### Initial e2e Setup

Source: https://github.com/pando85/kaniop/blob/master/AGENTS.md

Creates a Kind cluster, builds images, and installs the operator. Run this once per session.

```bash
make e2e  # Creates Kind cluster, builds images, installs operator
```

--------------------------------

### Setup End-to-End Testing Environment

Source: https://github.com/pando85/kaniop/blob/master/AGENTS.md

Creates a Kind cluster, builds necessary images, and installs the operator for end-to-end testing.

```bash
make e2e
```

--------------------------------

### Generate Examples

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/contributing.md

Generate example manifests or configurations for Kaniop. This is useful for demonstrating usage and testing.

```bash
make examples
```

--------------------------------

### Deploy Service Account Configuration

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/quickstart.md

Apply the example configuration to create a new service account.

```bash
kubectl apply -f https://raw.githubusercontent.com/pando85/kaniop/master/examples/service-account.yaml
```

--------------------------------

### Deploy Person Account Configuration

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/quickstart.md

Apply the example configuration to create a new user account.

```bash
# Use the person example
kubectl apply -f https://raw.githubusercontent.com/pando85/kaniop/master/examples/person.yaml
```

--------------------------------

### Install Kaniop with Custom Values

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/installation.md

Installs Kaniop using Helm with a specified custom values file for configuration.

```bash
# Install with custom values
helm install --create-namespace --namespace kaniop --wait
  --values kaniop-values.yaml
  kaniop oci://ghcr.io/pando85/helm-charts/kaniop
```

--------------------------------

### Deploy Group Configuration

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/quickstart.md

Apply the example configuration to create a new group for organizing users.

```bash
# Use the group example
kubectl apply -f https://raw.githubusercontent.com/pando85/kaniop/master/examples/group.yaml
```

--------------------------------

### Deploy OAuth2 Client Configuration

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/quickstart.md

Apply the example configuration to set up an OAuth2 client for application integration.

```bash
# Use the OAuth2 client example
kubectl apply -f https://raw.githubusercontent.com/pando85/kaniop/master/examples/oauth2.yaml
```

--------------------------------

### Install and Configure Rust Toolchain

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/contributing.md

Install the latest stable Rust toolchain and its components, including rustfmt and clippy, which are essential for development and code quality checks.

```bash
rustup toolchain install stable
rustup default stable
rustup component add rustfmt clippy
```

--------------------------------

### Install Kaniop using Helm OCI Registry

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/installation.md

Installs Kaniop using the official Helm chart from an OCI registry. This command creates the namespace, deploys the operator, and waits for completion.

```bash
helm install --create-namespace --namespace kaniop --wait kaniop oci://ghcr.io/pando85/helm-charts/kaniop
```

--------------------------------

### Install Kaniop Operator with Custom Values

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Installs the Kaniop operator using a custom values file. This allows for pre-configuration of operator settings.

```bash
helm install --create-namespace --namespace kaniop --wait \
  --values kaniop-values.yaml \
  kaniop oci://ghcr.io/pando85/helm-charts/kaniop
```

--------------------------------

### Multi-Environment User Configuration (Development)

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/person.md

Example of configuring a user for a development environment, specifying a different namespace and Kanidm reference.

```yaml
# Development environment
apiVersion: kaniop.rs/v1beta1
kind: KanidmPersonAccount
metadata:
  name: alice
  namespace: identity-dev
spec:
  kanidmRef:
    name: dev-idm
  personAttributes:
    displayname: Alice Smith (Dev)
    mail:
      - alice.dev@example.com
---

```

--------------------------------

### Install cargo-edit

Source: https://github.com/pando85/kaniop/blob/master/RELEASE.md

Installs the 'cargo-edit' tool, which is required for managing dependencies.

```bash
cargo install cargo-edit
```

--------------------------------

### Create Custom Kaniop Values File

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/installation.md

Defines custom configurations for Kaniop installation, such as operator replicas and resource limits, and webhook settings.

```bash
# Create custom values file
cat > kaniop-values.yaml << EOF
operator:
  replicas: 2
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: 500m
      memory: 512Mi

webhook:
  enabled: true
  failurePolicy: Fail
EOF
```

