added headlamp
This commit is contained in:
kisfenyo
@@ -636,3 +636,25 @@ spec:
|
|||||||
- CreateNamespace=true
|
- CreateNamespace=true
|
||||||
- PruneLast=true
|
- PruneLast=true
|
||||||
---
|
---
|
||||||
|
# Headlamp
|
||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: Application
|
||||||
|
metadata:
|
||||||
|
name: headlamp
|
||||||
|
namespace: argocd
|
||||||
|
finalizers:
|
||||||
|
- resources-finalizer.argocd.argoproj.io
|
||||||
|
spec:
|
||||||
|
project: homelab
|
||||||
|
source:
|
||||||
|
repoURL: https://gitea.dooplex.hu/admin/homelab-manifests.git
|
||||||
|
targetRevision: main
|
||||||
|
path: headlamp-system
|
||||||
|
destination:
|
||||||
|
server: https://kubernetes.default.svc
|
||||||
|
namespace: headlamp-system
|
||||||
|
syncPolicy:
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=true
|
||||||
|
- PruneLast=true
|
||||||
|
---
|
||||||
|
|||||||
@@ -0,0 +1,381 @@
|
|||||||
|
# =============================================================================
|
||||||
|
# Headlamp - Kubernetes Dashboard
|
||||||
|
# Version: 0.39.0
|
||||||
|
# Namespace: headlamp-system
|
||||||
|
# Domain: headlamp.dooplex.hu
|
||||||
|
# Authentication: Authentik OIDC
|
||||||
|
# =============================================================================
|
||||||
|
#
|
||||||
|
# PREREQUISITES - Create in Authentik:
|
||||||
|
# 1. Create OAuth2/OIDC Provider:
|
||||||
|
# - Name: headlamp
|
||||||
|
# - Authorization flow: default-provider-authorization-explicit-consent
|
||||||
|
# - Client type: Confidential
|
||||||
|
# - Client ID: headlamp (or auto-generated)
|
||||||
|
# - Redirect URIs: https://headlamp.dooplex.hu/oidc-callback
|
||||||
|
# - Scopes: email, openid, profile
|
||||||
|
# - Signing Key: Select your certificate
|
||||||
|
#
|
||||||
|
# 2. Create Application:
|
||||||
|
# - Name: Headlamp
|
||||||
|
# - Slug: headlamp
|
||||||
|
# - Provider: (select the provider created above)
|
||||||
|
# - Launch URL: https://headlamp.dooplex.hu
|
||||||
|
#
|
||||||
|
# 3. Create the secret with OIDC credentials:
|
||||||
|
# kubectl create secret generic headlamp-oidc -n headlamp-system \
|
||||||
|
# --from-literal=client-id='your-client-id' \
|
||||||
|
# --from-literal=client-secret='your-client-secret'
|
||||||
|
#
|
||||||
|
# NOTE: For full OIDC authentication to K8s API (user identity passed to k8s),
|
||||||
|
# you need to configure k3s with OIDC flags. Add to /etc/rancher/k3s/config.yaml:
|
||||||
|
# kube-apiserver-arg:
|
||||||
|
# - "oidc-issuer-url=https://authentik.dooplex.hu/application/o/headlamp/"
|
||||||
|
# - "oidc-client-id=headlamp"
|
||||||
|
# - "oidc-username-claim=email"
|
||||||
|
# - "oidc-groups-claim=groups"
|
||||||
|
# Then restart k3s: sudo systemctl restart k3s
|
||||||
|
#
|
||||||
|
# After enabling API server OIDC, create ClusterRoleBinding for your user/group:
|
||||||
|
# kubectl create clusterrolebinding oidc-cluster-admin \
|
||||||
|
# --clusterrole=cluster-admin \
|
||||||
|
# --user=your-email@example.com
|
||||||
|
#
|
||||||
|
# =============================================================================
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: headlamp-system
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: headlamp
|
||||||
|
app.kubernetes.io/instance: headlamp
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: headlamp
|
||||||
|
namespace: headlamp-system
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: headlamp
|
||||||
|
app.kubernetes.io/instance: headlamp
|
||||||
|
---
|
||||||
|
# ClusterRole for Headlamp to access cluster resources
|
||||||
|
# This is a read-heavy role suitable for dashboard viewing
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: headlamp
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: headlamp
|
||||||
|
app.kubernetes.io/instance: headlamp
|
||||||
|
rules:
|
||||||
|
# Core resources - full access for management
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
- endpoints
|
||||||
|
- persistentvolumeclaims
|
||||||
|
- pods
|
||||||
|
- pods/log
|
||||||
|
- pods/exec
|
||||||
|
- replicationcontrollers
|
||||||
|
- replicationcontrollers/scale
|
||||||
|
