Identity Options
Options for: kanidm, kaniop, oidc.
All options are under lab.clusters.<name>.components.
kanidm.backup.enable
This option has no description.
Type: boolean
Default: false
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.backup.schedule
This option has no description.
Type: string
Default: "0 2 * * *"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.chart
This option has no description.
Type: package
Default: <derivation helm-chart-https-datosh.github.io-kanidm-kanidm-0.2.1>
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.domain
This option has no description.
Type: string
Default: "idm.example.com"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.enable
Whether to enable Kanidm identity management.
Type: boolean
Default: false
Example: true
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.gateway.enable
This option has no description.
Type: boolean
Default: true
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.gateway.gatewayNamespace
This option has no description.
Type: null or string
Default: "kube-system"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.gateway.gatewayRef
This option has no description.
Type: string
Default: "default-gateway"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.gateway.mode
TLS mode: ‘terminate’ uses HTTPRoute + BackendTLSPolicy, ‘passthrough’ uses TLSRoute (raw TLS to backend)
Type: one of "terminate", "passthrough"
Default: "terminate"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.groups
This option has no description.
Type: attribute set of (submodule)
Default: { }
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.groups.<name>.accountPolicy
This option has no description.
Type: null or (submodule)
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.groups.<name>.accountPolicy.authSessionExpiry
This option has no description.
Type: signed integer
Default: 86400
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.groups.<name>.accountPolicy.credentialTypeMinimum
This option has no description.
Type: one of "any", "mfa", "passkey", "attested_passkey"
Default: "any"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.groups.<name>.accountPolicy.passwordMinimumLength
This option has no description.
Type: signed integer
Default: 12
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.groups.<name>.accountPolicy.privilegeExpiry
This option has no description.
Type: signed integer
Default: 900
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.groups.<name>.entryManagedBy
Group or account that manages this group
Type: null or string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.groups.<name>.mail
Group email addresses
Type: list of string
Default: [ ]
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.groups.<name>.members
This option has no description.
Type: list of string
Default: [ ]
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.groups.<name>.posixAttributes
This option has no description.
Type: null or (submodule)
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.groups.<name>.posixAttributes.gidnumber
This option has no description.
Type: null or signed integer
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.instanceName
This option has no description.
Type: string
Default: "kanidm"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.namespace
This option has no description.
Type: string
Default: "kanidm"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2ClientNamespaceSelector
Namespace selector for KanidmOAuth2Client discovery. {} = all namespaces.
Type: null or (attribute set)
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients
This option has no description.
Type: attribute set of (submodule)
Default: { }
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.allowInsecureClientDisablePkce
Disable PKCE enforcement for confidential clients whose OIDC library doesn’t support it (e.g. Dex)
Type: boolean
Default: false
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.allowLocalhostRedirect
This option has no description.
Type: boolean
Default: false
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.claimMap
Custom claim mappings from group membership
Type: list of (submodule)
Default: [ ]
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.claimMap.*.joinStrategy
This option has no description.
Type: one of "csv", "ssv", "array"
Default: "array"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.claimMap.*.name
This option has no description.
Type: string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.claimMap.*.valuesMap
This option has no description.
Type: list of (submodule)
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.claimMap.*.valuesMap.*.group
This option has no description.
Type: string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.claimMap.*.valuesMap.*.values
This option has no description.
Type: list of string
Default: [ ]
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.disableConsentPrompt
Skip user consent screen (for admin-managed apps)
Type: boolean
Default: false
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.displayName
This option has no description.
Type: string
Default: ""
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.namespace
Namespace for this OAuth2Client CR and its generated secret. null = kanidm namespace.
Type: null or string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.origin
This option has no description.
Type: string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.preferShortUsername
This option has no description.
Type: boolean
Default: false
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.public
This option has no description.
Type: boolean
Default: true
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.redirectUrls
This option has no description.
Type: list of string
Default: [ ]
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.scopeMap
This option has no description.
Type: list of (submodule)
Default: [ ]
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.scopeMap.*.group
This option has no description.