--------------------------------

### Temporary Person Account with Expiration

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/person.md

Example of creating a temporary person account with defined start and expiration dates. Useful for contractors or interns.

```yaml
apiVersion: kaniop.rs/v1beta1
kind: KanidmPersonAccount
metadata:
  name: contractor
  namespace: default
spec:
  kanidmRef:
    name: my-idm
  personAttributes:
    displayname: Jane Contractor
    mail:
      - jane.contractor@example.com
    accountValidFrom: "2024-06-01T00:00:00Z"
    accountExpire: "2024-12-31T23:59:59Z"
```

--------------------------------

### Verify Person Account Creation and Get Credentials Link

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/quickstart.md

Check if the person account was created and retrieve the link to set user credentials.

```bash
kubectl get kanidmpersonaccounts
kubectl describe kanidmpersonaccount me
```

--------------------------------

### Complete Person Account with All Attributes

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/person.md

An extensive example demonstrating all available attributes for a person account, including legal names, aliases, lifecycle, and POSIX attributes. Labels can be used for organization.

```yaml
# Extended example based on examples/person.yaml
apiVersion: kaniop.rs/v1beta1
kind: KanidmPersonAccount
metadata:
  name: john-doe
  namespace: default
  labels:
    department: engineering
    role: senior-developer
spec:
  kanidmRef:
    name: my-idm
  personAttributes:
    displayname: John Doe
    legalname: John Michael Doe
    mail:
      - john.doe@example.com
      - j.doe@example.com # Alias
    accountValidFrom: "2024-01-01T00:00:00Z"
    accountExpire: "2025-12-31T23:59:59Z"
  posixAttributes:
    gidnumber: 1000
    loginshell: /bin/bash
```

--------------------------------

### KanidmRef Example

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Reference a Kanidm cluster by name and namespace. If namespace is omitted, it defaults to the current namespace.

```yaml
kanidmRef:
  name: my-idm
  namespace: default
```

--------------------------------

### Verify Kaniop Operator Pods

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/quickstart.md

Check if the Kaniop operator pods are in a Running state after installation.

```bash
kubectl get pods -n kaniop
# Expected output: kaniop-<release-name> pod in Running state
```

--------------------------------

### Get Events for a Resource

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Filter and retrieve events related to a specific Kanidm resource or kind in a namespace.

```bash
kubectl get events -n <namespace> --field-selector involvedObject.name=<name>
kubectl get events -n <namespace> --field-selector involvedObject.kind=Kanidm
```

--------------------------------

### Basic Service Account Configuration

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/service.md

Define a basic service account with essential attributes. Refer to the full example for all available options.

```yaml
# Basic configuration - see examples/service-account.yaml for all options
apiVersion: kaniop.rs/v1beta1
kind: KanidmServiceAccount
metadata:
  name: alice
  namespace: default
spec:
  kanidmRef:
    name: my-idm
  serviceAccountAttributes:
    displayname: Alice Smith
    entryManagedBy: admin
```

--------------------------------

### Service Account Configuration

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/person.md

Example of configuring a service account using KanidmPersonAccount. Labels are used to specify the type and purpose of the account.

```yaml
apiVersion: kaniop.rs/v1beta1
kind: KanidmPersonAccount
metadata:
  name: ci-service
  namespace: default
  labels:
    type: service-account
    purpose: ci-cd
spec:
  kanidmRef:
    name: my-idm
  personAttributes:
    displayname: CI/CD Service Account
    mail:
      - ci-cd@example.com
```

--------------------------------

### Basic KanidmGroup Configuration

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/group.md

A simple KanidmGroup configuration defining members. This serves as a foundational example for creating groups.

```yaml
# Basic configuration - see examples/group.yaml for complete setup
apiVersion: kaniop.rs/v1beta1
kind: KanidmGroup
metadata:
  name: developers
  namespace: default
spec:
  kanidmRef:
    name: my-idm
  members:
    - alice
    - bob
    - charlie
```

--------------------------------

### Full Reset of Kind Cluster

Source: https://github.com/pando85/kaniop/blob/master/AGENTS.md

Deletes the existing Kind cluster and then performs the initial e2e setup. Use this when the cluster is in a bad state.

```bash
make delete-kind && make e2e
```

--------------------------------

### Check Person Account Status with kubectl

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/person.md

Commands to list all KanidmPersonAccount resources and get detailed information about a specific person account.

```bash
kubectl get kanidmpersonaccounts
kubectl describe kanidmpersonaccount alice
```

