jakman85andClaude Opus 4.8
5fb097d019
Add Headlamp (kubernetes-sigs/headlamp Helm chart) at headlamp.home.keithjackson.dev with native Keycloak OIDC login and PER-USER RBAC: Headlamp forwards each user's id_token to the k3s apiserver, so the existing oidc:* group bindings (platform-admins->cluster-admin, viewers->view) apply per user. The ServiceAccount is deliberately NOT bound to cluster-admin (clusterRoleBinding.create=false), since user requests ride the forwarded token. Key integration nuance: the apiserver is configured oidc-client-id=kubernetes, so it only accepts tokens whose aud contains `kubernetes`. The new `headlamp` Keycloak client carries an oidc-audience-mapper (included.client.audience= kubernetes) so tokens carry aud=[headlamp, kubernetes] -- accepted by both Headlamp's own verifier and the apiserver, leaving the apiserver config untouched. A groups mapper emits the `groups` claim the apiserver maps to RBAC. - platform/headlamp: namespace, HelmRepository/HelmRelease, SOPS OIDC secret (externalSecret envFrom), default-deny NetworkPolicy + Cilium ingress (gateway)/egress (apiserver+Keycloak) policies, README. Wired into platform/kustomization.yaml (platform tier). - platform/headlamp/httproute.yaml wired into platform-config (Gateway API CR, dependsOn platform), modeled on grafana-httproute. - keycloak-realm-import: add `headlamp` confidential client + groups/audience mappers + HEADLAMP_CLIENT_SECRET placeholder. Client also created LIVE via kcadm (realm import no-ops on the existing realm). - keycloak-realm-clients.sops: add headlamp-client-secret (mirrored into headlamp-oidc-credentials clientSecret). Both encrypted to the repo age key. Co-Authored-By: Claude Opus 4.8 <[email protected]>
36 lines
1.3 KiB
YAML
36 lines
1.3 KiB
YAML
---
|
|
# North-south ingress for Headlamp at headlamp.home.keithjackson.dev. Attaches to the shared Gateway
|
|
# (docs/09); TLS terminated at the Gateway by the *.home.keithjackson.dev wildcard cert (already
|
|
# covers this host). Same-namespace backend, so no ReferenceGrant is needed; the parentRef is
|
|
# permitted because the headlamp namespace carries gateway-access=shared. CR of the Gateway API CRDs
|
|
# — CARRIED BY platform-config (dependsOn platform) so the CRDs exist first (like grafana-httproute).
|
|
#
|
|
# auth-mode annotation records that Headlamp authenticates via native Keycloak OIDC (R-IDP-02); this
|
|
# route is NOT protected by oauth2-proxy forward-auth (Headlamp runs its own OIDC login + per-user
|
|
# token forwarding), so it must NOT carry an oauth2-proxy ExtAuth filter.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: headlamp
|
|
namespace: headlamp
|
|
labels:
|
|
app.kubernetes.io/name: headlamp
|
|
annotations:
|
|
homelab.keithjackson.dev/auth-mode: oidc
|
|
homelab.keithjackson.dev/auth-groups: platform-admins
|
|
spec:
|
|
parentRefs:
|
|
- name: shared
|
|
namespace: gateway
|
|
sectionName: https
|
|
hostnames:
|
|
- headlamp.home.keithjackson.dev
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
backendRefs:
|
|
- name: headlamp
|
|
port: 80
|