feat: setup headlamp oidc

[joryirving]

No description provided.

[smurf-bot]

--- kubernetes/main/apps/flux-system/headlamp/app Kustomization: flux-system/headlamp HelmRelease: flux-system/headlamp

+++ kubernetes/main/apps/flux-system/headlamp/app Kustomization: flux-system/headlamp HelmRelease: flux-system/headlamp

@@ -26,12 +26,18 @@

     cleanupOnFail: true
     remediation:
       retries: 3
       strategy: rollback
   values:
     config:
+      oidc:
+        externalSecret:
+          enabled: true
+          name: headlamp-secret
+        secret:
+          create: false
       pluginsDir: /build/plugins
     fullnameOverride: headlamp
     ingress:
       enabled: true
       hosts:
       - host: headlamp.jory.dev
--- kubernetes/main/apps/flux-system/headlamp/app Kustomization: flux-system/headlamp ExternalSecret: flux-system/headlamp-secret

+++ kubernetes/main/apps/flux-system/headlamp/app Kustomization: flux-system/headlamp ExternalSecret: flux-system/headlamp-secret

@@ -0,0 +1,26 @@

+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  labels:
+    app.kubernetes.io/name: headlamp
+    kustomize.toolkit.fluxcd.io/name: headlamp
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: headlamp-secret
+  namespace: flux-system
+spec:
+  dataFrom:
+  - extract:
+      key: headlamp
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword
+  target:
+    name: headlamp-secret
+    template:
+      data:
+        OIDC_CLIENT_ID: '{{ .HEADLAMP_CLIENT_ID }}'
+        OIDC_CLIENT_SECRET: '{{ .HEADLAMP_CLIENT_SECRET }}'
+        OIDC_ISSUER_URL: https://sso.jory.dev/application/o/headlamp/
+        OIDC_SCOPES: openid email profile
+

[smurf-bot]

--- HelmRelease: flux-system/headlamp Deployment: flux-system/headlamp

+++ HelmRelease: flux-system/headlamp Deployment: flux-system/headlamp

@@ -37,16 +37,22 @@

           privileged: false
           runAsGroup: 101
           runAsNonRoot: true
           runAsUser: 100
         image: ghcr.io/headlamp-k8s/headlamp:v0.28.0
         imagePullPolicy: IfNotPresent
-        env: null
+        envFrom:
+        - secretRef:
+            name: headlamp-secret
         args:
         - -in-cluster
         - -plugins-dir=/build/plugins
+        - -oidc-client-id=$(OIDC_CLIENT_ID)
+        - -oidc-client-secret=$(OIDC_CLIENT_SECRET)
+        - -oidc-idp-issuer-url=$(OIDC_ISSUER_URL)
+        - -oidc-scopes=$(OIDC_SCOPES)
         ports:
         - name: http
           containerPort: 4466
           protocol: TCP
         livenessProbe:
           httpGet:

[smurf-bot]

📝 Terraform Plan for terraform/authentik

→ Resource Changes: 4 to create, 4 to update, 0 to re-create, 0 to delete.

✨ Create

authentik_application.application["headlamp"]

+ group              = "Infrastructure"
+ id                 = (known after apply)
+ meta_icon          = "https://raw.githubusercontent.com/headlamp-k8s/headlamp/refs/heads/main/frontend/src/resources/icon-dark.svg"
+ meta_launch_url    = "https://headlamp.jory.dev/oidc-callback"
+ name               = "Headlamp"
+ open_in_new_tab    = true
+ policy_engine_mode = "all"
+ protocol_provider  = (known after apply)
+ slug               = "headlamp"
+ uuid               = (known after apply)

authentik_group.default["media"]

+ attributes   = jsonencode({})
+ id           = (known after apply)
+ is_superuser = false
+ name         = "Media"
+ users        = (known after apply)

authentik_policy_binding.application_policy_binding["headlamp"]

+ enabled        = true
+ failure_result = false
+ group          = "c106e1f6-0015-4330-8cca-5e33e4f8f951"
+ id             = (known after apply)
+ negate         = false
+ order          = 0
+ target         = (known after apply)
+ timeout        = 30

authentik_provider_oauth2.oauth2["headlamp"]

+ access_code_validity       = "minutes=1"
+ access_token_validity      = "hours=4"
+ allowed_redirect_uris      = [
+     {
+         "matching_mode" = "strict"
+         "url"           = "https://headlamp.jory.dev/oidc-callback"
      },
  ]
+ authentication_flow        = "745ba906-041d-4740-a7f4-200811f2b00e"
+ authorization_flow         = "01a99e21-6d65-4d0b-a795-fb88146b240e"
+ client_id                  = (sensitive value)
+ client_secret              = (sensitive value)
+ client_type                = "confidential"
+ id                         = (known after apply)
+ include_claims_in_id_token = true
+ invalidation_flow          = "b13379f7-628c-4967-ac4d-571890ccf1c8"
+ issuer_mode                = "per_provider"
+ name                       = "headlamp"
+ property_mappings          = [
+     "19b3134c-7727-4977-8035-376b0e7b4aff",
+     "f3d51311-4d25-43ef-ba79-d48727efc50f",
+     "55c034ce-f36a-47b5-abc7-fbbf26755e96",
  ]
+ refresh_token_validity     = "days=30"
+ signing_key                = "a9791054-b30b-4862-ba60-2d00372998ee"
+ sub_mode                   = "hashed_user_id"

♻️ Update

authentik_application.application["dashbrr"]

! group                 = "Monitoring" -> "Downloads"
  id                    = "dashbrr"
  name                  = "Dashbrr"
  # (8 unchanged attributes hidden)

authentik_application.application["kyoo"]

! group                 = "Home" -> "Media"
  id                    = "kyoo"
  name                  = "Kyoo"
  # (8 unchanged attributes hidden)

authentik_policy_binding.application_policy_binding["dashbrr"]

! group          = "d33505f4-315b-4ed0-a341-5ea876bddf36" -> "cfec16fd-86f2-474e-9534-bba063b82fd8"
  id             = "1176c965-1691-405f-ba74-54d84807d48d"
  # (7 unchanged attributes hidden)

authentik_policy_binding.application_policy_binding["kyoo"]

! group          = "908b77e6-146e-4850-a0e3-bac2ed668c95" -> (known after apply)
  id             = "55865418-2cc8-43f3-a2cb-6e638f2abfa9"
  # (7 unchanged attributes hidden)

---

Triggered by @joryirving, Commit: 5c167247d1aad2c019aa229c14ad381f32a55255