--------------------------------

### Upgrade Kaniop using Helm

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/installation.md

Upgrades the Kaniop installation to the latest version using Helm and applies Custom Resource Definitions (CRDs).

```bash
helm upgrade --namespace kaniop --wait kaniop oci://ghcr.io/pando85/helm-charts/kaniop
helm show crds oci://ghcr.io/pando85/helm-charts/kaniop | kubectl apply --server-side \
  --force-conflicts -f -
```

--------------------------------

### Basic Kanidm Cluster Configuration

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/kanidm.md

A minimal Kanidm cluster configuration using the Kanidm CRD. This example defines the cluster name and domain, and specifies one replica in the default replica group. It requires a TLS certificate named 'my-idm-tls'.

```yaml
apiVersion: kaniop.rs/v1beta1
kind: Kanidm
metadata:
  name: my-idm
spec:
  domain: my-idm.localhost
  replicaGroups:
    - name: default
      replicas: 1
```

--------------------------------

### Get Resource Status JSONPath

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Retrieve specific status fields from Kanidm resources using JSONPath.

```bash
kubectl get kanidm <name> -n <namespace> -o jsonpath='{.status.conditions}'
kubectl get kanidmpersonaccount <name> -n <namespace> -o jsonpath='{.status.ready}'
```

--------------------------------

### Department-Based Person Account Organization

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/person.md

Example of organizing person accounts using Kubernetes labels to denote department, team, and level. This aids in filtering and management.

```yaml
apiVersion: kaniop.rs/v1beta1
kind: KanidmPersonAccount
metadata:
  name: engineering-alice
  namespace: default
  labels:
    department: engineering
    team: backend
    level: senior
spec:
  kanidmRef:
    name: my-idm
  personAttributes:
    displayname: Alice Smith
    mail:
      - alice.smith@example.com
```

--------------------------------

### Preview Documentation Book

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/contributing.md

Build and preview the project's documentation book locally. This allows you to check how your documentation changes will appear.

```bash
make book
```

--------------------------------

### Build and Test the Project

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/contributing.md

Build the Kaniop project and run its unit tests. These commands are part of the standard development workflow.

```bash
make build
make test
```

--------------------------------

### Build and Push Multi-Arch Images

Source: https://github.com/pando85/kaniop/blob/master/AGENTS.md

Builds and pushes multi-architecture images (amd64, arm64) for the project.

```bash
make push-images
```

--------------------------------

### Deploy Basic Kanidm Cluster

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/quickstart.md

Apply the basic Kanidm cluster configuration files. This sets up the core Kanidm deployment.

```bash
# Use the basic Kanidm example
kubectl apply -f https://raw.githubusercontent.com/pando85/kaniop/master/examples/kanidm-tls.yaml
kubectl apply -f https://raw.githubusercontent.com/pando85/kaniop/master/examples/kanidm.yaml
```

--------------------------------

### Run Unit Tests

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/contributing.md

Execute the unit tests for the Kaniop project. This is a quick way to verify individual components.

```bash
make test
```

--------------------------------

### Build Local Images

Source: https://github.com/pando85/kaniop/blob/master/AGENTS.md

Builds single-architecture local images for the project.

```bash
make images
```

--------------------------------

### Verify Service Account Creation

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/quickstart.md

Confirm that the service account resource has been successfully created.

```bash
kubectl get kanidmserviceaccounts
```

--------------------------------

### List All Kanidm Resources

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Use kubectl to list all resources of a specific Kanidm type across all namespaces.

```bash
kubectl get kanidms -A
kubectl get kanidmpersonaccounts -A
kubectl get kanidmgroups -A
kubectl get kanidmoauth2clients -A
kubectl get kanidmserviceaccounts -A
```

--------------------------------

### Build Debug Binaries

Source: https://github.com/pando85/kaniop/blob/master/AGENTS.md

Builds the debug versions of the kaniop and kaniop-webhook binaries.

```bash
make build
```

--------------------------------

### Describe Kanidm Resource

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Use kubectl describe to inspect a specific Kanidm resource and its status in a given namespace.

```bash
kubectl describe kanidm <name> -n <namespace>
kubectl describe kanidmpersonaccount <name> -n <namespace>
```

