Add Headlamp Kubernetes dashboard deployment

- Deploy Headlamp v0.27.0 in dedicated namespace
- Configure OIDC authentication with Pocket ID
- Grant cluster-admin access via service account
- Expose via Traefik ingress at headlamp.basicstack.de
- Seal OIDC client credentials
- Enable access for andreas.leinen@basicstack.de and admin@basicstack.de

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/app-headlamp.yaml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: headlamp
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: git@forgejo.forgejo.svc.cluster.local:basicstack/stack.basicstack.de.git
+    targetRevision: main
+    path: apps/headlamp
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: headlamp
+  syncPolicy:
+    syncOptions:
+    - CreateNamespace=true

apps/headlamp/README.md

@@ -0,0 +1,42 @@
+# Headlamp - Kubernetes Dashboard
+
+Headlamp is a modern, web-based Kubernetes dashboard that provides a user-friendly interface for managing and monitoring Kubernetes clusters.
+
+## Deployment
+
+This deployment includes:
+
+- **Namespace**: `headlamp`
+- **Service Account**: `headlamp-admin` with `cluster-admin` ClusterRoleBinding for full cluster access
+- **OIDC Authentication**: Integrated with Pocket ID (https://auth.basicstack.de)
+- **Ingress**: Accessible at https://headlamp.basicstack.de
+
+## OIDC Configuration
+
+The deployment is configured to authenticate users via Pocket ID using OpenID Connect (OIDC):
+
+- **Issuer URL**: https://auth.basicstack.de
+- **Client ID**: Stored in sealed secret `headlamp-oidc`
+- **Client Secret**: Stored in sealed secret `headlamp-oidc`
+- **Scopes**: openid, profile, email
+
+### Authorized Users
+
+The following users have access to Headlamp through Pocket ID:
+- andreas.leinen@basicstack.de (admin)
+- admin@basicstack.de (admin)
+
+Users authenticate through the Pocket ID SSO and receive cluster-admin permissions via the service account.
+
+## Resources
+
+- **Official Documentation**: https://headlamp.dev/docs/
+- **OIDC Setup Guide**: https://headlamp.dev/docs/latest/installation/in-cluster/oidc
+- **Source Repository**: https://github.com/headlamp-k8s/headlamp
+
+## Access
+
+After deployment via ArgoCD, access the dashboard at:
+https://headlamp.basicstack.de
+
+Users will be redirected to Pocket ID for authentication before accessing the cluster dashboard.

apps/headlamp/deployment.yaml

@@ -0,0 +1,57 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: headlamp
+  namespace: headlamp
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: headlamp
+  template:
+    metadata:
+      labels:
+        app: headlamp
+    spec:
+      serviceAccountName: headlamp-admin
+      containers:
+      - name: headlamp
+        image: ghcr.io/headlamp-k8s/headlamp:v0.27.0
+        imagePullPolicy: IfNotPresent
+        args:
+        - "-in-cluster"
+        - "-plugins-dir=/headlamp/plugins"
+        ports:
+        - containerPort: 4466
+          name: http
+          protocol: TCP
+        env:
+        - name: HEADLAMP_CONFIG_BASE_URL
+          value: ""
+        - name: HEADLAMP_CONFIG_OIDC_IDPISSUERURL
+          value: https://auth.basicstack.de
+        - name: HEADLAMP_CONFIG_OIDC_CLIENTID
+          valueFrom:
+            secretKeyRef:
+              name: headlamp-oidc
+              key: client-id
+        - name: HEADLAMP_CONFIG_OIDC_CLIENTSECRET
+          valueFrom:
+            secretKeyRef:
+              name: headlamp-oidc
+              key: client-secret
+        - name: HEADLAMP_CONFIG_OIDC_SCOPES
+          value: "openid,profile,email"
+        volumeMounts:
+        - name: headlamp-config
+          mountPath: /headlamp/config
+        resources:
+          limits:
+            cpu: 500m
+            memory: 512Mi
+          requests:
+            cpu: 100m
+            memory: 128Mi
+      volumes:
+      - name: headlamp-config
+        emptyDir: {}

