skills: kanidm-operator workflows (add user to group, group to app, add app, migrate app) #22

Merged

sophie merged 1 commit from kanidm-skills into main

2026-10-20 21:55:36 +11:00

myagent commented

2026-10-20 00:02:23 +11:00

Collaborator

Four skills under .claude/skills/ for the Kanidm-operator side of this repo, written from the hedgedoc migration (#19, #20, #21). They follow the add-argocd-app shape: inputs to gather, steps with the YAML to copy, a validate/PR/check section using the read-only scout context, gotchas.

skill	does
`kanidm-add-user-to-group`	edit a `Group` CR's `members`; what to do when the group is still hand-made; `RefNotFound` / `RefNotReady`
`kanidm-add-group-to-app`	add a scope map (who can log in) or a claim map (roles) to an `OAuth2Client`
`kanidm-add-app`	new `OAuth2Client` + `Group` for a scout app and wiring the Deployment to the generated Secret; the inputs that bite: exact callback URL, PKCE, `preferShortUsername`, confidential vs public, scout-only
`kanidm-migrate-app`	adopt a hand-made client without breaking login, the two-PR procedure, verification, and rollback without triggering the finalizer. Lists the remaining hand-made clients (karakeep next)

kanidm-migrate-app/capture.sh <client> [ns] reads the live client and the groups in its scope/claim maps over the Kanidm API, using the operator's service-account token from scout (read-only GETs; the token and basic secret are never printed), prints the attributes, and prints a draft kanidm.yaml. Tested against scout-hedgedoc: the draft matches argo/hedgedoc/kanidm.yaml apart from scope order. Claim maps and supplementary scope maps are printed raw with a TODO, since the operator can't express the latter and the former need a hand translation.

Companion: kanidm-operator PR #15 updates docs/deploying.md to point at kanidm-migrate-app.

🤖 Generated with Claude Code

Four skills under `.claude/skills/` for the Kanidm-operator side of this repo, written from the hedgedoc migration (#19, #20, #21). They follow the `add-argocd-app` shape: inputs to gather, steps with the YAML to copy, a validate/PR/check section using the read-only scout context, gotchas. | skill | does | |---|---| | `kanidm-add-user-to-group` | edit a `Group` CR's `members`; what to do when the group is still hand-made; `RefNotFound` / `RefNotReady` | | `kanidm-add-group-to-app` | add a scope map (who can log in) or a claim map (roles) to an `OAuth2Client` | | `kanidm-add-app` | new `OAuth2Client` + `Group` for a scout app and wiring the Deployment to the generated Secret; the inputs that bite: exact callback URL, PKCE, `preferShortUsername`, confidential vs public, scout-only | | `kanidm-migrate-app` | adopt a hand-made client without breaking login, the two-PR procedure, verification, and rollback without triggering the finalizer. Lists the remaining hand-made clients (karakeep next) | `kanidm-migrate-app/capture.sh <client> [ns]` reads the live client and the groups in its scope/claim maps over the Kanidm API, using the operator's service-account token from scout (read-only GETs; the token and basic secret are never printed), prints the attributes, and prints a draft `kanidm.yaml`. Tested against `scout-hedgedoc`: the draft matches `argo/hedgedoc/kanidm.yaml` apart from scope order. Claim maps and supplementary scope maps are printed raw with a TODO, since the operator can't express the latter and the former need a hand translation. Companion: kanidm-operator PR #15 updates `docs/deploying.md` to point at `kanidm-migrate-app`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

myagent added 1 commit

2026-10-20 00:02:23 +11:00

skills: kanidm-operator workflows (add user to group, group to app, add app, migrate app) 18c7cc9de2

Four skills for the Kanidm/operator side of this repo, written from the hedgedoc
migration (#19):

- kanidm-add-user-to-group: edit a Group CR's members; what to do when the group
  is hand-made; RefNotFound/RefNotReady.
- kanidm-add-group-to-app: scope maps and claim maps on an OAuth2Client.
- kanidm-add-app: a new OAuth2Client + Group for a scout app and wiring the app
  to the generated Secret; the inputs that bite (exact callback URL, PKCE,
  preferShortUsername, confidential vs public).
- kanidm-migrate-app: adopt a hand-made client without breaking login, as done
  for hedgedoc, with capture.sh that reads the live client and its groups over
  the Kanidm API (operator token from scout, never printed) and prints a draft
  kanidm.yaml. Tested: it reproduces argo/hedgedoc/kanidm.yaml.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>