--------------------------------

### Build Optimized Release Binaries

Source: https://github.com/pando85/kaniop/blob/master/AGENTS.md

Builds optimized release binaries for the project.

```bash
make release
```

--------------------------------

### Clone the Kaniop Repository

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/contributing.md

Clone the official Kaniop repository to your local machine. Ensure you replace `<your-username>` with your GitHub username.

```bash
git clone https://github.com/<your-username>/kaniop.git
cd kaniop
```

--------------------------------

### Verify Group Creation

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/quickstart.md

Confirm that the group resource has been successfully created.

```bash
kubectl get kanidmgroups
```

--------------------------------

### Create a Feature Branch

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/contributing.md

Before making changes, create a new branch for your feature. Replace `your-feature-name` with a descriptive name for your changes.

```bash
git checkout -b feature/your-feature-name
```

--------------------------------

### Describe KanidmPersonAccount Resource

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/person.md

Use this command to check the status and conditions of a KanidmPersonAccount resource, useful for troubleshooting account creation issues.

```bash
kubectl describe kanidmpersonaccount alice
```

--------------------------------

### View Kanidm Deployment Logs

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Stream logs from the Kanidm deployment or specific Kanidm pods.

```bash
kubectl logs -f deployment/kaniop -n kaniop
kubectl logs pod/<kanidm-name>-<replica-group>-0 -n <namespace>
```

--------------------------------

### Wait for Kanidm StatefulSet and Pods

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/quickstart.md

Monitor the Kanidm StatefulSet and wait for its pods to become ready, ensuring the cluster is operational.

```bash
kubectl get statefulsets -l kanidm.kaniop.rs/cluster=my-idm
kubectl wait --for=condition=ready pod -l kanidm.kaniop.rs/cluster=my-idm --timeout=300s
```

--------------------------------

### Run Integration Tests

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/contributing.md

Execute integration tests for Kaniop. These tests require a running Kubernetes cluster to interact with.

```bash
make integration-test
```

--------------------------------

### View Operator Logs

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/troubleshooting.md

Retrieve the logs for the Kaniop deployment in the 'kaniop' namespace to identify potential errors.

```bash
kubectl logs deployment/kaniop -n kaniop
```

--------------------------------

### Run Clippy for Linting

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/contributing.md

Execute Clippy to enforce coding standards and catch potential issues. All Clippy warnings must be resolved before merging code.

```bash
make lint
```

--------------------------------

### Execute Release Script

Source: https://github.com/pando85/kaniop/blob/master/RELEASE.md

This script is used to manage the release workflow. Ensure you are in the project root directory before execution.

```bash
.ci/release.sh
```

--------------------------------

### Port-forward to Kanidm Instance

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/quickstart.md

Forward local port 8443 to the Kanidm service for browser access.

```bash
kubectl port-forward svc/my-idm 8443:8443 -n default
```

--------------------------------

### Apply Person Account Changes with kubectl

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/person.md

Command to apply Kubernetes manifests for person accounts. Ensure your YAML file is correctly named and located.

```bash
kubectl apply -f person.yaml
```

--------------------------------

### Test and Lint Changes

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/contributing.md

After making changes, run tests and linting to ensure code quality and correctness. This includes running standard tests and code style checks.

```bash
make test
make lint
```

--------------------------------

### Verify OAuth2 Client Creation

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/quickstart.md

Check if the OAuth2 client resource has been successfully created in the cluster.

```bash
kubectl get kanidmoauth2clients
```

--------------------------------

### Test a Single E2E Test

Source: https://github.com/pando85/kaniop/blob/master/AGENTS.md

Runs a specific end-to-end test after the cluster has been created with 'make e2e'.

```bash
RUST_TEST_THREADS=16 cargo test -p kaniop-e2e-tests --features e2e-test <test_name>
```

--------------------------------

### Basic Person Account Configuration

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/person.md

A minimal configuration for a person account. Ensure the 'kanidmRef' points to your Kanidm cluster.

```yaml
apiVersion: kaniop.rs/v1beta1
kind: KanidmPersonAccount
metadata:
  name: alice
  namespace: default
spec:
  kanidmRef:
    name: my-idm
  personAttributes:
    displayname: Alice Smith
    mail:
      - alice@example.com
```

