jakman85andClaude Opus 4.8
5fb097d019
Add Headlamp (kubernetes-sigs/headlamp Helm chart) at headlamp.home.keithjackson.dev with native Keycloak OIDC login and PER-USER RBAC: Headlamp forwards each user's id_token to the k3s apiserver, so the existing oidc:* group bindings (platform-admins->cluster-admin, viewers->view) apply per user. The ServiceAccount is deliberately NOT bound to cluster-admin (clusterRoleBinding.create=false), since user requests ride the forwarded token. Key integration nuance: the apiserver is configured oidc-client-id=kubernetes, so it only accepts tokens whose aud contains `kubernetes`. The new `headlamp` Keycloak client carries an oidc-audience-mapper (included.client.audience= kubernetes) so tokens carry aud=[headlamp, kubernetes] -- accepted by both Headlamp's own verifier and the apiserver, leaving the apiserver config untouched. A groups mapper emits the `groups` claim the apiserver maps to RBAC. - platform/headlamp: namespace, HelmRepository/HelmRelease, SOPS OIDC secret (externalSecret envFrom), default-deny NetworkPolicy + Cilium ingress (gateway)/egress (apiserver+Keycloak) policies, README. Wired into platform/kustomization.yaml (platform tier). - platform/headlamp/httproute.yaml wired into platform-config (Gateway API CR, dependsOn platform), modeled on grafana-httproute. - keycloak-realm-import: add `headlamp` confidential client + groups/audience mappers + HEADLAMP_CLIENT_SECRET placeholder. Client also created LIVE via kcadm (realm import no-ops on the existing realm). - keycloak-realm-clients.sops: add headlamp-client-secret (mirrored into headlamp-oidc-credentials clientSecret). Both encrypted to the repo age key. Co-Authored-By: Claude Opus 4.8 <[email protected]>
46 lines
3.7 KiB
YAML
46 lines
3.7 KiB
YAML
---
|
|
# Top-level platform kustomization — the entrypoint the Flux `platform` Kustomization renders
|
|
# (clusters/base/platform.yaml, path: ./platform).
|
|
#
|
|
# UNIFIED GRAPH (R-ENV-02): dev and prod both render THIS single list; overlays differ only by
|
|
# cluster-vars. Components are enabled here PER PHASE as their phase opens (roadmap/phases.md) —
|
|
# the same pattern by which kyverno was previously deferred. Credentials each component needs are
|
|
# provisioned upfront as SOPS-encrypted Secrets (bootstrap/sops/, .sops.yaml), so enabling a
|
|
# component is never gated on a credential ask — only on its phase and readiness.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
# ---- Phase 2 — Platform Core: Network, Storage, TLS, DNS, Ingress ----
|
|
- kyverno # admission enforcer FIRST — policies present before other components reconcile
|
|
- cilium # CNI (adopts the running Ansible-installed release; parity verified)
|
|
- longhorn # replicated block storage / CSI
|
|
- external-snapshotter # CSI snapshot CRDs + snapshot-controller (VolumeSnapshot API; CDI smart-clone)
|
|
- cert-manager # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
|
|
- externaldns # auto DNS records — needs SOPS `cloudflare-api-token`
|
|
- gateway # Gateway API listeners (ingress; replaces Traefik)
|
|
- coredns # split-horizon in-cluster DNS: *.home.keithjackson.dev -> Gateway VIP (R-DNS-01/03)
|
|
# ---- Phase 3 — Egress / VPN (ADR-0015): node-level host OpenVPN split-tunnel (Ansible role
|
|
# vpn_egress_gateway) steered by a Cilium Egress Gateway policy, with a host nftables kill-switch.
|
|
# No in-cluster gateway pod (Gluetun retired). See ADR-0015 + DECISIONS-LOG "Phase 3 VPN". ----
|
|
- vpn-egress # CiliumEgressGatewayPolicy steering egress-class=vpn pods to the node tun0 (ADR-0015)
|
|
# ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ----
|
|
- monitoring # kube-prometheus-stack + Loki + Alloy + Alertmanager
|
|
# ---- Phase 6 — Identity / SSO (ADR-0014): foundational IdP, onboarded early. Keycloak Operator +
|
|
# CloudNativePG DB. Controllers here; the Keycloak/RealmImport/CNPG Cluster CRs + ServiceMonitors
|
|
# + HTTPRoutes are in platform-config (dependsOn platform). ----
|
|
# oauth2-proxy (forward-auth) is DELIBERATELY NOT here: it depends on Keycloak + trusted TLS +
|
|
# split-horizon DNS, so keeping it in this wait:true tier self-gated its own dependencies into a
|
|
# cold-start deadlock (twice). It now reconciles in its own post-platform Flux Kustomization
|
|
# (clusters/base/oauth2-proxy.yaml, dependsOn platform-config). See DECISIONS-LOG.
|
|
- cnpg # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami)
|
|
- keycloak # Keycloak Operator (quay.io images) + SOPS admin credential
|
|
- headlamp # Kubernetes dashboard — Keycloak native-OIDC login + PER-USER RBAC (ADR-0014).
|
|
# HelmRelease + SOPS OIDC credential + default-deny/Cilium policies; its
|
|
# HTTPRoute is a Gateway API CR in platform-config (dependsOn platform).
|
|
# ---- Later phases: enabled when their phase opens ----
|
|
# - velero # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
|
|
# - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate
|
|
# ---- Phase 5 — IaaS proof (KubeVirt): operator CONTROLLERS only; the KubeVirt/CDI CRs +
|
|
# ServiceMonitors/alerts/dashboard are applied by platform-config (dependsOn platform, F-MON1). ----
|
|
- kubevirt # KubeVirt + CDI operators (register kubevirt.io / cdi.kubevirt.io CRDs)
|