Add JSON schema generation for kubeconform CRD validation

- ci/generate-schemas.sh extracts schemas from live cluster CRDs via kubectl
- Generated schemas committed to schemas/ for CI use
- Run `make schemas` to regenerate after CRD or K8s version changes
- validate-apps.sh and validate-clusters.sh check local schemas first
- CRD instances (Gateway, TLSRoute, Pooler, etc.) now validated instead of skipped
- CustomResourceDefinition meta-type still skipped (no schema exists upstream)

apps/base/authentik/cnpg_cluster.yaml

@@ -1,91 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: postgres
-  namespace: authentik
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  bootstrap:
-    initdb:
-      database: authentik
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: authentik
-      secret:
-        name: postgres-credentials
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
-  instances: 3
-  logLevel: info
-  maxSyncReplicas: 0
-  minSyncReplicas: 0
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      archive_mode: "on"
-      archive_timeout: 5min
-      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
-      full_page_writes: "on"
-      log_destination: csvlog
-      log_directory: /controller/log
-      log_filename: postgres
-      log_rotation_age: "0"
-      log_rotation_size: "0"
-      log_truncate_on_rotation: "false"
-      logging_collector: "on"
-      max_connections: "200"
-      max_parallel_workers: "16"
-      max_replication_slots: "16"
-      max_worker_processes: "16"
-      shared_buffers: 128MB
-      shared_memory_type: mmap
-      ssl_max_protocol_version: TLSv1.3
-      ssl_min_protocol_version: TLSv1.3
-      wal_keep_size: 256MB
-      wal_level: logical
-      wal_log_hints: "on"
-      wal_receiver_timeout: 5s
-      wal_sender_timeout: 5s
-    syncReplicaElectionConstraint:
-      enabled: false
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  probes:
-    liveness:
-      isolationCheck:
-        connectionTimeout: 1000
-        enabled: true
-        requestTimeout: 1000
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: 500m
-      memory: 512Mi
-    requests:
-      cpu: 250m
-      memory: 256Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 20Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600

apps/base/authentik/cnpg_pooler.yaml

@@ -1,66 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Pooler
-metadata:
-  name: postgres-pooler-rw
-  namespace: authentik
-spec:
-  cluster:
-    name: postgres
-  instances: 2
-  pgbouncer:
-    parameters:
-      default_pool_size: "100"
-      max_client_conn: "400"
-    paused: false
-    poolMode: session
-  template:
-    metadata:
-      labels:
-        app: pooler-rw
-    spec:
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - pooler-rw
-              topologyKey: kubernetes.io/hostname
-      containers: []
-  type: rw
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Pooler
-metadata:
-  name: postgres-pooler-ro
-  namespace: authentik
-spec:
-  cluster:
-    name: postgres
-  instances: 2
-  pgbouncer:
-    parameters:
-      default_pool_size: "100"
-      max_client_conn: "400"
-    paused: false
-    poolMode: session
-  template:
-    metadata:
-      labels:
-        app: pooler-ro
-    spec:
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - pooler-ro
-              topologyKey: kubernetes.io/hostname
-      containers: []
-  type: ro

apps/base/authentik/gateway.yaml

@@ -1,57 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: identity.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: identity.unkin.net,identity.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: authentik
-  namespace: authentik
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: identity.unkin.net
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: identity.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: authentik-tls
-        mode: Terminate
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: identity.k8s.syd1.au.unkin.net
-      name: http-internal
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: identity.k8s.syd1.au.unkin.net
-      name: https-internal
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: authentik-tls
-        mode: Terminate

apps/base/authentik/httproute.yaml

@@ -1,59 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: authentik-http-redirect
-  namespace: authentik
-spec:
-  hostnames:
-    - identity.unkin.net
-    - identity.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik
-      sectionName: http
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik
-      sectionName: http-internal
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: authentik
-  namespace: authentik
-spec:
-  hostnames:
-    - identity.unkin.net
-    - identity.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik
-      sectionName: https
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik
-      sectionName: https-internal
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: authentik-server
-          port: 80
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/authentik/kustomization.yaml