--------------------------------

### Run End-to-End Tests

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/contributing.md

Perform end-to-end testing of Kaniop, including the deployment of Kanidm. This provides a comprehensive test of the operator's functionality.

```bash
make e2e-test
```

--------------------------------

### Describe Custom Resource

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/troubleshooting.md

Inspect the status and events of a specific Custom Resource (CR) to find reconciliation errors. Replace <kind> and <name> with your CR's details.

```bash
kubectl describe <kind> <name>
```

--------------------------------

### Upgrade Dependencies

Source: https://github.com/pando85/kaniop/blob/master/RELEASE.md

Upgrades project dependencies to their latest compatible versions. Use '--incompatible' for potentially breaking changes.

```bash
cargo upgrade
```

```bash
cargo upgrade --incompatible
```

--------------------------------

### Basic KanidmOAuth2Client Configuration

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/oauth2.md

Defines a basic OAuth2 client registration. This resource will create a corresponding client secret for application integration.

```yaml
apiVersion: kaniop.rs/v1beta1
kind: KanidmOAuth2Client
metadata:
  name: my-webapp
  namespace: default
spec:
  kanidmRef:
    name: my-idm
  displayName: My Web Application
  origin: https://myapp.example.com
  redirectUrl:
    - https://myapp.example.com/oauth2/callback
```

--------------------------------

### Enable Webhook with Built-in Certificate Generation

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/webhook.md

Enable the webhook deployment and its built-in certificate generation feature. This configuration is suitable when not using cert-manager.

```yaml
webhook:
  enabled: true
  patch:
    enabled: true
  certManager:
    enabled: false
```

--------------------------------

### Organize Rust Imports

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/contributing.md

Follow the specified import organization for Rust code. Imports should be grouped by origin: crate, internal, standard library, and external crates.

```rust
// Crate imports
use crate::crd::KanidmPerson;

// Internal crates
use kaniop_operator::reconcile;

// Standard library
use std::collections::HashMap;
use std::sync::Arc;

// External crates
use anyhow::Context;
use kube::Client;
```

--------------------------------

### Enable Metrics and ServiceMonitor with Helm

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Enables metrics collection and the ServiceMonitor resource for Prometheus integration. Requires Prometheus Operator CRDs.

```bash
helm upgrade --namespace kaniop --wait kaniop oci://ghcr.io/pando85/helm-charts/kaniop \
  --set metrics.enabled=true \
  --set metrics.serviceMonitor.enabled=true
```

--------------------------------

### Kanidm Custom CSS ConfigMap

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/kanidm.md

Create a ConfigMap to store your custom CSS. This ConfigMap will be mounted into the Kanidm pods.

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: kanidm-custom-css
  namespace: default
data:
  override.css: |
    /* Custom styling */
    body {
      background-color: #f5f5f5;
    }
    .kanidm_header {
      background-color: #2c3e50;
      color: #ecf0f1;
    }
```

--------------------------------

### Explain Kaniop CRD Schemas

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Uses `kubectl explain` to retrieve detailed schema information for Kaniop Custom Resource Definitions (CRDs). This is essential for understanding required fields, defaults, and validation rules.

```bash
kubectl explain kanidm.spec --api-version=kaniop.rs/v1beta1 --recursive
kubectl explain kanidmpersonaccount.spec --api-version=kaniop.rs/v1beta1 --recursive
kubectl explain kanidmgroup.spec --api-version=kaniop.rs/v1beta1 --recursive
kubectl explain kanidmoauth2client.spec --api-version=kaniop.rs/v1beta1 --recursive
kubectl explain kanidmserviceaccount.spec --api-version=kaniop.rs/v1beta1 --recursive
```

--------------------------------

### Helm Chart Unit Testing

Source: https://github.com/pando85/kaniop/blob/master/AGENTS.md

Verifies Helm chart templates using unit tests. This command should be run after making changes to chart values, schemas, or templates.

```bash
helm unittest charts/kaniop
```

--------------------------------

### Tail Operator Logs

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/troubleshooting.md

Continuously stream logs from the Kaniop operator deployment in the 'kaniop' namespace for real-time insights.

```bash
kubectl logs -f deployment/kaniop -n kaniop
```

--------------------------------

### Apply Group Changes with kubectl

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/group.md

Applies group configuration changes defined in a YAML file to the Kanidm system using kubectl.