- serviceaccounts
|
||||||
|
- services
|
||||||
|
- nodes
|
||||||
|
- namespaces
|
||||||
|
- events
|
||||||
|
- secrets
|
||||||
|
- resourcequotas
|
||||||
|
- limitranges
|
||||||
|
- persistentvolumes
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||||
|
# Apps resources
|
||||||
|
- apiGroups: ["apps"]
|
||||||
|
resources:
|
||||||
|
- daemonsets
|
||||||
|
- deployments
|
||||||
|
- deployments/scale
|
||||||
|
- replicasets
|
||||||
|
- replicasets/scale
|
||||||
|
- statefulsets
|
||||||
|
- statefulsets/scale
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||||
|
# Batch resources
|
||||||
|
- apiGroups: ["batch"]
|
||||||
|
resources:
|
||||||
|
- cronjobs
|
||||||
|
- jobs
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||||
|
# Autoscaling
|
||||||
|
- apiGroups: ["autoscaling"]
|
||||||
|
resources:
|
||||||
|
- horizontalpodautoscalers
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||||
|
# Networking
|
||||||
|
- apiGroups: ["networking.k8s.io"]
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
- networkpolicies
|
||||||
|
- ingressclasses
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||||
|
# Storage
|
||||||
|
- apiGroups: ["storage.k8s.io"]
|
||||||
|
resources:
|
||||||
|
- storageclasses
|
||||||
|
- volumeattachments
|
||||||
|
- csidrivers
|
||||||
|
- csinodes
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# RBAC
|
||||||
|
- apiGroups: ["rbac.authorization.k8s.io"]
|
||||||
|
resources:
|
||||||
|
- clusterroles
|
||||||
|
- clusterrolebindings
|
||||||
|
- roles
|
||||||
|
- rolebindings
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||||
|
# Policy
|
||||||
|
- apiGroups: ["policy"]
|
||||||
|
resources:
|
||||||
|
- poddisruptionbudgets
|
||||||
|
- podsecuritypolicies
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||||
|
# Certificates
|
||||||
|
- apiGroups: ["certificates.k8s.io"]
|
||||||
|
resources:
|
||||||
|
- certificatesigningrequests
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# API extensions
|
||||||
|
- apiGroups: ["apiextensions.k8s.io"]
|
||||||
|
resources:
|
||||||
|
- customresourcedefinitions
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# Metrics
|
||||||
|
- apiGroups: ["metrics.k8s.io"]
|
||||||
|
resources:
|
||||||
|
- nodes
|
||||||
|
- pods
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# Discovery
|
||||||
|
- apiGroups: ["discovery.k8s.io"]
|
||||||
|
resources:
|
||||||
|
- endpointslices
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# Events
|
||||||
|
- apiGroups: ["events.k8s.io"]
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# Coordination
|
||||||
|
- apiGroups: ["coordination.k8s.io"]
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# Node
|
||||||
|
- apiGroups: ["node.k8s.io"]
|
||||||
|
resources:
|
||||||
|
- runtimeclasses
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# Scheduling
|
||||||
|
- apiGroups: ["scheduling.k8s.io"]
|
||||||
|
resources:
|
||||||
|
- priorityclasses
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# Longhorn CRDs
|
||||||
|
- apiGroups: ["longhorn.io"]
|
||||||
|
resources: ["*"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# Cert-manager CRDs
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["*"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# ArgoCD CRDs
|
||||||
|
- apiGroups: ["argoproj.io"]
|
||||||
|
resources: ["*"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# CloudNativePG CRDs
|
||||||
|
- apiGroups: ["postgresql.cnpg.io"]
|
||||||
|
resources: ["*"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: headlamp
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: headlamp
|
||||||
|
app.kubernetes.io/instance: headlamp
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: headlamp
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: headlamp
|
||||||
|
namespace: headlamp-system
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: headlamp-config
|
||||||
|
namespace: headlamp-system
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: headlamp
|
||||||
|
app.kubernetes.io/instance: headlamp
|
||||||
|
data:
|
||||||
|
# Headlamp configuration
|
||||||
|
# Note: OIDC settings are passed via environment variables
|