@@ -1,19 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - cnpg_cluster.yaml
-  - cnpg_pooler.yaml
-  - gateway.yaml
-  - httproute.yaml
-  - ldap-gateway.yaml
-  - ldap-httproute.yaml
-  - ldap-service.yaml
-  - ldap-tlsroute.yaml
-  - namespace.yaml
-  - redis-deployment.yaml
-  - redis-pvc.yaml
-  - redis-service.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml

apps/base/authentik/ldap-gateway.yaml

@@ -1,47 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: ldap.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  name: authentik-ldap
-  namespace: authentik
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: ldap.k8s.syd1.au.unkin.net
-      name: ldaps-internal
-      port: 636
-      protocol: TLS
-      tls:
-        mode: Passthrough
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: ldap.main.unkin.net
-      name: ldaps-main
-      port: 636
-      protocol: TLS
-      tls:
-        mode: Passthrough
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: ldap.k8s.syd1.au.unkin.net
-      name: http-dns
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: ldap.main.unkin.net
-      name: http-dns-main
-      port: 80
-      protocol: HTTP

apps/base/authentik/ldap-httproute.yaml

@@ -1,32 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: authentik-ldap-dns
-  namespace: authentik
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: ldap.k8s.syd1.au.unkin.net,ldap.main.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-spec:
-  hostnames:
-    - ldap.k8s.syd1.au.unkin.net
-    - ldap.main.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik-ldap
-      sectionName: http-dns
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik-ldap
-      sectionName: http-dns-main
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/authentik/ldap-service.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-ldap
-  namespace: authentik
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: ldaps
-      port: 6636
-      protocol: TCP
-      targetPort: 6636
-  selector:
-    app.kubernetes.io/name: authentik
-    app.kubernetes.io/component: ldap
-  sessionAffinity: None
-  type: ClusterIP

apps/base/authentik/ldap-tlsroute.yaml

@@ -1,26 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: TLSRoute
-metadata:
-  name: authentik-ldaps
-  namespace: authentik
-spec:
-  hostnames:
-    - ldap.k8s.syd1.au.unkin.net
-    - ldap.main.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik-ldap
-      sectionName: ldaps-internal
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik-ldap
-      sectionName: ldaps-main
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: authentik-ldap
-          port: 6636
-          weight: 1

apps/base/authentik/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: authentik

apps/base/authentik/redis-deployment.yaml

@@ -1,58 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: redis
-  namespace: authentik
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: redis
-  template:
-    metadata:
-      labels:
-        app: redis
-    spec:
-      containers:
-        - name: redis
-          image: redis:7-alpine
-          imagePullPolicy: IfNotPresent
-          args:
-            - --save
-            - "20"
-            - "1"
-          ports:
-            - containerPort: 6379
-              name: redis
-              protocol: TCP
-          livenessProbe:
-            exec:
-              command:
-                - redis-cli
-                - ping
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          readinessProbe:
-            exec:
-              command:
-                - redis-cli
-                - ping
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          resources:
-            limits:
-              cpu: 500m
-              memory: 512Mi
-            requests:
-              cpu: 50m
-              memory: 128Mi
-          volumeMounts:
-            - mountPath: /data
-              name: redis-data
-      volumes:
-        - name: redis-data
-          persistentVolumeClaim:
-            claimName: redis-data

apps/base/authentik/redis-pvc.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: redis-data
-  namespace: authentik
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-delete

apps/base/authentik/redis-service.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: redis
-  namespace: authentik
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: redis
-      port: 6379
-      protocol: TCP
-      targetPort: redis
-  selector:
-    app: redis
-  sessionAffinity: None
-  type: ClusterIP

apps/base/authentik/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: authentik
-spec:
-  allowedNamespaces:
-    - authentik
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default

apps/base/authentik/vaultstaticsecret.yaml

@@ -1,51 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: postgres-credentials
-  namespace: authentik
-spec:
-  destination:
-    create: true
-    name: postgres-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/authentik/default/postgres-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: authentik-credentials
-  namespace: authentik
-spec:
-  destination:
-    create: true
-    name: authentik-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/authentik/default/authentik-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: s3-credentials
-  namespace: authentik
-spec:
-  destination:
-    create: true
-    name: s3-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/authentik/default/s3-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/woodpecker/kustomization.yaml

@@ -7,11 +7,7 @@ resources:
   - cnpg_cluster.yaml
   - cnpg_pooler.yaml
   - serviceaccount_terraform_artifactapi.yaml
-  - serviceaccount_terraform_authentik.yaml
   - serviceaccount_terraform_git.yaml
-  - serviceaccount_terraform_prowlarr.yaml
-  - serviceaccount_terraform_radarr.yaml
-  - serviceaccount_terraform_sonarr.yaml
   - serviceaccount_terraform_vault.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml

apps/base/woodpecker/serviceaccount_terraform_authentik.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: terraform-authentik
-  namespace: woodpecker

apps/base/woodpecker/serviceaccount_terraform_prowlarr.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: terraform-prowlarr
-  namespace: woodpecker

apps/base/woodpecker/serviceaccount_terraform_radarr.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: terraform-radarr
-  namespace: woodpecker