```bash
kubectl apply -f group.yaml
```

--------------------------------

### Clean E2E Resources

Source: https://github.com/pando85/kaniop/blob/master/AGENTS.md

Cleans up end-to-end testing resources but keeps the Kind cluster intact.

```bash
make clean-e2e
```

--------------------------------

### Commit and Push Changes

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/contributing.md

Commit your changes using the Conventional Commits format and push them to your feature branch. This prepares your changes for a pull request.

```bash
git commit -m "feat: add new feature description"
git push origin feature/your-feature-name
```

--------------------------------

### Verify Kaniop Operator Deployment

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Checks the status of Kaniop operator pods, retrieves logs, and lists events in the 'kaniop' namespace.

```bash
kubectl get pods -n kaniop
kubectl logs -f deployment/kaniop -n kaniop
kubectl get events -n kaniop
```

--------------------------------

### Enable Webhook Validation with Helm

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Enables the webhook validation feature for the Kaniop operator by setting the corresponding Helm value.

```bash
helm upgrade --namespace kaniop --wait kaniop oci://ghcr.io/pando85/helm-charts/kaniop \
  --set webhook.enabled=true
```

--------------------------------

### Check Operator Pod Status

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/troubleshooting.md

Verify that the Kaniop operator pod is running and healthy in the 'kaniop' namespace.

```bash
kubectl get pods -n kaniop
```

--------------------------------

### Monitor Person Account Events with kubectl

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/person.md

Command to monitor Kubernetes events related to a specific person account, useful for debugging.

```bash
kubectl get events --field-selector involvedObject.name=alice
```

--------------------------------

### Uninstall Kaniop using Helm

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/installation.md

Removes Kaniop and all associated Kanidm resources from the cluster using Helm.

```bash
helm uninstall --namespace kaniop kaniop
helm show crds oci://ghcr.io/pando85/helm-charts/kaniop | kubectl delete -f -
```

--------------------------------

### Discover Helm Chart Values and CRDs

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Retrieves available Helm values and CRD definitions for the Kaniop chart. Useful for understanding configuration options and resource structures.

```bash
helm show values oci://ghcr.io/pando85/helm-charts/kaniop
helm show crds oci://ghcr.io/pando85/helm-charts/kaniop
```

--------------------------------

### Check Cluster Events

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/troubleshooting.md

Retrieve all cluster events, sorted by creation timestamp, to identify system-level issues.

```bash
kubectl get events --sort-by '.metadata.creationTimestamp'
```

--------------------------------

### Force Kanidm Resource Reconciliation

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Trigger a manual reconciliation for a Kanidm resource by annotating it with a force-update timestamp.

```bash
kubectl annotate <kind> <name> -n <namespace> kanidm/force-update="$(date -u +%Y-%m-%dT%H:%M:%SZ)" --overwrite
```

--------------------------------

### Rapid Iteration for E2E Testing

Source: https://github.com/pando85/kaniop/blob/master/AGENTS.md

Rebuilds the operator and reloads it into the Kind cluster for rapid iteration during e2e testing.

```bash
make update-e2e-kaniop
```

--------------------------------

### Cross-Namespace Selectors

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Configure selectors on the Kanidm resource to enable cross-namespace operations for identity resources. An empty selector `{}` selects all namespaces.

```yaml
spec:
  personNamespaceSelector: {}
  groupNamespaceSelector: {}
  oauth2ClientNamespaceSelector: {}
  serviceAccountNamespaceSelector: {}
```

--------------------------------

### Rapid Iteration Cycle

Source: https://github.com/pando85/kaniop/blob/master/AGENTS.md

After code changes, rebuild and reload the operator into the cluster. This is followed by running specific or all e2e tests.

```bash
# After code changes, rebuild and reload operator into cluster
make update-e2e-kaniop

# Run a specific test
RUST_TEST_THREADS=16 cargo test -p kaniop-e2e-tests --features e2e-test <test_name>

# Or run all e2e tests
make e2e-test
```

--------------------------------

### KanidmGroup with Email Aliases

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/group.md

Configures a KanidmGroup with email aliases, enabling mailing list functionality. The first email address listed is designated as the primary.

