Open source Kubernetes operator for Kanidm

Manage Kanidm on Kubernetes with confidence.

Deploy, configure, and operate Kanidm clusters and identity resources through the Kubernetes API. Built for declarative workflows, predictable reconciliation, and GitOps.

Kanidm is the identity server. Kaniop operates it on Kubernetes and reconciles identity resources from GitOps workflows.

Get started Explore documentation

Open source · Kubernetes-native · Built in Rust

kanidm.yaml YAML

apiVersion: kaniop.rs/v1beta1
kind: Kanidm
metadata:
  name: my-idm
spec:
  domain: my-idm.localhost
  replicaGroups:
    - name: default
      replicas: 1

apiVersion: kaniop.rs/v1beta1
kind: KanidmPersonAccount
metadata:
  name: alice
spec:
  kanidmRef:
    name: my-idm
  personAttributes:
    displayname: Alice Smith
    mail:
      - alice@example.com

apiVersion: kaniop.rs/v1beta1
kind: KanidmOAuth2Client
metadata:
  name: my-webapp
spec:
  kanidmRef:
    name: my-idm
  displayname: My Web Application
  origin: https://myapp.example.com
  redirectUrl:
    - https://myapp.example.com/oauth2/callback

Real Kubernetes CRD examples Full reference →

Kubernetes APIDesired state

KaniopReconciliation

KanidmIdentity service

GitOps readyManage identity as code

Kubernetes nativeStandard CRDs and controllers

Identity resourcesPersons, groups, OAuth2 & more

Operational safetyConservative stateful workflows

CAPABILITIES

Everything you need to operate Kanidm

Bring identity management into the same declarative infrastructure workflows you already use across your Kubernetes platform.

Cluster management

Deploy and reconcile Kanidm clusters, replica groups, configuration, and Kubernetes workloads.

Cluster documentation

Declarative identities

Manage persons, groups, OAuth2 clients, and service accounts as Kubernetes resources.

Identity resources

GitOps workflows

Review identity changes in Git and let your existing reconciliation tools apply them.

Explore the concepts

Conservative operations

Coordinate lifecycle changes while respecting Kanidm's data and replication semantics.

Safety architecture

Backup & restore Experimental

Explore native backup and recovery workflows. Not yet supported for production disaster recovery.

Limitations and status

Observability

Understand controller behavior through resource status, Kubernetes events, and telemetry.

Cluster operations

ARCHITECTURE

Kubernetes-native by design.

Kaniop continuously reconciles Kubernetes custom resources. Kubernetes defines the desired deployment state, Kaniop coordinates operations, and Kanidm remains responsible for identity, persistence, and replication correctness.

Explore the architecture

Kubernetes API

Kanidm CRTopology & configuration

Identity CRDsPersons, groups, OAuth2

Platform resourcesSecrets & persistent storage

Kaniop operator

Reconciliation loop Observe · plan · coordinate

Safe orchestrationStateful lifecycle policies

Kanidm cluster

Kanidm data planeIdentity, storage, replication

Correctness stays with Kanidm

QUICKSTART

Get started with Kaniop.

Install the operator with Helm, then use the documented Kubernetes resources to deploy and manage Kanidm.

1
Install the operatorUse the official Helm chart from GHCR.
2
Declare a Kanidm clusterApply the manifests in the quickstart guide.
3
Manage identity as codeAdd persons, groups, and OAuth2 clients through CRDs.

Follow the full quickstart

Install with HelmShell

helm install --create-namespace \
  --namespace kaniop --wait kaniop \
  oci://ghcr.io/pando85/helm-charts/kaniop

kubectl get pods -n kaniop

See the guide for prerequisites and production configuration.

Installation documentation

OPEN SOURCE

Built openly. Improved together.

Explore the source, follow releases, report issues, and help shape Kaniop.

View on GitHub Join discussions