Type: string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.scopeMap.*.scopes
This option has no description.
Type: list of string
Default:
[
"openid"
"email"
"groups"
]
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.secretTemplate
Extra labels for the kaniop-generated credential secret
Type: null or (attribute set of string)
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.strictRedirectUrl
Require exact redirect URL matching
Type: boolean
Default: true
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.supScopeMap
Supplementary scopes (optional claims not used for authz)
Type: list of (submodule)
Default: [ ]
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.supScopeMap.*.group
This option has no description.
Type: string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.oauth2Clients.<name>.supScopeMap.*.scopes
This option has no description.
Type: list of string
Default: [ ]
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.origin
This option has no description.
Type: string
Default: "https://idm.example.com"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.phase
This option has no description.
Type: string
Default: "infrastructure"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.ref
This option has no description.
Type: attribute set
Default: { }
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.replicas
This option has no description.
Type: positive integer, meaning >0
Default: 1
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.serviceAccounts
Service accounts (bots/daemons) with API tokens
Type: attribute set of (submodule)
Default: { }
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.serviceAccounts.<name>.accountExpire
This option has no description.
Type: null or string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.serviceAccounts.<name>.accountValidFrom
This option has no description.
Type: null or string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.serviceAccounts.<name>.apiTokens
This option has no description.
Type: list of (submodule)
Default: [ ]
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.serviceAccounts.<name>.apiTokens.*.expiry
RFC3339 expiry (e.g. 2026-12-31T00:00:00Z)
Type: null or string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.serviceAccounts.<name>.apiTokens.*.label
This option has no description.
Type: string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.serviceAccounts.<name>.apiTokens.*.purpose
This option has no description.
Type: one of "readonly", "readwrite"
Default: "readonly"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.serviceAccounts.<name>.apiTokens.*.secretName
This option has no description.
Type: string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.serviceAccounts.<name>.displayName
This option has no description.
Type: string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.serviceAccounts.<name>.entryManagedBy
Group or account that manages this service account
Type: string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.serviceAccounts.<name>.mail
This option has no description.
Type: list of string
Default: [ ]
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.storage.size
This option has no description.
Type: string
Default: "10Gi"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.storage.storageClass
This option has no description.
Type: null or string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.tls.issuerRef
This option has no description.
Type: null or (submodule)
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.tls.issuerRef.kind
This option has no description.
Type: string
Default: "ClusterIssuer"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.tls.issuerRef.name
This option has no description.
Type: string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.tls.secretName
This option has no description.
Type: string
Default: "kanidm-tls"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.users
This option has no description.
Type: attribute set of (submodule)
Default: { }
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.users.<name>.accountExpire
ISO 8601 timestamp — account expires after this time
Type: null or string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.users.<name>.accountValidFrom
ISO 8601 timestamp — account is invalid before this time
Type: null or string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.users.<name>.credential
This option has no description.
Type: one of "token", "password", "passkey"
Default: "token"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.users.<name>.credentialsTokenTtl
This option has no description.
Type: signed integer
Default: 3600
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.users.<name>.displayName
This option has no description.
Type: string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.users.<name>.email
This option has no description.
Type: string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.users.<name>.groups
This option has no description.
Type: list of string
Default: [ ]
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.users.<name>.legalName
This option has no description.
Type: null or string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.users.<name>.passwordSecretRef
This option has no description.
Type: null or (submodule)
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.users.<name>.passwordSecretRef.key
This option has no description.
Type: string
Default: "password"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.users.<name>.passwordSecretRef.name
This option has no description.
Type: string
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.users.<name>.posixAttributes
POSIX/Unix attributes for SSH and Linux integration
Type: null or (submodule)
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.users.<name>.posixAttributes.gidnumber
Unix UID/GID (auto-generated if null)
Type: null or signed integer
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.users.<name>.posixAttributes.loginshell
This option has no description.
Type: string
Default: "/bin/bash"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kanidm.version
This option has no description.
