{"id":26917814,"url":"https://github.com/kittykatt/kanidm-helm-chart","last_synced_at":"2026-03-14T18:02:45.784Z","repository":{"id":273778428,"uuid":"919393341","full_name":"KittyKatt/kanidm-helm-chart","owner":"KittyKatt","description":"A non-official Helm chart for Kanidm","archived":false,"fork":false,"pushed_at":"2025-10-10T01:56:04.000Z","size":25,"stargazers_count":2,"open_issues_count":0,"forks_count":3,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-10-12T16:06:06.246Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Mustache","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/KittyKatt.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":"KittyKatt"}},"created_at":"2025-01-20T10:05:25.000Z","updated_at":"2025-10-10T01:56:04.000Z","dependencies_parsed_at":null,"dependency_job_id":"94681d76-68fe-46ad-8b70-a738734ac270","html_url":"https://github.com/KittyKatt/kanidm-helm-chart","commit_stats":null,"previous_names":["kittykatt/kanidm-helm-chart"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/KittyKatt/kanidm-helm-chart","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KittyKatt%2Fkanidm-helm-chart","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KittyKatt%2Fkanidm-helm-chart/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KittyKatt%2Fkanidm-helm-chart/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KittyKatt%2Fkanidm-helm-chart/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/KittyKatt","download_url":"https://codeload.github.com/KittyKatt/kanidm-helm-chart/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KittyKatt%2Fkanidm-helm-chart/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279011983,"owners_count":26085039,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-12T02:00:06.719Z","response_time":53,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-04-01T20:50:39.311Z","updated_at":"2025-10-12T16:06:38.212Z","avatar_url":"https://github.com/KittyKatt.png","language":"Mustache","funding_links":["https://github.com/sponsors/KittyKatt"],"categories":[],"sub_categories":[],"readme":"# Kanidm Helm Chart (non-official)\n\n![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.4.5](https://img.shields.io/badge/AppVersion-1.4.5-informational?style=flat-square)\n\n## Introduction\n\nThis is a non-official Helm chart for the [Kanidm identity management platform](https://github.com/kanidm/kanidm). I use Kanidm exlusively for all of my identity needs with anything that speaks OIDC (and some that I bully into speaking OIDC). This was made mostly to suit my needs and use case, but I tried to work in some other use cases I could think of. If something about this chart doesn't meet the needs of your specific environment/deployment, feel free to open a PR and maybe we can adapt the chart to allow it. Enjoy.\n\n## Prerequisites\n\n* Tested against Kubernetes v1.30.1\n* Tested with Helm v3.16.3\n* If you want to run unit tests, you'll need to install the Helm unittests plugin. See the [Testing](#testing) section for more information.\n\n## Installation\n\n### Add Helm Repository\n\nTBD, you'll have to install by cloning the chart for now\n\n### Configuration Information\n\nThere's a lot of configuration you can do here. At a high level, these are the top level objects you can disable/enable for your needs:\n\n* **Ingress**: If you don't require an Ingress resource, you can disable this using `ingress.enable: false`. If you do want to continue to use the Ingress, it is advised that you keep `service.https.type` set to `ClusterIP`. The Ingress is enabled by default, but does require some user provided values to work.\n* **Service**: There are two services here, ldaps and https. You can disable either or both by using `service.\u003cservic_type\u003e.enable: false`. Both services can be set to type of `ClusterIP`, `LoadBalancer`, or `NodePort`. They are both enabled and set to `ClusterIP` by default.\n* **Service Account**: If you decide you want (or don't want) a service account created to attach to the pod, you can control that with `serviceAccount.enable: false/true`. This is disabled by default.\n\nThere is an assumption made that you will be using TLS in this stack, either by generating a certificate through a ClusterIssuer/Issuer or providing a pre-created Secret containing two keys: TLS Key and TLS Certificate Chain.