 +2,19 @@
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:
-  name: dkim-keys
+  name: repl-certs
-  namespace: mailgateway
+  namespace: kanidm
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
 spec:
+  vaultAuthRef: default
+  mount: kv
+  type: kv-v2
+  path: kubernetes/namespace/kanidm/default/repl-certs
+  refreshAfter: 5m
   destination:
+    name: kanidm-repl-certs
     create: true
-    name: dkim-keys
     overwrite: true
   hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/mailgateway/default/dkim-keys
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/litellm/cnpg_cluster.yaml

@@ -76,8 +76,8 @@ spec:
     updateInterval: 30
   resources:
     limits:
-      cpu: 1
+      cpu: "1"
-      memory: 1024Mi
+      memory: 1Gi
     requests:
       cpu: 250m
       memory: 512Mi

apps/base/litellm/httproute.yaml

@@ -8,7 +8,9 @@ spec:
   hostnames:
     - litellm.k8s.syd1.au.unkin.net
   parentRefs:
-    - name: litellm
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: litellm
       sectionName: http
   rules:
     - filters:
@@ -30,12 +32,17 @@ spec:
   hostnames:
     - litellm.k8s.syd1.au.unkin.net
   parentRefs:
-    - name: litellm
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: litellm
       sectionName: https
   rules:
     - backendRefs:
-        - name: litellm
+        - group: ""
+          kind: Service
+          name: litellm
           port: 4000
+          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/mailgateway/certificate.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: postfix-smtp-tls
-  namespace: mailgateway
-spec:
-  secretName: postfix-smtp-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: mail.main.unkin.net
-  dnsNames:
-    - mail.main.unkin.net
-    - smtp-in.main.unkin.net
-  privateKey:
-    size: 4096
-    algorithm: RSA

apps/base/mailgateway/gateway.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: rspamd.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: rspamd.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: rspamd
-  namespace: mailgateway
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: rspamd.k8s.syd1.au.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: rspamd.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: rspamd-tls
-        mode: Terminate

apps/base/mailgateway/httproute.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: rspamd
-  namespace: mailgateway
-spec:
-  parentRefs:
-    - name: rspamd
-      namespace: mailgateway
-  hostnames:
-    - rspamd.k8s.syd1.au.unkin.net
-  rules:
-    - backendRefs:
-        - name: rspamd
-          port: 11334

apps/base/mailgateway/kustomization.yaml

@@ -1,36 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - certificate.yaml
-  - gateway.yaml
-  - httproute.yaml
-  - namespace.yaml
-  - postfix-deployment.yaml
-  - postfix-hpa.yaml
-  - rspamd-deployment.yaml
-  - rspamd-hpa.yaml
-  - services.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-
-configMapGenerator:
-  - name: postfix-config
-    files:
-      - main.cf=resources/postfix/main.cf
-      - master.cf=resources/postfix/master.cf
-    options:
-      disableNameSuffixHash: true
-  - name: postfix-maps
-    files:
-      - transport=resources/postfix/transport
-    options:
-      disableNameSuffixHash: true
-  - name: rspamd-config
-    files:
-      - worker-proxy.inc=resources/rspamd/local.d/worker-proxy.inc
-      - dkim_signing.conf=resources/rspamd/local.d/dkim_signing.conf
-      - milter_headers.conf=resources/rspamd/local.d/milter_headers.conf
-    options:
-      disableNameSuffixHash: true

