jakman85andClaude Opus 4.8
ebe0371b1b
Headlamp's HelmRelease sat in the wait:true `platform` Flux tier. Its pod crashlooped (`flag provided but not defined: -session-ttl` — chart 0.40.1 renders a container arg the appVersion v0.40.1 backend lacks; upstream kubernetes-sigs/headlamp#4883), and because it gated `platform`, the whole chain stalled: platform Ready=Unknown -> platform-config, oauth2-proxy, apps-wave-0/1/2 and apps-vms all Ready=False "dependency not ready". Part A (unblock + durable lesson): a leaf UI must never gate the chain. Move all Headlamp resources into a new non-gating Flux Kustomization clusters/base/headlamp.yaml (dependsOn platform-config, wait:false, SOPS decryption patched per-env in clusters/dev) — mirroring oauth2-proxy exactly. The new Kustomization owns the whole platform/headlamp component; its HTTPRoute moves from platform-config into platform/headlamp/kustomization.yaml. Removed headlamp from platform/kustomization.yaml and its httproute from platform-config/kustomization.yaml. Now a crashlooping Headlamp can never stall platform/platform-config/apps. Part B (make it start): pin the chart to 0.41.0 (`>=0.41.0 <0.42.0`). The backend added `f.Int("session-ttl", …)` in v0.41.0 and chart 0.41.0 pins that same image (appVersion == chart version), so chart+image realign; every arg the chart renders for our values is supported. OIDC config + per-user RBAC (clusterRoleBinding.create:false) unchanged. Gate: `make -C ci gate` PASS. Co-Authored-By: Claude Opus 4.8 <[email protected]>
96 lines
4.9 KiB
YAML
96 lines
4.9 KiB
YAML
---
|
|
# Headlamp — the Kubernetes web dashboard, served at headlamp.home.keithjackson.dev with Keycloak
|
|
# native-OIDC login and PER-USER RBAC (ADR-0014, docs/15). Official kubernetes-sigs/headlamp Helm
|
|
# chart via a Flux HelmRelease (same pattern as platform/monitoring's kube-prometheus-stack).
|
|
#
|
|
# ── PER-USER RBAC (the whole point) ────────────────────────────────────────────────────────────
|
|
# Headlamp is configured for OIDC, so its backend forwards the LOGGED-IN USER's OIDC id_token as the
|
|
# bearer to the k3s API server. The apiserver validates that token (oidc-issuer-url = this realm,
|
|
# oidc-client-id=kubernetes, oidc-username-claim=email, oidc-groups-claim=groups; see
|
|
# infra/ansible roles/k3s_server) and RBAC is applied per user via the EXISTING group bindings
|
|
# (platform/keycloak/k8s-oidc-rbac.yaml: oidc:platform-admins -> cluster-admin, oidc:viewers -> view).
|
|
# So every user gets exactly their own rights — NOT a shared identity.
|
|
#
|
|
# clusterRoleBinding.create=false ← DELIBERATE. The default chart binds Headlamp's ServiceAccount
|
|
# to cluster-admin; that would let the backend act as cluster-admin. We do NOT want that: user
|
|
# requests ride the user's forwarded id_token, so the SA needs no cluster rights. Removing the
|
|
# binding means an unauthenticated backend can do nothing — the secure posture for per-user RBAC.
|
|
#
|
|
# ── AUDIENCE NUANCE ─────────────────────────────────────────────────────────────────────────────
|
|
# The apiserver only accepts ID tokens whose `aud` CONTAINS `kubernetes` (oidc-client-id=kubernetes).
|
|
# A `headlamp` client would issue aud=[headlamp]. The Keycloak `headlamp` client therefore carries an
|
|
# AUDIENCE protocol mapper that ADDS `kubernetes` to the token audience (keycloak-realm-import.yaml),
|
|
# giving aud=[headlamp, kubernetes]: Headlamp's own verifier accepts it (aud contains headlamp) AND
|
|
# the apiserver accepts it (aud contains kubernetes). This keeps the apiserver config untouched.
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: headlamp
|
|
namespace: headlamp
|
|
spec:
|
|
interval: 30m
|
|
chart:
|
|
spec:
|
|
chart: headlamp
|
|
# 0.41.x, NOT 0.40.x. Chart 0.40.1 shipped the `-session-ttl=86400` container arg BEFORE the
|
|
# backend flag existed: its image (appVersion v0.40.1) has no `session-ttl` flag, so the pod
|
|
# crashlooped with `flag provided but not defined: -session-ttl` (upstream issue #4883). The
|
|
# backend gained `f.Int("session-ttl", …)` in v0.41.0, and chart 0.41.0 pins that same image
|
|
# (appVersion == chart version), so chart+image realign: every arg the chart renders for our
|
|
# values (-session-ttl + the -oidc-* args from the externalSecret; useCookie stays default-false
|
|
# so `-oidc-use-cookie` is NOT emitted) is supported by the v0.41.0 backend. Renovate maintains
|
|
# within 0.41.x; the appVersion continues to pin the Headlamp image.
|
|
version: ">=0.41.0 <0.42.0"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: headlamp
|
|
namespace: headlamp
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
replicaCount: 1
|
|
# In-cluster mode: Headlamp discovers the apiserver from the pod's in-cluster config, then
|
|
# OVERRIDES the bearer with the user's OIDC id_token for authenticated requests.
|
|
config:
|
|
inCluster: true
|
|
oidc:
|
|
# OIDC config (clientID / clientSecret / issuerURL / scopes / callbackURL) is supplied via an
|
|
# EXISTING SOPS-encrypted Secret consumed by name only (R-IDP-04) — the chart envFrom's it.
|
|
# (The chart's `externalSecret` path reads OIDC_* env from this Secret; nothing sensitive is
|
|
# rendered into the HelmRelease.)
|
|
externalSecret:
|
|
enabled: true
|
|
name: headlamp-oidc
|
|
hasScopes: true
|
|
# PER-USER RBAC: do NOT grant Headlamp's ServiceAccount cluster-admin. User requests are
|
|
# authorized by their forwarded OIDC token against the existing oidc:* group bindings.
|
|
serviceAccount:
|
|
create: true
|
|
clusterRoleBinding:
|
|
create: false
|
|
# Hardened pod defaults from the chart (runAsNonRoot, uid 100). Kept explicit for clarity.
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 100
|
|
runAsGroup: 101
|
|
privileged: false
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
# NOTE: readOnlyRootFilesystem intentionally left unset (chart default). Enabling it needs a
|
|
# writable /tmp (+ plugins dir) emptyDir; deferred as a runtime-verified follow-up hardening.
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 256Mi
|
|
service:
|
|
type: ClusterIP
|
|
port: 80
|