\n\nThe domain/origin URL of your Kanidm instance is controlled by `kanidm.domain` (required) and `kanidm.origin` (optional). If `kanidm.origin` is not specified, `kanidm.domain` is used in all instances where it would be referenced.\n\nNearly any resource can have annotations and labels specifically applied to it. Additionally, you can set `global.(labels|annotations)` to apply labels and/or annotations to ALL resources created by this chart.\n\nFor more specific configuration needs and further explanation of any values, please see the [full configuration values](#full-configuration-values) section.\n\n### Data Persistence\n\nThere is no assumption made by this chart by default to give you any data persistence. The default behavior is to mount an `emptyDir: {}` volume at `/data` in the container. This means data will be lost if you restart the StatefulSet/Pod. If you would like to persist your Kanidm data (HIGHLY recommended), you have one of two options:\n\n* Use `statefulset.storage.existingClaim` to specify the name of an existing PersistentVolumeClaim to bind to the pod. This requires you create this and the underlying PersistentVolume ahead of time however you would like.\n* Use `statefulset.storage.volumeClaimTemplate` to use a PersistentVolumeClaimTemplate to generate a PVC and PV for you using the specified StorageClass. Be sure the StorageClass actually exists first.\n\nVolumeClaimTemplate should follow standard format like the following (customize to your needs):\n\n```yaml\nvolumeClaimTemplate:\n  metadata:\n    name: volume-name\n  spec:\n    accessModes: [ \"ReadWriteOnce\" ]\n    resources:\n      requests:\n        storage: 10Gi\n    storageClassName: your-storage-class\n```\n\nIf you're struggling with file permissions in your persistence (for example, over NFS), look into NFS `mapall` and `mapgroup` options. You can also use `statefulset.podSecurityContext` to configure the user or group files are accessed as.\n\n## Full Configuration Values\n\n### Global\n\n| Key | Type | Default | Description |\n|-----|------|---------|-------------|\n| global.labels | object | {} | Labels that will be applied to all resources |\n| global.annotations | object | {} | Annotations that will be applied to all resources |\n\n### Kanidm Configuration (Top Level)\n\n| Key | Type | Default | Description |\n|-----|------|---------|-------------|\n| kanidm.domain | string | `\"\"` | Domain to use for Kanidm |\n| kanidm.origin | string | `\"\"` | Origin to use for Kanidm (if different from domain) |\n\n### Kanidm Configuration (Backups)\n\n| Key | Type | Default | Description |\n|-----|------|---------|-------------|\n| kanidm.backups.enabled | bool | true | Enable/disable database backups |\n| kanidm.backups.path | string | /data/backups | Path to store backups |\n| kanidm.backups.schedule | string | \"00 00 * * *\" | Schedule for backups |\n\n### Kanidm Configuration (Services)\n\n| Key | Type | Default | Description |\n|-----|------|---------|-------------|\n| kanidm.https.enabled | bool | true | Enable/disable the HTTPS service |\n| kanidm.https.port | int | 8443 | Port to use for the HTTPS service |\n| kanidm.ldaps.enabled | bool | true | Enable/disable the LDAPS service |\n| kanidm.ldaps.port | int | 3636 | Port to use for the LDAPS service |\n\n### Kanidm Configuration (TLS)\n\n| Key | Type | Default | Description |\n|-----|------|---------|-------------|\n| kanidm.tls.externalCertificateSecret.enabled | bool | false | Enable/disable the use of an external certificate resource (mutually exclusive with `kanidm.tls.issuer`) |\n| kanidm.tls.issuer | object | {} | Certificate issuer to use with ClusterIssuer/Issuer for cert generation (mutually exclusive with `kanidm.tls.externalCertificateSecret`) |\n| kanidm.tls.hosts | list | [] | Hosts to use for the TLS certificate |\n| kanidm.tls.secretName | string | \"kanidm-tls\" | Secret name to use for the TLS certificate |\n| kanidm.tls.tlsKeySecretKeyName | string | \"tls.key\" | Secret key that holds the TLS certificate key |\n| kanidm.tls.tlsChainSecretKeyName | string | \"tls.crt\" | Secret key that holds the TLS certificate chain |\n\n### Service Account\n\n| Key | Type | Default | Description |\n|-----|------|---------|-------------|\n| serviceAccount.create | bool | false | Enable/disable