# OIDC Registration in ecommerce namespace
apiVersion: v1
kind: Secret
metadata:
  name: flux-dashboard-oidc-client-secret
  namespace: ecommerce
type: Opaque
stringData:
  secret: "f9f44c88d9fda647e4abbb4479f1116611ecc14624bd67ec"
---
apiVersion: auth.k6n.net/v1alpha1
kind: AuthClient
metadata:
  name: flux-dashboard
  namespace: ecommerce
  labels:
    auth.k6n.net/server: auth
spec:
  clientID: flux-dashboard
  displayName: Flux GitOps Dashboard
  description: Web UI for Flux CD (Weave GitOps)
  redirectURIs:
    - https://flux.k6n.net/oauth2/callback
  scopes:
    - openid
    - profile
    - email
    - groups
  secretRef:
    name: flux-dashboard-oidc-client-secret
    key: secret
---
# Weave GitOps OIDC Secret in flux-system
apiVersion: v1
kind: Secret
metadata:
  name: oidc-auth
  namespace: flux-system
type: Opaque
stringData:
  clientID: "flux-dashboard"
  clientSecret: "f9f44c88d9fda647e4abbb4479f1116611ecc14624bd67ec"
  issuerURL: "https://users.k6n.net"
  redirectURL: "https://flux.k6n.net/oauth2/callback"
  claimUsername: "email"
  claimGroups: "roles"
---
# Weave GitOps Helm OCI Source and HelmRelease
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: weave-gitops
  namespace: flux-system
spec:
  type: oci
  url: oci://ghcr.io/weaveworks/charts
  interval: 1h
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: weave-gitops
  namespace: flux-system
spec:
  interval: 10m
  chart:
    spec:
      chart: weave-gitops
      version: "4.0.36"
      sourceRef:
        kind: HelmRepository
        name: weave-gitops
  values:
    envVars:
      - name: KUBERNETES_SERVICE_HOST
        value: "10.10.1.102"
      - name: KUBERNETES_SERVICE_PORT
        value: "6443"
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
            - matchExpressions:
                - key: kubernetes.io/hostname
                  operator: NotIn
                  values:
                    - serber
    # Use existing oidc-auth secret created above
    oidcSecret:
      create: false
    adminUser:
      create: false
    ingress:
      enabled: true
      className: nginx
      annotations:
        cert-manager.io/cluster-issuer: letsencrypt-prod
      hosts:
        - host: flux.k6n.net
          paths:
            - path: /
              pathType: ImplementationSpecific
      tls:
        - hosts:
            - flux.k6n.net
          secretName: flux-k6n-tls
---
# ClusterRoleBinding so authenticated users can view/manage GitOps resources
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: weave-gitops-admin
subjects:
  - kind: Group
    name: admin
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io