Merge branch 'main' into benvin/kanidm-vault-repl

- Store per-pod replication certs in Vault (kv/kubernetes/namespace/kanidm/default/repl-certs)
- VaultAuth + VaultStaticSecret sync certs to kanidm-repl-certs Secret
- busybox config-init init container injects peer certs from Secret into server.toml at startup
- Remove hardcoded partner_cert entries from per-pod server.toml templates
- Add automatic_refresh = true to all replication configs
- Add reloader.stakater.com/auto annotation to trigger rolling restart on ConfigMap/Secret changes
- Document domain UUID mismatch resolution and cert rotation in README

apps/base/kanidm/resources/server-0.toml

@@ -17,3 +17,4 @@ versions = 7
 [replication]
 origin = "repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"
 bindaddress = "[::]:8444"
+automatic_refresh = true

apps/base/kanidm/resources/server-1.toml

@@ -17,3 +17,4 @@ versions = 7
 [replication]
 origin = "repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"
 bindaddress = "[::]:8444"
+automatic_refresh = true

apps/base/kanidm/resources/server-2.toml

@@ -17,3 +17,4 @@ versions = 7
 [replication]
 origin = "repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"
 bindaddress = "[::]:8444"
+automatic_refresh = true

apps/base/kanidm/vaultauth.yaml

@@ -4,15 +4,18 @@ kind: VaultAuth
 metadata:
   name: default
   namespace: kanidm
+  labels:
+    app.kubernetes.io/name: kanidm
+    app.kubernetes.io/instance: kanidm
 spec:
-  allowedNamespaces:
-    - kanidm
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
   method: kubernetes
   mount: k8s/au/syd1
   vaultConnectionRef: vso-system/default
+  allowedNamespaces:
+    - kanidm
+  kubernetes:
+    role: default
+    serviceAccount: kanidm
+    audiences:
+      - vault
+    tokenExpirationSeconds: 600