```yaml
apiVersion: kaniop.rs/v1beta1
kind: KanidmGroup
metadata:
  name: engineering-team
  namespace: default
spec:
  kanidmRef:
    name: my-idm
  members:
    - alice
    - bob
  mail:
    - engineering@example.com
    - dev-team@example.com
```

--------------------------------

### Retrieve Kanidm Admin Passwords from Secret

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Decode and retrieve the Kanidm admin and idm_admin passwords from the default secrets.

```bash
# Kanidm admin password, current default name and key
kubectl get secret <kanidm-name>-admin-passwords -n <namespace> -o jsonpath='{.data.ADMIN_PASSWORD}' | base64 -d

# Kanidm idm_admin password, current default name and key
kubectl get secret <kanidm-name>-admin-passwords -n <namespace> -o jsonpath='{.data.IDM_ADMIN_PASSWORD}' | base64 -d
```

--------------------------------

### Update Version Across Workspace and Helm Chart

Source: https://github.com/pando85/kaniop/blob/master/AGENTS.md

Updates the version number across the entire workspace and the Helm chart.

```bash
make update-version
```

--------------------------------

### KanidmGroup with POSIX Attributes

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/group.md

Configures a KanidmGroup with POSIX attributes, specifically a `gidnumber` for file system permissions. If `gidnumber` is omitted, Kanidm will auto-generate one.

```yaml
apiVersion: kaniop.rs/v1beta1
kind: KanidmGroup
metadata:
  name: sysadmins
  namespace: default
spec:
  kanidmRef:
    name: my-idm
  members:
    - alice
  posixAttributes:
    gidnumber: 1001
```

--------------------------------

### Production KanidmPersonAccount Definition

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/person.md

Defines a KanidmPersonAccount resource for a production environment, specifying the Kanidm instance and person attributes.

```yaml
apiVersion: kaniop.rs/v1beta1
kind: KanidmPersonAccount
metadata:
  name: alice
  namespace: identity-prod
spec:
  kanidmRef:
    name: prod-idm
  personAttributes:
    displayname: Alice Smith
    mail:
      - alice@example.com
```

--------------------------------

### Cleanup Leftover Test Resources

Source: https://github.com/pando85/kaniop/blob/master/AGENTS.md

Removes leftover test resources without deleting the cluster. Use this when tests fail with 'already exists' errors.

```bash
# Clean up leftover test resources but keep cluster running
make clean-e2e
```

--------------------------------

### Future-Dated Person Account Activation

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/person.md

Configuration for a person account that will become active on a specified future date using 'accountValidFrom'.

```yaml
apiVersion: kaniop.rs/v1beta1
kind: KanidmPersonAccount
metadata:
  name: new-hire
  namespace: default
spec:
  kanidmRef:
    name: my-idm
  personAttributes:
    displayname: New Employee
    mail:
      - new.employee@example.com
    accountValidFrom: "2024-09-15T09:00:00Z"
```

--------------------------------

### Delete Specific Leftover Resources

Source: https://github.com/pando85/kaniop/blob/master/AGENTS.md

Manually deletes specific Kubernetes resources that might be causing conflicts. Use for targeted cleanup.

```bash
kubectl delete kanidmgroup <name> -n default --ignore-not-found=true
kubectl delete kanidmpersonaccount <name> -n default --ignore-not-found=true
kubectl delete kanidmoauth2client <name> -n default --ignore-not-found=true
kubectl delete kanidmserviceaccount <name> -n default --ignore-not-found=true
kubectl delete kanidm <name> -n default --ignore-not-found=true
```

--------------------------------

### Retrieve Service Account Password from Secret

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Decode and retrieve the generated service account password from its default secret.

```bash
# Service account generated password, current default name and key
kubectl get secret <name>-kanidm-service-account-credentials -n <namespace> -o jsonpath='{.data.password}' | base64 -d
```

--------------------------------

### Check Group Status with kubectl

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/group.md

Retrieves the status of KanidmGroups and describes a specific group using kubectl commands.

```bash
kubectl get kanidmgroups
kubectl describe kanidmgroup developers
```

--------------------------------

### Retrieve Service Account API Token from Secret

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Decode and retrieve the service account API token from its default secret.

```bash
# Service account API token, current default name and key
kubectl get secret <name>-<label>-api-token -n <namespace> -o jsonpath='{.data.token}' | base64 -d
```

--------------------------------

### Reference ConfigMap in Kanidm CR

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/kanidm.md

Reference the created ConfigMap in your Kanidm Custom Resource to apply the custom CSS. This involves defining volumes and volume mounts.

