Kaniop is a Kubernetes operator for managing Kanidm.
Kanidm is a modern, secure identity management system that provides authentication and authorization services with support for POSIX accounts, OAuth2, and more.
Kaniop treats Kubernetes as the orchestration control plane for Kanidm deployments. It continuously reconciles desired cluster topology, workload lifecycle, storage, configuration, upgrades, and identity resources through standard Kubernetes APIs, while Kanidm remains responsible for identity, persistence, and replication semantics.
Kaniop automates deployment and management of Kanidm clusters to provide declaratively managed, automatically reconciled, and observable identity services. The operator builds on Kubernetes resources to deploy, configure, provision, scale, upgrade, and monitor Kanidm clusters.
When an operation depends on database or replication correctness, Kaniop prefers explicit, machine-readable server state and conservative workflows. Pod readiness, StatefulSet rollout state, log messages, and timestamps are useful orchestration signals, but they are not treated as proofs of data safety.
The operator enables declarative identity management through GitOps workflows, allowing you to manage users, groups, OAuth2 clients, and other identity resources using familiar Kubernetes manifests.
Key capabilities include:
- Kanidm Cluster Management: Deploy and manage Kanidm clusters, including high-availability topologies and replication configuration
- Identity Resources: Declaratively manage persons, groups, OAuth2 clients, and service accounts
- GitOps Ready: Full integration with Git-based workflows for infrastructure-as-code
- Kubernetes Native: Built using Custom Resources and standard Kubernetes reconciliation patterns
- Operational Safety: Conservative stateful workflows with testing, monitoring, and observability support
For the design principles behind this separation of responsibilities, see the Architecture documentation.
For installation, deployment, and administration, see our Documentation and Quickstart Guide.
We welcome contributions. See Contributing to get started.
For filing bugs, suggesting improvements, or requesting new features, please open an issue.
Please use the following to reach members of the community:
- GitHub: Start a discussion or open an issue
- Documentation: pando85.github.io
Official releases of Kaniop can be found on the releases page. Please note that it is strongly recommended that you use official releases of Kaniop, as unreleased versions from the master branch are subject to changes and incompatibilities that will not be supported in the official releases. Builds from the master branch can have functionality changed and even removed at any time without compatibility support and without prior notice.