apps/base/woodpecker/serviceaccount_terraform_sonarr.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: terraform-sonarr
-  namespace: woodpecker

apps/overlays/au-syd1/authentik/kustomization.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/authentik
-
-helmCharts:
-  - name: authentik
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "2026.5.3"
-    releaseName: authentik
-    namespace: authentik
-    valuesFile: values.yaml

apps/overlays/au-syd1/authentik/values.yaml

@@ -1,105 +0,0 @@
-global:
-  env:
-    # PostgreSQL primary (via pooler)
-    - name: AUTHENTIK_POSTGRESQL__HOST
-      value: postgres-pooler-rw
-    - name: AUTHENTIK_POSTGRESQL__PORT
-      value: "5432"
-    - name: AUTHENTIK_POSTGRESQL__NAME
-      value: authentik
-    - name: AUTHENTIK_POSTGRESQL__USER
-      valueFrom:
-        secretKeyRef:
-          name: postgres-credentials
-          key: username
-    - name: AUTHENTIK_POSTGRESQL__PASSWORD
-      valueFrom:
-        secretKeyRef:
-          name: postgres-credentials
-          key: password
-    # PostgreSQL read replica (via pooler)
-    - name: AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__HOST
-      value: postgres-pooler-ro
-    - name: AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__PORT
-      value: "5432"
-    - name: AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__NAME
-      value: authentik
-    - name: AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__USER
-      valueFrom:
-        secretKeyRef:
-          name: postgres-credentials
-          key: username
-    - name: AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__PASSWORD
-      valueFrom:
-        secretKeyRef:
-          name: postgres-credentials
-          key: password
-    # PostgreSQL pooler settings
-    - name: AUTHENTIK_POSTGRESQL__DISABLE_SERVER_SIDE_CURSORS
-      value: "true"
-    - name: AUTHENTIK_POSTGRESQL__CONN_MAX_AGE
-      value: "0"
-    - name: AUTHENTIK_POSTGRESQL__CONN_HEALTH_CHECKS
-      value: "true"
-    # Redis
-    - name: AUTHENTIK_REDIS__HOST
-      value: redis
-    - name: AUTHENTIK_REDIS__PORT
-      value: "6379"
-    # S3 storage
-    - name: AUTHENTIK_STORAGE__BACKEND
-      value: s3
-    - name: AUTHENTIK_STORAGE__S3__ENDPOINT
-      value: https://radosgw.service.consul/
-    - name: AUTHENTIK_STORAGE__S3__BUCKET_NAME
-      value: authentik
-    - name: AUTHENTIK_STORAGE__S3__ADDRESSING_STYLE
-      value: path
-    - name: AUTHENTIK_STORAGE__S3__ACCESS_KEY
-      valueFrom:
-        secretKeyRef:
-          name: s3-credentials
-          key: AUTHENTIK_STORAGE__S3__ACCESS_KEY
-    - name: AUTHENTIK_STORAGE__S3__SECRET_KEY
-      valueFrom:
-        secretKeyRef:
-          name: s3-credentials
-          key: AUTHENTIK_STORAGE__S3__SECRET_KEY
-    # Secret key
-    - name: AUTHENTIK_SECRET_KEY
-      valueFrom:
-        secretKeyRef:
-          name: authentik-credentials
-          key: AUTHENTIK_SECRET_KEY
-
-server:
-  replicas: 3
-  annotations:
-    reloader.stakater.com/auto: "true"
-  ingress:
-    enabled: false
-  resources:
-    limits:
-      cpu: "2"
-      memory: 2Gi
-    requests:
-      cpu: 250m
-      memory: 512Mi
-
-worker:
-  replicas: 2
-  annotations:
-    reloader.stakater.com/auto: "true"
-  resources:
-    limits:
-      cpu: "2"
-      memory: 2Gi
-    requests:
-      cpu: 250m
-      memory: 512Mi
-
-postgresql:
-  enabled: false
-
-redis:
-  enabled: false

argocd/applicationsets/platform.yaml

@@ -10,7 +10,6 @@ spec:
       repoURL: https://git.unkin.net/unkin/argocd-apps
       revision: HEAD
       directories:
-      - path: apps/overlays/*/authentik
       - path: apps/overlays/*/artifactapi
       - path: apps/overlays/*/age-api
       - path: apps/overlays/*/cattle-system

argocd/projects/platform.yaml

@@ -19,8 +19,6 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'age-api'
       server: https://kubernetes.default.svc
-    - namespace: 'authentik'
-      server: https://kubernetes.default.svc
     - namespace: 'cert-manager'
       server: https://kubernetes.default.svc
     - namespace: 'certificates'