jakman85andClaude Opus 4.8
5fb097d019
Add Headlamp (kubernetes-sigs/headlamp Helm chart) at headlamp.home.keithjackson.dev with native Keycloak OIDC login and PER-USER RBAC: Headlamp forwards each user's id_token to the k3s apiserver, so the existing oidc:* group bindings (platform-admins->cluster-admin, viewers->view) apply per user. The ServiceAccount is deliberately NOT bound to cluster-admin (clusterRoleBinding.create=false), since user requests ride the forwarded token. Key integration nuance: the apiserver is configured oidc-client-id=kubernetes, so it only accepts tokens whose aud contains `kubernetes`. The new `headlamp` Keycloak client carries an oidc-audience-mapper (included.client.audience= kubernetes) so tokens carry aud=[headlamp, kubernetes] -- accepted by both Headlamp's own verifier and the apiserver, leaving the apiserver config untouched. A groups mapper emits the `groups` claim the apiserver maps to RBAC. - platform/headlamp: namespace, HelmRepository/HelmRelease, SOPS OIDC secret (externalSecret envFrom), default-deny NetworkPolicy + Cilium ingress (gateway)/egress (apiserver+Keycloak) policies, README. Wired into platform/kustomization.yaml (platform tier). - platform/headlamp/httproute.yaml wired into platform-config (Gateway API CR, dependsOn platform), modeled on grafana-httproute. - keycloak-realm-import: add `headlamp` confidential client + groups/audience mappers + HEADLAMP_CLIENT_SECRET placeholder. Client also created LIVE via kcadm (realm import no-ops on the existing realm). - keycloak-realm-clients.sops: add headlamp-client-secret (mirrored into headlamp-oidc-credentials clientSecret). Both encrypted to the repo age key. Co-Authored-By: Claude Opus 4.8 <[email protected]>
19 lines
991 B
YAML
19 lines
991 B
YAML
---
|
|
# Headlamp — Kubernetes dashboard with Keycloak native-OIDC login + per-user RBAC (ADR-0014).
|
|
# CONTROLLERS half: the HelmRepository + HelmRelease (chart installs the Deployment/Service/SA), the
|
|
# SOPS-encrypted OIDC credential (decrypted by the `platform` Flux Kustomization), and the
|
|
# default-deny + Cilium egress/ingress policies. The HTTPRoute is a Gateway API CR and lives in
|
|
# platform-config (dependsOn platform) so the Gateway CRDs exist first — same split as grafana.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
namespace: headlamp
|
|
resources:
|
|
- namespace.yaml
|
|
- helmrepository.yaml
|
|
- helmrelease.yaml
|
|
# OIDC client credential (envFrom'd by the chart via config.oidc.externalSecret) — SOPS-encrypted,
|
|
# referenced by name (R-IDP-04). The matching value is mirrored in keycloak-realm-clients.
|
|
- headlamp-oidc-credentials.sops.yaml
|
|
# default-deny baseline + Cilium ingress(gateway)/egress(apiserver+Keycloak) allows.
|
|
- networkpolicy.yaml
|