feat: convert many

clusters/cl01tl/helm/headlamp/templates/_helpers.tpl

@@ -0,0 +1,21 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+ServiceAccount name
+*/}}
+{{- define "custom.serviceAccountName" -}}
+headlamp-admin
+{{- end -}}

clusters/cl01tl/helm/headlamp/templates/cluster-role-binding.yaml

@@ -5,16 +5,15 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: cluster-admin-oidc
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    {{- include "custom.labels" . | nindent 4 }}
 roleRef:
+  apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: cluster-admin
-  apiGroup: rbac.authorization.k8s.io
 subjects:
-  - kind: User
+  - apiGroup: rbac.authorization.k8s.io
+    kind: User
     name: https://authentik.alexlebens.net/application/o/headlamp/#alexanderlebens@gmail.com
-    apiGroup: rbac.authorization.k8s.io
   - kind: ServiceAccount
-    name: headlamp-admin
-    namespace: headlamp
+    name: {{ include "custom.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}

clusters/cl01tl/helm/headlamp/templates/external-secret.yaml

@@ -1,38 +1,37 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: headlamp-oidc-secret
+  name: headlamp-oidc-authentik
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: headlamp-oidc-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: headlamp-oidc-authentik
+    {{- include "custom.labels" . | nindent 4 }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: OIDC_CLIENT_ID
       remoteRef:
-        key: /authentik/oidc/headlamp
+        key: /cl01tl/authentik/oidc/headlamp
         property: client
     - secretKey: OIDC_CLIENT_SECRET
       remoteRef:
-        key: /authentik/oidc/headlamp
+        key: /cl01tl/authentik/oidc/headlamp
         property: secret
     - secretKey: OIDC_ISSUER_URL
       remoteRef:
-        key: /authentik/oidc/headlamp
+        key: /cl01tl/authentik/oidc/headlamp
         property: issuer
     - secretKey: OIDC_SCOPES
       remoteRef:
-        key: /authentik/oidc/headlamp
+        key: /cl01tl/authentik/oidc/headlamp
         property: scopes
     - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_IDP_ISSUER_URL
       remoteRef:
-        key: /authentik/oidc/headlamp
-        property: validator-issuer-url
+        key: /cl01tl/authentik/oidc/headlamp
+        property: issuer
     - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_CLIENT_ID
       remoteRef:
-        key: /authentik/oidc/headlamp
-        property: validator-client-id
+        key: /cl01tl/authentik/oidc/headlamp
+        property: client

clusters/cl01tl/helm/headlamp/templates/service-account.yaml

@@ -1,9 +1,8 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: headlamp-admin
+  name: {{ include "custom.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: headlamp-admin
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "custom.serviceAccountName" . }}
+    {{- include "custom.labels" . | nindent 4 }}

clusters/cl01tl/helm/headlamp/values.yaml

@@ -10,7 +10,7 @@ headlamp:
         create: false
       externalSecret:
         enabled: true
-        name: headlamp-oidc-secret
+        name: headlamp-oidc-authentik
     watchPlugins: true
   httpRoute:
     enabled: true
@@ -27,11 +27,9 @@ headlamp:
             type: PathPrefix
             value: /
         backendRefs:
-          - group: ''
-            kind: Service
+          - kind: Service
             name: headlamp
             port: 80
-            weight: 100
   resources:
     requests:
       cpu: 1m