apps/base/mailgateway/postfix-deployment.yaml

@@ -1,105 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: postfix
-  namespace: mailgateway
-spec:
-  selector:
-    matchLabels:
-      app: postfix
-  template:
-    metadata:
-      annotations:
-        reloader.stakater.com/auto: "true"
-      labels:
-        app: postfix
-    spec:
-      initContainers:
-        - name: postmap
-          image: tozd/postfix:alpine-322
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              for f in /etc/postfix/maps/*; do
-                base=$(basename "$f")
-                cp "$f" /tmp/"$base"
-                postmap hash:/tmp/"$base"
-                cp /tmp/"${base}.db" /etc/postfix/db/
-              done
-          volumeMounts:
-            - name: postfix-maps
-              mountPath: /etc/postfix/maps
-              readOnly: true
-            - name: postfix-db
-              mountPath: /etc/postfix/db
-      containers:
-        - name: postfix
-          image: tozd/postfix:alpine-322
-          ports:
-            - containerPort: 25
-              name: smtp
-              protocol: TCP
-            - containerPort: 587
-              name: submission
-              protocol: TCP
-          env:
-            # Keep these in sync with main.cf so the tozd startup postconf calls are no-ops
-            - name: MAILNAME
-              value: "mail.main.unkin.net"
-            - name: MY_NETWORKS
-              value: "127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16"
-            - name: MY_DESTINATION
-              value: "localhost.localdomain, localhost"
-            - name: LOG_TO_STDOUT
-              value: "1"
-          livenessProbe:
-            tcpSocket:
-              port: 25
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            tcpSocket:
-              port: 25
-            initialDelaySeconds: 15
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 512Mi
-          volumeMounts:
-            - name: postfix-config
-              mountPath: /etc/postfix/main.cf
-              subPath: main.cf
-            - name: postfix-config
-              mountPath: /etc/postfix/master.cf
-              subPath: master.cf
-            - name: postfix-db
-              mountPath: /etc/postfix/transport.db
-              subPath: transport.db
-            - name: postfix-tls
-              mountPath: /etc/postfix/tls
-              readOnly: true
-            - name: spool
-              mountPath: /var/spool/postfix
-      volumes:
-        - name: postfix-config
-          configMap:
-            name: postfix-config
-        - name: postfix-maps
-          configMap:
-            name: postfix-maps
-        - name: postfix-db
-          emptyDir: {}
-        - name: postfix-tls
-          secret:
-            secretName: postfix-smtp-tls
-        - name: spool
-          emptyDir: {}

apps/base/mailgateway/postfix-hpa.yaml

@@ -1,38 +0,0 @@
----
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: postfix-hpa
-  namespace: mailgateway
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: postfix
-  minReplicas: 2
-  maxReplicas: 6
-  metrics:
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          type: Utilization
-          averageUtilization: 70
-  behavior:
-    scaleUp:
-      stabilizationWindowSeconds: 0
-      selectPolicy: Max
-      policies:
-        - type: Percent
-          value: 100
-          periodSeconds: 60
-        - type: Pods
-          value: 4
-          periodSeconds: 30
-    scaleDown:
-      stabilizationWindowSeconds: 300
-      selectPolicy: Min
-      policies:
-        - type: Percent
-          value: 30
-          periodSeconds: 60

apps/base/mailgateway/resources/postfix/main.cf

@@ -1,46 +0,0 @@
-# Basic identity — kept in sync with MAILNAME/MY_NETWORKS/MY_DESTINATION env vars
-# so the tozd startup script's postconf calls are no-ops
-myhostname = mail.main.unkin.net
-myorigin = main.unkin.net
-mydestination = localhost.localdomain, localhost
-mynetworks = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
-inet_protocols = ipv4
-inet_interfaces = all
-
-# No local delivery — we're a relay-only gateway
-local_transport = error:no local delivery
-alias_maps =
-alias_database =
-
-# Relay inbound mail for these domains to Stalwart
-relay_domains = main.unkin.net unkin.net
-transport_maps = hash:/etc/postfix/transport
-
-# rspamd milter (same namespace — short DNS name resolves)
-smtpd_milters = inet:rspamd:11332
-non_smtpd_milters = inet:rspamd:11332
-milter_default_action = accept
-milter_protocol = 6
-milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
-
-# Inbound TLS (cert from cert-manager Certificate resource)
-smtpd_use_tls = yes
-smtpd_tls_security_level = may
-smtpd_tls_cert_file = /etc/postfix/tls/tls.crt
-smtpd_tls_key_file = /etc/postfix/tls/tls.key
-smtpd_tls_loglevel = 1
-
-# Outbound TLS (opportunistic)
-smtp_tls_security_level = may
-smtp_tls_loglevel = 1
-
-# Message size limit (50 MiB)
-message_size_limit = 52428800
-mailbox_size_limit = 0
-
-# Queue retention
-maximal_queue_lifetime = 5d
-bounce_queue_lifetime = 1d
-
-# Log to stdout for k8s log collection
-maillog_file = /dev/stdout