```yaml
apiVersion: kaniop.rs/v1beta1
kind: Kanidm
metadata:
  name: my-idm
spec:
  domain: idm.example.com
  replicaGroups:
    - name: default
      replicas: 1
  volumes:
    - name: custom-css
      configMap:
        name: kanidm-custom-css
  volumeMounts:
    - name: custom-css
      mountPath: /hpkg/override.css
      subPath: override.css
```

--------------------------------

### Kanidm Cluster with Security Context Configuration

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/kanidm.md

A Kanidm cluster configuration enhanced with security contexts to comply with Kubernetes Pod Security Standards at the restricted level. This includes pod-level, container-level, and init container-level security settings for enhanced security.

```yaml
apiVersion: kaniop.rs/v1beta1
kind: Kanidm
metadata:
  name: my-idm
spec:
  domain: my-idm.localhost
  replicaGroups:
    - name: default
      replicas: 1
  # Pod-level security context
  securityContext:
    runAsNonRoot: true
    runAsUser: 389
    runAsGroup: 389
    fsGroup: 389
    seccompProfile:
      type: RuntimeDefault
  # Container-level security context
  containers:
    - name: kanidm
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL
  # Init container security context
  initContainers:
    - name: kanidm-generate-replication-config
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL
```

--------------------------------

### Inspect KanidmPersonAccount Credential Reset Events

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Retrieve detailed information about a KanidmPersonAccount or filter events related to credential resets for a specific person account. This helps in debugging credential management issues.

```bash
kubectl describe kanidmpersonaccount <name> -n <namespace>
kubectl get events -n <namespace> --field-selector involvedObject.kind=KanidmPersonAccount,involvedObject.name=<name>
```

--------------------------------

### POSIX Account Attributes Configuration

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/usage/person.md

Configuration for POSIX attributes, which are essential for systems requiring SSH and filesystem access. 'gidnumber' can be auto-generated if omitted.

```yaml
# POSIX configuration from examples/person.yaml
posixAttributes:
  gidnumber: 1000 # Auto-generated if omitted
  loginshell: /bin/bash
```

--------------------------------

### Update Cargo Lock Dependencies

Source: https://github.com/pando85/kaniop/blob/master/RELEASE.md

Updates the 'Cargo.lock' file to reflect the latest dependency versions allowed by 'Cargo.toml'.

```bash
cargo update
```

--------------------------------

### Uninstall Kaniop Helm Chart

Source: https://github.com/pando85/kaniop/blob/master/charts/kaniop/README.md

Uninstalls the Kaniop operator and removes all associated Kubernetes components.

```bash
helm uninstall kaniop
```

--------------------------------

### Upgrade Kaniop CRDs and Operator

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

First upgrades the Custom Resource Definitions (CRDs) and then upgrades the Kaniop operator. This ensures compatibility between the operator and its resources.

```bash
helm show crds oci://ghcr.io/pando85/helm-charts/kaniop | kubectl apply --server-side --force-conflicts -f -
helm upgrade --namespace kaniop --wait kaniop oci://ghcr.io/pando85/helm-charts/kaniop
```

--------------------------------

### Delete Kind Cluster

Source: https://github.com/pando85/kaniop/blob/master/AGENTS.md

Completely deletes the Kind cluster used for testing.

```bash
make delete-kind
```

--------------------------------

### Wait for Kanidm Cluster Availability

Source: https://github.com/pando85/kaniop/blob/master/Documentation/llm.txt

Use kubectl to check the status of Kanidm clusters and wait for them to become available. This is useful after deployment or scaling operations.

```bash
kubectl get kanidms -A
kubectl describe kanidm <name> -n <namespace>
kubectl wait kanidm/<name> -n <namespace> --for=condition=Available --timeout=300s
```

--------------------------------

### Kanidm Cluster Reference

Source: https://github.com/pando85/kaniop/blob/master/Documentation/src/concepts.md

Specifies the Kanidm cluster to which an identity object belongs. Ensure the referenced Kanidm resource exists in the same or a specified namespace.

```yaml
kanidmRef:
  name: my-idm # The name of the Kanidm resource in the same namespace
  # namespace: default  # Optional if cross-namespace references are allowed
```