Type: string
Default: "1.4.2"
Declared in: modules/lab/cluster/components/idm/kanidm.nix
kaniop.chart
Custom chart derivation. When null, uses OCI chart.
Type: package
Default: <derivation helm-chart-oci-ghcr.io-pando85-helm-charts-kaniop-0.6.1>
Declared in: modules/lab/cluster/components/idm/kaniop.nix
kaniop.enable
Whether to enable Kaniop operator for declarative Kanidm management.
Type: boolean
Default: false
Example: true
Declared in: modules/lab/cluster/components/idm/kaniop.nix
kaniop.namespace
Namespace for Kaniop operator (same as Kanidm)
Type: string
Default: "kanidm"
Declared in: modules/lab/cluster/components/idm/kaniop.nix
kaniop.phase
Deployment phase this component belongs to
Type: string
Default: "operators"
Declared in: modules/lab/cluster/components/idm/kaniop.nix
kaniop.ref
Computed references for Kaniop
Type: attribute set
Default: { }
Declared in: modules/lab/cluster/components/idm/kaniop.nix
kaniop.version
Kaniop operator version
Type: string
Default: "0.6.1"
Declared in: modules/lab/cluster/components/idm/kaniop.nix
oidc.caSecretRef
Reference to Secret containing the OIDC issuer CA certificate
Type: null or (submodule)
Declared in: modules/lab/cluster/auth/oidc.nix
oidc.caSecretRef.key
Key within the secret
Type: string
Default: "ca.crt"
Declared in: modules/lab/cluster/auth/oidc.nix
oidc.caSecretRef.name
Secret name containing CA cert
Type: string
Declared in: modules/lab/cluster/auth/oidc.nix
oidc.caSecretRef.namespace
Secret namespace
Type: string
Declared in: modules/lab/cluster/auth/oidc.nix
oidc.clientId
OIDC client ID registered in the identity provider
Type: string
Default: "kubernetes"
Declared in: modules/lab/cluster/auth/oidc.nix
oidc.enable
Whether to enable OIDC authentication for Kubernetes API server.
Type: boolean
Default: false
Example: true
Declared in: modules/lab/cluster/auth/oidc.nix
oidc.groupsClaim
JWT claim containing group memberships
Type: string
Default: "groups"
Declared in: modules/lab/cluster/auth/oidc.nix
oidc.groupsPrefix
Prefix added to OIDC groups to avoid collisions
Type: string
Default: "oidc:"
Declared in: modules/lab/cluster/auth/oidc.nix
oidc.issuerUrl
OIDC issuer URL for the Kubernetes API server.
Use config.components.kanidm.ref.oauth2Clients.
Type: string
Default: ""
Declared in: modules/lab/cluster/auth/oidc.nix
oidc.namespace
Namespace for OIDC RBAC resources
Type: string
Default: "kube-system"
Declared in: modules/lab/cluster/auth/oidc.nix
oidc.phase
Deployment phase this component belongs to
Type: string
Default: "infrastructure"
Declared in: modules/lab/cluster/auth/oidc.nix
oidc.rbac
Map of ClusterRoleBinding name to OIDC group + ClusterRole
Type: attribute set of (submodule)
Default: { }
Declared in: modules/lab/cluster/auth/oidc.nix
oidc.rbac.<name>.clusterRole
ClusterRole to bind to the OIDC group
Type: string
Default: "cluster-admin"
Declared in: modules/lab/cluster/auth/oidc.nix
oidc.rbac.<name>.group
OIDC group name (groupsPrefix will be prepended)
Type: string
Declared in: modules/lab/cluster/auth/oidc.nix
oidc.ref
Computed references for OIDC
Type: attribute set
Default: { }
Declared in: modules/lab/cluster/auth/oidc.nix
oidc.usernameClaim
JWT claim to use as the Kubernetes username
Type: string
Default: "email"
Declared in: modules/lab/cluster/auth/oidc.nix
oidc.usernamePrefix
Prefix added to OIDC usernames to avoid collisions
Type: string
Default: "oidc:"
Declared in: modules/lab/cluster/auth/oidc.nix