apps/base/mailgateway/resources/postfix/master.cf

@@ -1,42 +0,0 @@
-# ==========================================================================
-# service type  private unpriv  chroot  wakeup  maxproc command + args
-#               (yes)   (yes)   (yes)   (never) (100)
-# ==========================================================================
-
-# SMTP inbound (port 25) — runs rspamd milter, relays to Stalwart via transport_maps
-smtp      inet  n       -       n       -       -       smtpd
-
-# Submission (port 587) — TLS required, relay from trusted mynetworks only
-submission inet n       -       n       -       -       smtpd
-  -o syslog_name=postfix/submission
-  -o smtpd_tls_security_level=encrypt
-  -o smtpd_sasl_auth_enable=no
-  -o smtpd_reject_unlisted_recipient=no
-  -o smtpd_relay_restrictions=permit_mynetworks,reject
-  -o milter_macro_daemon_name=ORIGINATING
-
-# Internal postfix processes
-pickup    unix  n       -       n       60      1       pickup
-cleanup   unix  n       -       n       -       0       cleanup
-qmgr      unix  n       -       n       300     1       qmgr
-tlsmgr    unix  -       -       n       1000?   1       tlsmgr
-rewrite   unix  -       -       n       -       -       trivial-rewrite
-bounce    unix  -       -       n       -       0       bounce
-defer     unix  -       -       n       -       0       bounce
-trace     unix  -       -       n       -       0       bounce
-verify    unix  -       -       n       -       1       verify
-flush     unix  n       -       n       1000?   0       flush
-proxymap  unix  -       -       n       -       -       proxymap
-proxywrite unix -       -       n       -       1       proxymap
-smtp      unix  -       -       n       -       -       smtp
-relay     unix  -       -       n       -       -       smtp
-showq     unix  n       -       n       -       -       showq
-error     unix  -       -       n       -       -       error
-retry     unix  -       -       n       -       -       error
-discard   unix  -       -       n       -       -       discard
-local     unix  -       n       n       -       -       local
-virtual   unix  -       n       n       -       -       virtual
-lmtp      unix  -       -       n       -       -       lmtp
-anvil     unix  -       -       n       -       1       anvil
-scache    unix  -       -       n       -       1       scache
-postlog   unix-dgram n  -       n       -       1       postlogd

apps/base/mailgateway/resources/postfix/transport

@@ -1,2 +0,0 @@
-.unkin.net        smtp:[stalwart.stalwart.svc.cluster.local]:25
-unkin.net         smtp:[stalwart.stalwart.svc.cluster.local]:25

apps/base/mailgateway/resources/rspamd/local.d/dkim_signing.conf

@@ -1,13 +0,0 @@
-enabled = true;
-selector = "mail";
-
-domain {
-    main.unkin.net {
-        privkey = "/etc/rspamd/dkim/private_key";
-        selector = "mail";
-    }
-    unkin.net {
-        privkey = "/etc/rspamd/dkim/private_key";
-        selector = "mail";
-    }
-}

apps/base/mailgateway/resources/rspamd/local.d/milter_headers.conf

@@ -1,2 +0,0 @@
-extended_spam_headers = true;
-use = ["x-spam-status", "x-spam-score", "authentication-results"];

apps/base/mailgateway/resources/rspamd/local.d/worker-proxy.inc

@@ -1,7 +0,0 @@
-milter = yes;
-bind_socket = "*:11332";
-
-upstream "local" {
-    default = yes;
-    self_scan = yes;
-}

apps/base/mailgateway/rspamd-deployment.yaml

@@ -1,75 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: rspamd
-  namespace: mailgateway
-spec:
-  selector:
-    matchLabels:
-      app: rspamd
-  template:
-    metadata:
-      annotations:
-        reloader.stakater.com/auto: "true"
-      labels:
-        app: rspamd
-    spec:
-      securityContext:
-        runAsUser: 11333
-        runAsGroup: 11333
-        fsGroup: 11333
-      containers:
-        - name: rspamd
-          image: rspamd/rspamd:4.0.1
-          ports:
-            - containerPort: 11332
-              name: milter
-              protocol: TCP
-            - containerPort: 11333
-              name: worker
-              protocol: TCP
-            - containerPort: 11334
-              name: controller
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 11334
-            initialDelaySeconds: 15
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 11334
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 512Mi
-          volumeMounts:
-            - name: rspamd-config
-              mountPath: /etc/rspamd/local.d
-              readOnly: true
-            - name: dkim-keys
-              mountPath: /etc/rspamd/dkim
-              readOnly: true
-            - name: rspamd-data
-              mountPath: /var/lib/rspamd
-      volumes:
-        - name: rspamd-config
-          configMap:
-            name: rspamd-config
-        - name: dkim-keys
-          secret:
-            secretName: dkim-keys
-        - name: rspamd-data
-          emptyDir: {}

apps/base/mailgateway/rspamd-hpa.yaml

@@ -1,38 +0,0 @@
----
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: rspamd-hpa
-  namespace: mailgateway
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: rspamd
-  minReplicas: 2
-  maxReplicas: 6
-  metrics:
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          type: Utilization
-          averageUtilization: 70
-  behavior:
-    scaleUp:
-      stabilizationWindowSeconds: 0
-      selectPolicy: Max
-      policies:
-        - type: Percent
-          value: 100
-          periodSeconds: 30
-        - type: Pods
-          value: 4
-          periodSeconds: 30
-    scaleDown:
-      stabilizationWindowSeconds: 300
-      selectPolicy: Min
-      policies:
-        - type: Percent
-          value: 30
-          periodSeconds: 60

