kanidm-operator: deploy on scout + smoke OAuth2Client/Group #18

Merged

sophie merged 1 commit from wu-8-kanidm-operator into main

2026-10-19 21:57:23 +11:00

myagent commented

2026-10-19 20:42:58 +11:00

Collaborator

Deploys kanidm-operator on scout (WU-8). Merging this is the deploy.

scout-kanidm-operator → argo/scout/kanidm-operator/

namespace.yaml, crds.yaml, rbac.yaml, deployment.yaml are rendered by kanidm-operator's make homelab-manifests IMG=code.m.ac.nz/containers/kanidm-operator:sha-516bb05. They are byte-identical to a fresh render. Don't hand-edit them: re-copy per kanidm-operator docs/deploying.md (kanidm-operator PR linked below).
The Deployment pins sha-516bb05, reads KANIDM_URL and KANIDM_TOKEN via secretKeyRef from Secret kanidm-operator, has httpGet /healthz and /readyz probes on :8081, resources 10m/64Mi → 500m/128Mi, leader election, and operator.1password.io/auto-restart: "true". The namespace enforces restricted PSA.
secrets.yaml: OnePasswordItem vaults/homelab/items/kanidm-operator → Secret kanidm-operator (keys url, token).
No Service or ingress.
The Application uses syncOptions: [ServerSideApply=true] for the CRDs.

scout-kanidm-operator-smoke → argo/scout/kanidm-operator-smoke/

An empty Group kanidm-operator-smoke-users and a confidential OAuth2Client kanidm-operator-smoke (URLs under .invalid, scope map to the empty group), so it grants nothing.
It is a separate app so it can be removed while the operator still runs, which lets the finalizers clean up Kanidm. It has SkipDryRunOnMissingResource plus retry in case it syncs before the CRDs exist.
hedgedoc is untouched (it stays on its OnePasswordItem, per your call).

Validated: the skill's validate.sh passes for both apps. A server-side dry-run against scout accepted every cluster-scoped object (CRDs, ClusterRoles/Bindings, both Applications, namespaces). The four operator files plus the smoke CRs were also applied to a throwaway kind cluster with the released image.

After merge, I'll check with read-only kubectl: both apps Synced/Healthy, the Connected to Kanidm log line, both CRs Ready=True, Secret kanidm-operator-smoke-oidc, and the public discovery URL.

🤖 Generated with Claude Code

Deploys [kanidm-operator](https://code.m.ac.nz/sophie/kanidm-operator) on scout (WU-8). **Merging this is the deploy.** **`scout-kanidm-operator`** → `argo/scout/kanidm-operator/` - `namespace.yaml`, `crds.yaml`, `rbac.yaml`, `deployment.yaml` are rendered by kanidm-operator's `make homelab-manifests IMG=code.m.ac.nz/containers/kanidm-operator:sha-516bb05`. They are byte-identical to a fresh render. Don't hand-edit them: re-copy per kanidm-operator `docs/deploying.md` (kanidm-operator PR linked below). - The Deployment pins `sha-516bb05`, reads `KANIDM_URL` and `KANIDM_TOKEN` via `secretKeyRef` from Secret `kanidm-operator`, has `httpGet` `/healthz` and `/readyz` probes on :8081, resources 10m/64Mi → 500m/128Mi, leader election, and `operator.1password.io/auto-restart: "true"`. The namespace enforces `restricted` PSA. - `secrets.yaml`: `OnePasswordItem` `vaults/homelab/items/kanidm-operator` → Secret `kanidm-operator` (keys `url`, `token`). - No Service or ingress. - The Application uses `syncOptions: [ServerSideApply=true]` for the CRDs. **`scout-kanidm-operator-smoke`** → `argo/scout/kanidm-operator-smoke/` - An empty `Group` `kanidm-operator-smoke-users` and a confidential `OAuth2Client` `kanidm-operator-smoke` (URLs under `.invalid`, scope map to the empty group), so it grants nothing. - It is a separate app so it can be removed while the operator still runs, which lets the finalizers clean up Kanidm. It has `SkipDryRunOnMissingResource` plus retry in case it syncs before the CRDs exist. - hedgedoc is untouched (it stays on its `OnePasswordItem`, per your call). **Validated:** the skill's `validate.sh` passes for both apps. A server-side dry-run against scout accepted every cluster-scoped object (CRDs, ClusterRoles/Bindings, both Applications, namespaces). The four operator files plus the smoke CRs were also applied to a throwaway kind cluster with the released image. **After merge**, I'll check with read-only kubectl: both apps Synced/Healthy, the `Connected to Kanidm` log line, both CRs `Ready=True`, Secret `kanidm-operator-smoke-oidc`, and the public discovery URL. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

myagent added 1 commit

2026-10-19 20:42:58 +11:00

kanidm-operator: deploy on scout, plus a smoke OAuth2Client/Group dd3e37e903

- argo/scout/kanidm-operator/: namespace, CRDs, RBAC and Deployment rendered by
  kanidm-operator's `make homelab-manifests` at sha-516bb05 (do not edit by hand;
  re-copy per kanidm-operator docs/deploying.md), plus secrets.yaml mapping 1Password
  item vaults/homelab/items/kanidm-operator to Secret kanidm-operator (url, token).
  No Service or ingress: nothing is exposed.
- argo/apps/scout-kanidm-operator.yaml: ServerSideApply=true for the CRDs.
- argo/scout/kanidm-operator-smoke/ + argo/apps/scout-kanidm-operator-smoke.yaml: an
  empty Group and an OAuth2Client that grants nothing (.invalid URLs), proving the
  operator against the real Kanidm. Separate app so it can be removed while the operator
  is still running.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

myagent commented

2026-10-19 20:43:05 +11:00

Author

Collaborator

Operator-repo half (procedure docs, split script, config): sophie/kanidm-operator#13 (sophie/kanidm-operator#13). The doc links in the generated headers resolve once that merges.

Operator-repo half (procedure docs, split script, config): sophie/kanidm-operator#13 (https://code.m.ac.nz/sophie/kanidm-operator/pulls/13). The doc links in the generated headers resolve once that merges.