||||||
|
config.yaml: |
|
||||||
|
# Additional headlamp configuration can be placed here if needed
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: headlamp
|
||||||
|
namespace: headlamp-system
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: headlamp
|
||||||
|
app.kubernetes.io/instance: headlamp
|
||||||
|
app.kubernetes.io/version: "0.39.0"
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
strategy:
|
||||||
|
type: Recreate
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: headlamp
|
||||||
|
app.kubernetes.io/instance: headlamp
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: headlamp
|
||||||
|
app.kubernetes.io/instance: headlamp
|
||||||
|
app.kubernetes.io/version: "0.39.0"
|
||||||
|
spec:
|
||||||
|
serviceAccountName: headlamp
|
||||||
|
automountServiceAccountToken: true
|
||||||
|
containers:
|
||||||
|
- name: headlamp
|
||||||
|
image: ghcr.io/headlamp-k8s/headlamp:v0.39.0
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
args:
|
||||||
|
- "-in-cluster"
|
||||||
|
- "-plugins-dir=/headlamp/plugins"
|
||||||
|
env:
|
||||||
|
# OIDC Configuration for Authentik
|
||||||
|
- name: HEADLAMP_CONFIG_OIDC_CLIENT_ID
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: headlamp-oidc
|
||||||
|
key: client-id
|
||||||
|
- name: HEADLAMP_CONFIG_OIDC_CLIENT_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: headlamp-oidc
|
||||||
|
key: client-secret
|
||||||
|
- name: HEADLAMP_CONFIG_OIDC_IDP_ISSUER_URL
|
||||||
|
value: "https://authentik.dooplex.hu/application/o/headlamp/"
|
||||||
|
- name: HEADLAMP_CONFIG_OIDC_SCOPES
|
||||||
|
value: "openid,profile,email"
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
containerPort: 4466
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /
|
||||||
|
port: http
|
||||||
|
initialDelaySeconds: 30
|
||||||
|
periodSeconds: 30
|
||||||
|
timeoutSeconds: 10
|
||||||
|
failureThreshold: 3
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /
|
||||||
|
port: http
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 10
|
||||||
|
timeoutSeconds: 5
|
||||||
|
failureThreshold: 3
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 512Mi
|
||||||
|
volumeMounts:
|
||||||
|
- name: plugins
|
||||||
|
mountPath: /headlamp/plugins
|
||||||
|
volumes:
|
||||||
|
- name: plugins
|
||||||
|
emptyDir: {}
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: headlamp
|
||||||
|
namespace: headlamp-system
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: headlamp
|
||||||
|
app.kubernetes.io/instance: headlamp
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
port: 80
|
||||||
|
targetPort: http
|
||||||
|
protocol: TCP
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: headlamp
|
||||||
|
app.kubernetes.io/instance: headlamp
|
||||||
|
---
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: headlamp
|
||||||
|
namespace: headlamp-system
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: headlamp
|
||||||
|
app.kubernetes.io/instance: headlamp
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||||
|
external-dns.alpha.kubernetes.io/hostname: headlamp.dooplex.hu,headlamp.home
|
||||||
|
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||||
|
nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
|
||||||
|
nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
|
||||||
|
# Homepage integration annotations
|
||||||
|
gethomepage.dev/enabled: "true"
|
||||||
|
gethomepage.dev/name: "Headlamp"
|
||||||
|
gethomepage.dev/description: "Kubernetes Dashboard"
|
||||||
|
gethomepage.dev/group: "Infrastructure"
|
||||||
|
gethomepage.dev/icon: "headlamp.png"
|
||||||
|
spec:
|
||||||
|
ingressClassName: nginx-internal
|
||||||
|
rules:
|
||||||
|
- host: headlamp.dooplex.hu
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
backend:
|
||||||
|
service:
|
||||||
|
name: headlamp
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
|
- host: headlamp.home
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
backend:
|
||||||
|
service:
|
||||||
|
name: headlamp
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- headlamp.dooplex.hu
|
||||||
|
secretName: headlamp-tls
|
||||||
Reference in New Issue
Block a user