apps/base/mailgateway/services.yaml

@@ -1,64 +0,0 @@
----
-# Internal service for rspamd - used by postfix pods in the same namespace
-apiVersion: v1
-kind: Service
-metadata:
-  name: rspamd
-  namespace: mailgateway
-spec:
-  selector:
-    app: rspamd
-  ports:
-    - name: milter
-      port: 11332
-      targetPort: 11332
-      protocol: TCP
-    - name: worker
-      port: 11333
-      targetPort: 11333
-      protocol: TCP
-    - name: controller
-      port: 11334
-      targetPort: 11334
-      protocol: TCP
----
-# Internal ClusterIP for postfix - used by stalwart for outbound relay
-apiVersion: v1
-kind: Service
-metadata:
-  name: postfix
-  namespace: mailgateway
-spec:
-  selector:
-    app: postfix
-  ports:
-    - name: smtp
-      port: 25
-      targetPort: 25
-      protocol: TCP
-    - name: submission
-      port: 587
-      targetPort: 587
-      protocol: TCP
----
-# External LoadBalancer for inbound MX (internet → postfix)
-apiVersion: v1
-kind: Service
-metadata:
-  name: postfix-external
-  namespace: mailgateway
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: smtp-in.main.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.199.1
-    purelb.io/service-group: dmz
-    purelb.io/addresses: 198.18.199.1
-spec:
-  type: LoadBalancer
-  externalTrafficPolicy: Local
-  selector:
-    app: postfix
-  ports:
-    - name: smtp
-      port: 25
-      targetPort: 25
-      protocol: TCP

apps/base/paperclip/httproute.yaml

@@ -8,7 +8,9 @@ spec:
   hostnames:
     - paperclip.k8s.syd1.au.unkin.net
   parentRefs:
-    - name: paperclip
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: paperclip
       sectionName: http
   rules:
     - filters:
@@ -30,12 +32,17 @@ spec:
   hostnames:
     - paperclip.k8s.syd1.au.unkin.net
   parentRefs:
-    - name: paperclip
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: paperclip
       sectionName: https
   rules:
     - backendRefs:
-        - name: paperclip
+        - group: ""
+          kind: Service
+          name: paperclip
           port: 3100
+          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/priority-classes/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../../../base/mailgateway
+  - priorityclasses.yaml

apps/base/priority-classes/priorityclasses.yaml

@@ -0,0 +1,36 @@
+---
+apiVersion: scheduling.k8s.io/v1
+kind: PriorityClass
+metadata:
+  name: low
+value: 100
+preemptionPolicy: Never
+globalDefault: false
+description: "Low-importance workloads. Can be evicted under pressure but will not preempt other pods."
+---
+apiVersion: scheduling.k8s.io/v1
+kind: PriorityClass
+metadata:
+  name: power
+value: 100
+preemptionPolicy: Never
+globalDefault: false
+description: "Compute-heavy workloads with low scheduling importance. Evictable under pressure."
+---
+apiVersion: scheduling.k8s.io/v1
+kind: PriorityClass
+metadata:
+  name: medium
+value: 10000
+preemptionPolicy: PreemptLowerPriority
+globalDefault: false
+description: "Standard workloads. Will preempt low-priority pods if the cluster is under pressure."
+---
+apiVersion: scheduling.k8s.io/v1
+kind: PriorityClass
+metadata:
+  name: high
+value: 100000
+preemptionPolicy: PreemptLowerPriority
+globalDefault: false
+description: "High-importance services. Will preempt medium- and low-priority pods if necessary."

apps/base/puppet/httproute_puppetboard.yaml

@@ -13,7 +13,9 @@ spec:
   hostnames:
     - puppetboard.k8s.syd1.au.unkin.net
   parentRefs:
-    - name: puppetboard
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: puppetboard
       sectionName: http
   rules:
     - filters:
@@ -40,12 +42,17 @@ spec:
   hostnames:
     - puppetboard.k8s.syd1.au.unkin.net
   parentRefs:
-    - name: puppetboard
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: puppetboard
       sectionName: https
   rules:
     - backendRefs:
-        - name: puppetboard
+        - group: ""
+          kind: Service
+          name: puppetboard
           port: 80
+          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/puppet/httproute_puppetdb.yaml

@@ -13,12 +13,17 @@ spec:
   hostnames:
     - puppetdb.k8s.syd1.au.unkin.net
   parentRefs:
-    - name: puppetdb
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: puppetdb
       sectionName: https
   rules:
     - backendRefs:
-        - name: puppetdb
+        - group: ""
+          kind: Service
+          name: puppetdb
           port: 8080
+          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/puppet/service_puppetdb.yaml

