eval

2026-09-27 16:45:10 +02:00
1 parent f5015581a4
commit e046bd86d1
@@ -0,0 +1,120 @@
+# OIDC Registration in ecommerce namespace
+apiVersion: v1
+kind: Secret
+metadata:
+  name: flux-dashboard-oidc-client-secret
+  namespace: ecommerce
+type: Opaque
+stringData:
+  secret: "f9f44c88d9fda647e4abbb4479f1116611ecc14624bd67ec"
+---
+apiVersion: auth.k6n.net/v1alpha1
+kind: AuthClient
+metadata:
+  name: flux-dashboard
+  namespace: ecommerce
+  labels:
+    auth.k6n.net/server: auth
+spec:
+  clientID: flux-dashboard
+  displayName: Flux GitOps Dashboard
+  description: Web UI for Flux CD (Weave GitOps)
+  redirectURIs:
+    - https://flux.k6n.net/oauth2/callback
+  scopes:
+    - openid
+    - profile
+    - email
+    - groups
+  secretRef:
+    name: flux-dashboard-oidc-client-secret
+    key: secret
+---
+# Weave GitOps OIDC Secret in flux-system
+apiVersion: v1
+kind: Secret
+metadata:
+  name: oidc-auth
+  namespace: flux-system
+type: Opaque
+stringData:
+  clientID: "flux-dashboard"
+  clientSecret: "f9f44c88d9fda647e4abbb4479f1116611ecc14624bd67ec"
+  issuerURL: "https://users.k6n.net"
+  redirectURL: "https://flux.k6n.net/oauth2/callback"
+  claimUsername: "email"
+  claimGroups: "roles"
+---
+# Weave GitOps Helm OCI Source and HelmRelease
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: weave-gitops
+  namespace: flux-system
+spec:
+  type: oci
+  url: oci://ghcr.io/weaveworks/charts
+  interval: 1h
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: weave-gitops
+  namespace: flux-system
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: weave-gitops
+      version: "4.0.36"
+      sourceRef:
+        kind: HelmRepository
+        name: weave-gitops
+  values:
+    envVars:
+      - name: KUBERNETES_SERVICE_HOST
+        value: "10.10.1.102"
+      - name: KUBERNETES_SERVICE_PORT
+        value: "6443"
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: kubernetes.io/hostname
+                  operator: NotIn
+                  values:
+                    - serber
+    # Use existing oidc-auth secret created above
+    oidcSecret:
+      create: false
+    adminUser:
+      create: false
+    ingress:
+      enabled: true
+      className: nginx
+      annotations:
+        cert-manager.io/cluster-issuer: letsencrypt-prod
+      hosts:
+        - host: flux.k6n.net
+          paths:
+            - path: /
+              pathType: ImplementationSpecific
+      tls:
+        - hosts:
+            - flux.k6n.net
+          secretName: flux-k6n-tls
+---
+# ClusterRoleBinding so authenticated users can view/manage GitOps resources
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: weave-gitops-admin
+subjects:
+  - kind: Group
+    name: admin
+    apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: ClusterRole
+  name: cluster-admin
+  apiGroup: rbac.authorization.k8s.io