121 lines
2.8 KiB
YAML
121 lines
2.8 KiB
YAML
# OIDC Registration in ecommerce namespace
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: flux-dashboard-oidc-client-secret
|
|
namespace: ecommerce
|
|
type: Opaque
|
|
stringData:
|
|
secret: "f9f44c88d9fda647e4abbb4479f1116611ecc14624bd67ec"
|
|
---
|
|
apiVersion: auth.k6n.net/v1alpha1
|
|
kind: AuthClient
|
|
metadata:
|
|
name: flux-dashboard
|
|
namespace: ecommerce
|
|
labels:
|
|
auth.k6n.net/server: auth
|
|
spec:
|
|
clientID: flux-dashboard
|
|
displayName: Flux GitOps Dashboard
|
|
description: Web UI for Flux CD (Weave GitOps)
|
|
redirectURIs:
|
|
- https://flux.k6n.net/oauth2/callback
|
|
scopes:
|
|
- openid
|
|
- profile
|
|
- email
|
|
- groups
|
|
secretRef:
|
|
name: flux-dashboard-oidc-client-secret
|
|
key: secret
|
|
---
|
|
# Weave GitOps OIDC Secret in flux-system
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: oidc-auth
|
|
namespace: flux-system
|
|
type: Opaque
|
|
stringData:
|
|
clientID: "flux-dashboard"
|
|
clientSecret: "f9f44c88d9fda647e4abbb4479f1116611ecc14624bd67ec"
|
|
issuerURL: "https://users.k6n.net"
|
|
redirectURL: "https://flux.k6n.net/oauth2/callback"
|
|
claimUsername: "email"
|
|
claimGroups: "roles"
|
|
---
|
|
# Weave GitOps Helm OCI Source and HelmRelease
|
|
apiVersion: source.toolkit.fluxcd.io/v1
|
|
kind: HelmRepository
|
|
metadata:
|
|
name: weave-gitops
|
|
namespace: flux-system
|
|
spec:
|
|
type: oci
|
|
url: oci://ghcr.io/weaveworks/charts
|
|
interval: 1h
|
|
---
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: weave-gitops
|
|
namespace: flux-system
|
|
spec:
|
|
interval: 10m
|
|
chart:
|
|
spec:
|
|
chart: weave-gitops
|
|
version: "4.0.36"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: weave-gitops
|
|
values:
|
|
envVars:
|
|
- name: KUBERNETES_SERVICE_HOST
|
|
value: "10.10.1.102"
|
|
- name: KUBERNETES_SERVICE_PORT
|
|
value: "6443"
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/hostname
|
|
operator: NotIn
|
|
values:
|
|
- serber
|
|
# Use existing oidc-auth secret created above
|
|
oidcSecret:
|
|
create: false
|
|
adminUser:
|
|
create: false
|
|
ingress:
|
|
enabled: true
|
|
className: nginx
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
hosts:
|
|
- host: flux.k6n.net
|
|
paths:
|
|
- path: /
|
|
pathType: ImplementationSpecific
|
|
tls:
|
|
- hosts:
|
|
- flux.k6n.net
|
|
secretName: flux-k6n-tls
|
|
---
|
|
# ClusterRoleBinding so authenticated users can view/manage GitOps resources
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: weave-gitops-admin
|
|
subjects:
|
|
- kind: Group
|
|
name: admin
|
|
apiGroup: rbac.authorization.k8s.io
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: cluster-admin
|
|
apiGroup: rbac.authorization.k8s.io
|