creation of a dedicated Kubernetes Service Account |\n| serviceAccount.name | string | \"\" | Name of the service account to use |\n\n### Ingress\n\n| Key | Type | Default | Description |\n|-----|------|---------|-------------|\n| ingress.enabled | bool | true | Enable/disable the creation of an Ingress resource |\n| ingress.ingressClassName | string | \"\" | IngressClass to use |\n| ingress.annotations | object | {} | Annotations to apply to the Ingress resource |\n| ingress.labels | object | {} | Labels to apply to the Ingress resource |\n| ingress.host | string | \"\" | Hostname to use for the Ingress |\n\n### Service\n\n| Key | Type | Default | Description |\n|-----|------|---------|-------------|\n| service.https.annotations | object | {} | Annotations to apply to the HTTPS Service resource |\n| service.https.labels | object | {} | Labels to apply to the HTTPS Service resource |\n| service.https.enabled | string | true | Enable/disable the HTTPS Service resource |\n| service.https.type | string | ClusterIP | Service type to use for HTTPS (can be one of ClusterIP, NodePort, LoadBalancer) |\n| service.https.port | int | 8443 | Port to use for the HTTPS Service resource |\n| service.ldaps.annotations | object | {} | Annotations to apply to the LDAPS Service resource |\n| service.ldaps.labels | object | {} | Labels to apply to the LDAPS Service resource |\n| service.ldaps.enabled | string | true | Enable/disable the LDAPS Service resource |\n| service.ldaps.type | string | ClusterIP | Service type to use for LDAPS (can be one of ClusterIP, NodePort, LoadBalancer) |\n| service.ldaps.port | int | 3636 | Port to use for the LDAPS Service resource |\n\n### StatefulSet\n\n| Key | Type | Default | Description |\n|-----|------|---------|-------------|\n| statefulset.annotations | object | {} | Annotations to apply to the StatefulSet resource |\n| statefulset.labels | object | {} | Labels to apply to the StatefulSet resource |\n| statefulset.podSecurityContext | object | {} | PodSecurityContext for StatefulSet object |\n| statefulset.containerSecurityContext | object | {} | SecurityContext for the kanidm container |\n| statefulset.imagePullSecrets | list | [] | Image pull secrets for use with private registries |\n| statefulset.image.repository | string | kanidm/server | Image to use for the kanidm container (must be in format repostiory/image_name) |\n| statefulset.image.tag | string | latest | Tag to use for the kanidm image |\n| statefulset.image.pullPolicy | string | IfNotPresent | pullPolicy to use for kanidm images |\n| statefulset.extraEnv | list | [] | Extra environment variables to pass to the kanidm container. Should be in `[{\"name\": name, \"value\": value}]` format |\n| statefulset.livenessProbeEnabled | bool | true | Enable/disable liveness probe |\n| statefulset.readinessProbeEnabled | bool | true | Enable/disable readiness probe |\n| statefulset.extraPorts | list | [] | Extra ports to expose on the kanidm container. Should be in `[{\"name\": name, \"containerPort\": port}]` format |\n| statefulset.resources.limits.cpu | string | 50M | CPU limit for the kanidm container |\n| statefulset.resources.limits.memory | string | 100Mi | Memory limit for the kanidm container |\n| statefulset.resources.requests.cpu | string | 10m | CPU request for the kanidm container |\n| statefulset.resources.requests.memory | string | 50Mi | Memory request for the kanidm container |\n| statefulset.storage.existingClaim | string | null | Existing PVC to use for the kanidm data volume |\n| statefulset.storage.volumeClaimTemplate | string | {} | VolumeClaimTemplate to use for kanidm data PVC creation. See [#data-persistence](Data Persistence) for more information |\n\n----------------------------------------------\nAutogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)\n\n## Testing\n\nTo run the unit tests for this chart, you'll need to install the [Helm unittests plugin](https://github.com/helm-unittest/helm-unittest/) plugin and run the following command from this directory:\n\n```shell\nhelm unittest .\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkittykatt%2Fkanidm-helm-chart","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkittykatt%2Fkanidm-helm-chart","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkittykatt%2Fkanidm-helm-chart/lists"}