jakman85andClaude Opus 4.8
5fb097d019
Add Headlamp (kubernetes-sigs/headlamp Helm chart) at headlamp.home.keithjackson.dev with native Keycloak OIDC login and PER-USER RBAC: Headlamp forwards each user's id_token to the k3s apiserver, so the existing oidc:* group bindings (platform-admins->cluster-admin, viewers->view) apply per user. The ServiceAccount is deliberately NOT bound to cluster-admin (clusterRoleBinding.create=false), since user requests ride the forwarded token. Key integration nuance: the apiserver is configured oidc-client-id=kubernetes, so it only accepts tokens whose aud contains `kubernetes`. The new `headlamp` Keycloak client carries an oidc-audience-mapper (included.client.audience= kubernetes) so tokens carry aud=[headlamp, kubernetes] -- accepted by both Headlamp's own verifier and the apiserver, leaving the apiserver config untouched. A groups mapper emits the `groups` claim the apiserver maps to RBAC. - platform/headlamp: namespace, HelmRepository/HelmRelease, SOPS OIDC secret (externalSecret envFrom), default-deny NetworkPolicy + Cilium ingress (gateway)/egress (apiserver+Keycloak) policies, README. Wired into platform/kustomization.yaml (platform tier). - platform/headlamp/httproute.yaml wired into platform-config (Gateway API CR, dependsOn platform), modeled on grafana-httproute. - keycloak-realm-import: add `headlamp` confidential client + groups/audience mappers + HEADLAMP_CLIENT_SECRET placeholder. Client also created LIVE via kcadm (realm import no-ops on the existing realm). - keycloak-realm-clients.sops: add headlamp-client-secret (mirrored into headlamp-oidc-credentials clientSecret). Both encrypted to the repo age key. Co-Authored-By: Claude Opus 4.8 <[email protected]>
37 lines
2.1 KiB
Plaintext
37 lines
2.1 KiB
Plaintext
# =============================================================================
|
|
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize and never
|
|
# auto-encrypted by SOPS). Reference scaffold + OPERATOR HAND-OFF.
|
|
#
|
|
# WHAT THIS IS: the OIDC config Headlamp uses to authenticate against the Keycloak `homelab` realm's
|
|
# `headlamp` client. The Headlamp chart's `config.oidc.externalSecret` (helmrelease.yaml) envFrom's
|
|
# THIS Secret, so ALL OIDC env (clientID/clientSecret/issuerURL/scopes/callbackURL) live here,
|
|
# SOPS-encrypted, referenced by name only (R-IDP-04). The chart maps these keys to the container's
|
|
# OIDC_CLIENT_ID / OIDC_CLIENT_SECRET / OIDC_ISSUER_URL / OIDC_SCOPES / OIDC_CALLBACK_URL env vars.
|
|
#
|
|
# The `clientSecret` value MUST equal the `headlamp-client-secret` placed in
|
|
# platform/keycloak/keycloak-realm-clients.sops.yaml (which the realm import injects into the
|
|
# Keycloak `headlamp` client) — same cross-namespace mirror pattern as grafana/gitea (a Secret
|
|
# cannot be shared across namespaces, so the one value is stored in two encrypted files).
|
|
#
|
|
# HAND-OFF STEPS (operator):
|
|
# (a) Use the SAME headlamp-client-secret generated for keycloak-realm-clients (openssl rand -hex 32).
|
|
# (b) Copy to: platform/headlamp/headlamp-oidc-credentials.sops.yaml
|
|
# (c) Fill `clientSecret`; encrypt:
|
|
# sops -e -i platform/headlamp/headlamp-oidc-credentials.sops.yaml
|
|
# (d) It is already listed under `resources:` in platform/headlamp/kustomization.yaml.
|
|
# =============================================================================
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: headlamp-oidc
|
|
namespace: headlamp
|
|
type: Opaque
|
|
stringData:
|
|
# Non-secret OIDC config (kept in the encrypted Secret because the chart envFrom's a single Secret).
|
|
clientID: headlamp
|
|
issuerURL: https://keycloak.home.keithjackson.dev/realms/homelab
|
|
scopes: "openid email profile"
|
|
callbackURL: https://headlamp.home.keithjackson.dev/oidc-callback
|
|
# The confidential client secret — MUST match keycloak-realm-clients headlamp-client-secret.
|
|
clientSecret: REPLACE-ME
|