@@ -9,7 +9,6 @@ metadata:
   name: puppetdb
   namespace: puppet
 spec:
-  clusterIP: null
   ports:
   - name: pdb-http
     port: 8080

apps/base/vault/httproute.yaml

@@ -11,7 +11,9 @@ spec:
   hostnames:
     - vault.k8s.syd1.au.unkin.net
   parentRefs:
-    - name: vault
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: vault
       sectionName: http
   rules:
     - filters:
@@ -36,12 +38,17 @@ spec:
   hostnames:
     - vault.k8s.syd1.au.unkin.net
   parentRefs:
-    - name: vault
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: vault
       sectionName: https
   rules:
     - backendRefs:
-        - name: vault
+        - group: ""
+          kind: Service
+          name: vault
           port: 8200
+          weight: 1
       matches:
         - path:
             type: PathPrefix
@@ -60,12 +67,17 @@ spec:
     - vault.service.consul
     - vault.query.consul
   parentRefs:
-    - name: vault
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: vault
       sectionName: vault-direct
   rules:
     - backendRefs:
-        - name: vault
+        - group: ""
+          kind: Service
+          name: vault
           port: 8200
+          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/vault/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
   - namespace.yaml
   - gateway.yaml
   - httproute.yaml
+  - role_k8s-service-registration.yaml

apps/base/vault/role_k8s-service-registration.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: vault-k8s-service-registration
+  namespace: vault
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: vault-k8s-service-registration
+  namespace: vault
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: vault-k8s-service-registration
+subjects:
+  - kind: ServiceAccount
+    name: vault
+    namespace: vault

apps/overlays/au-syd1/consul/values.yaml

@@ -37,7 +37,7 @@ server:
       cpu: 100m
     limits:
       memory: 2Gi
-      cpu: 1000m
+      cpu: "1"
 
 client:
   enabled: false

apps/overlays/au-syd1/kanidm/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/kanidm

apps/overlays/au-syd1/priority-classes/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/priority-classes

apps/overlays/au-syd1/vault/values.yaml

@@ -40,9 +40,7 @@ server:
           }
         }
 
-        service_registration "consul" {
+        service_registration "kubernetes" {}
-          address = "consul-server.consul.svc.cluster.local:8500"
-        }
 
   dataStorage:
     enabled: true
@@ -50,6 +48,14 @@ server:
     storageClass: cephrbd-fast-delete
     accessMode: ReadWriteOnce
 
+  extraEnv:
+    - name: VAULT_K8S_NAMESPACE
+      value: vault
+    - name: VAULT_K8S_POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+
   statefulSet:
     securityContext:
       container:

apps/overlays/au-syd1/woodpecker/values.yaml

@@ -2,6 +2,7 @@ agent:
   replicaCount: 3
   env:
     WOODPECKER_MAX_WORKFLOWS: "8"
+    WOODPECKER_BACKEND_K8S_PRIORITY_CLASS: power
     WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete
     WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G
     WOODPECKER_BACKEND_K8S_STORAGE_RWX: false

argocd/applicationsets/platform.yaml

@@ -20,8 +20,9 @@ spec:
       - path: apps/overlays/*/externaldns
       - path: apps/overlays/*/inteldeviceplugins-system
       - path: apps/overlays/*/jfrog
+      - path: apps/overlays/*/kanidm
       - path: apps/overlays/*/node-feature-discovery
-      - path: apps/overlays/*/mailgateway
+      - path: apps/overlays/*/priority-classes
       - path: apps/overlays/*/puppet
       - path: apps/overlays/*/purelb
       - path: apps/overlays/*/reflector-system
@@ -44,6 +45,12 @@ spec:
       destination:
         server: https://kubernetes.default.svc
         namespace: '{{path[3]}}'  # Use directory name as namespace
+      ignoreDifferences:
+      - group: ""
+        kind: ConfigMap
+        name: kanidm-repl-certs
+        jsonPointers:
+        - /data
       syncPolicy:
         automated:
           prune: true

argocd/projects/platform.yaml

@@ -27,8 +27,12 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'jfrog'
       server: https://kubernetes.default.svc
+    - namespace: 'kanidm'
+      server: https://kubernetes.default.svc
     - namespace: 'node-feature-discovery'
       server: https://kubernetes.default.svc
+    - namespace: 'priority-classes'
+      server: https://kubernetes.default.svc
     - namespace: 'purelb'
       server: https://kubernetes.default.svc
     - namespace: 'puppet'