apps/headlamp/headlamp-oidc-sealed.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: headlamp-oidc
+  namespace: headlamp
+spec:
+  encryptedData:
+    client-id: AgBBqPROu10YqtK7CtUZrJSoQrDA9zt/vExGvr3LUzofqlk3UQdJ2Ifmes8HxtMCIhad43GW1E6Q/Csv6smFhtb4XCV2bqXVzqdJgd0L1JIR8d5VVCPlb+nKAnK7L8y2wNQJSYimGDXvoU1ti0oEP11QfETItxapLyAg1qEmZQJ4YyqaCoFnIl3dmmZep8iBGg4+Xkjvmc/J+oaD4qMk1dCunqrbL7n5vVpt9emSYYwEfWmXG1v/2BSZt7Wib4o0eiK30bnT6vOAAgwv99N/Ze7/OD3LkwUQ0uMykVFFtiO7ihq8+LrgHLfA/Ok1sa/eta7Nh93x1exqjhABiwolCLjJDSDjzdkT6Xx9YIsdnNCr5YPxRm1uoiLNoGf+Jb+lDRQFVkVPOA47CjaLdUvvXhMHjcf6SLERNGeSz+G2DU08qP9n0x3fH0+u1m18tgiZFp0s4J/SS+eCZHQRMxv/j5oDJkXyvI7j1oQINJXnk+JsEFVAjqbkshJRkVOH+P5CKYLUeuLoBNVOhvpRMoWYeyLDCMf874A+2P77FQpmDFoOaaiPrFMN7EvHVE98FYno4DanJqZC0xcHDY0tSwcPXPw0fSBMMO3ANWVlz+sCokR5UBAWZ0/DOPKpYXPFjQ169E5QNnYJ9LQZX6No0PqorFmflgHxNAZlvu+FWtY42jexPltC58nV+bjtSLQjF9LfA4TbCPl9Hb6A/FPsRSehI7+dQYYfaREmS4hRPmgCamRyduDpBTQ=
+    client-secret: AgAouP9gSFtNqKvuh03tDjclwZcUEkxhsXHR9h9YzW5gjizhcuW2RMagBCRyJmKMz/+YqPoPJqJBTr1wl8ZH7oLrwNlaBCfhO3pGt69DQAEk3/plDeBir3zVGMZHAYSUaLtTWHfD6wF6lrGJtiyXtqkT74aw4O3zizl92WVzPPs0FkaqidQ9bLBOPW8cJX53J8Q4VK+8COI+eHmRVlrsSLM+jGzeqBIPdKtmYk5Nf8dNC4fp/WZ3Tkg0p7X9myOgWbgfzip7pPVyyy3+mphEN1IoBnqRyTW5uPJiDvxNy0uNipMqdSus5Qzx++yzHsk0mzhBeIVn5tdqgynU8RbjWY2dB4PhglO9Ae75cLAAhRylhuEF7oa4e+iMOGidNcTzO2bwVvwpUSS359qtXSVRYZLIVFQmHhCEYN904IHYxSJR4NHZlVVsxs1MueG12kPGXLMLTRv3tOTp7xa5E1NvX6ynfnzfiRHCBBE4HQ4xqFJQj3BAC//5aOI50xYK1tUE+0ThU8L+wIaEJvsH6o2d/sZvo/9V2Fu0SEGVjTtQ61w7VDEFswO9X4DH2Sn2QPByz5fKHlN3txRsrRiFTj8exymL63E3EelrIWNylJlqWU/IIgZl/2IVEugBXgoliNPTnwHHVxt8SHNI255sWtOjKiCIWZv/Qj1gVD4RQNBvhD31z6NwqyoVf4qqL08UMVNce+nC4WbB30pDnD9qFvTqLjLIg2dr/gBSJDp0iWi8t0nrPg==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: headlamp-oidc
+      namespace: headlamp
+      annotations:
+        argocd.argoproj.io/compare-options: IgnoreExtraneous
+    type: Opaque

apps/headlamp/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: headlamp
+  namespace: headlamp
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: headlamp.basicstack.de
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: headlamp
+            port:
+              number: 4466
+  tls:
+  - hosts:
+    - headlamp.basicstack.de
+    secretName: headlamp-tls

apps/headlamp/service-account.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: headlamp-admin
+  namespace: headlamp
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: headlamp-admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  name: headlamp-admin
+  namespace: headlamp

apps/headlamp/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: headlamp
+  namespace: headlamp
+spec:
+  type: ClusterIP
+  ports:
+  - port: 4466
+    targetPort: 4466
+    protocol: TCP
+    name: http
+  selector:
+    app: headlamp