apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cluster-admin-oidc
  namespace: headlamp
  labels:
    app.kubernetes.io/name: cluster-admin-oidc
    app.kubernetes.io/instance: headlamp
    app.kubernetes.io/part-of: headlamp
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: User
    name: https://authentik.alexlebens.net/application/o/headlamp/#alexanderlebens@gmail.com
    apiGroup: rbac.authorization.k8s.io
  - kind: ServiceAccount
    name: headlamp-admin
    namespace: headlamp
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: headlamp-admin
  labels:
    helm.sh/chart: headlamp-0.40.1
    app.kubernetes.io/name: headlamp
    app.kubernetes.io/instance: headlamp
    app.kubernetes.io/version: "0.40.1"
    app.kubernetes.io/managed-by: Helm
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: headlamp
    namespace: headlamp
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: headlamp-plugin-config
  namespace: headlamp
  labels:
    helm.sh/chart: headlamp-0.40.1
    app.kubernetes.io/name: headlamp
    app.kubernetes.io/instance: headlamp
    app.kubernetes.io/version: "0.40.1"
    app.kubernetes.io/managed-by: Helm
data:
  plugin.yml: |
    plugins:
      - name: cert-manager
        source: https://artifacthub.io/packages/headlamp/headlamp-plugins/headlamp_cert-manager
        version: 0.1.0
      - name: trivy
        source: https://artifacthub.io/packages/headlamp/headlamp-trivy/headlamp_trivy
        version: 0.3.1
      - name: external-secrets-operator
        source: https://artifacthub.io/packages/headlamp/external-secrets-operator-headlamp-plugin/external-secrets-operator
        version: 0.1.0-beta7
    installOptions:
      parallel: false
      maxConcurrent: 1
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: headlamp
  namespace: headlamp
  labels:
    helm.sh/chart: headlamp-0.40.1
    app.kubernetes.io/name: headlamp
    app.kubernetes.io/instance: headlamp
    app.kubernetes.io/version: "0.40.1"
    app.kubernetes.io/managed-by: Helm
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: headlamp
      app.kubernetes.io/instance: headlamp
  template:
    metadata:
      labels:
        app.kubernetes.io/name: headlamp
        app.kubernetes.io/instance: headlamp
    spec:
      serviceAccountName: headlamp
      automountServiceAccountToken: true
      hostUsers: true
      securityContext: {}
      containers:
        - name: headlamp
          securityContext:
            privileged: false
            runAsGroup: 101
            runAsNonRoot: true
            runAsUser: 100
          image: "ghcr.io/headlamp-k8s/headlamp:v0.40.1"
          imagePullPolicy: IfNotPresent
          envFrom:
            - secretRef:
                name: headlamp-oidc-secret
          args:
            - "-in-cluster"
            - "-in-cluster-context-name=main"
            - "-watch-plugins-changes"
            - "-plugins-dir=/headlamp/plugins"
            - "-oidc-client-id=$(OIDC_CLIENT_ID)"
            - "-oidc-client-secret=$(OIDC_CLIENT_SECRET)"
            - "-oidc-idp-issuer-url=$(OIDC_ISSUER_URL)"
            - "-oidc-scopes=$(OIDC_SCOPES)"
          ports:
            - name: http
              containerPort: 4466
              protocol: TCP
          livenessProbe:
            httpGet:
              path: "/"
              port: http
          readinessProbe:
            httpGet:
              path: "/"
              port: http
          resources:
            requests:
              cpu: 10m
              memory: 128Mi
          volumeMounts:
            - name: plugins-dir
              mountPath: /headlamp/plugins
        - name: headlamp-plugin
          image: node:lts-alpine
          command: ["/bin/sh", "-c"]
          args:
            - |
              if [ -f "/config/plugin.yml" ]; then
                echo "Installing plugins from config..."
                cat /config/plugin.yml
                # Use a writable cache directory
                export NPM_CONFIG_CACHE=/tmp/npm-cache
                # Use a writable config directory
                export NPM_CONFIG_USERCONFIG=/tmp/npm-userconfig
                mkdir -p /tmp/npm-cache /tmp/npm-userconfig
                npx --yes @headlamp-k8s/pluginctl@latest install --config /config/plugin.yml --folderName /headlamp/plugins --watch
              fi
          volumeMounts:
            - name: plugins-dir
              mountPath: /headlamp/plugins
            - name: plugin-config
              mountPath: /config
          resources: null
          securityContext:
            readOnlyRootFilesystem: false
            runAsNonRoot: false
            runAsUser: 0
      volumes:
        - name: plugins-dir
          emptyDir: {}
        - name: plugin-config
          configMap:
            name: headlamp-plugin-config
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: headlamp-oidc-secret
  namespace: headlamp
  labels:
    app.kubernetes.io/name: headlamp-oidc-secret
    app.kubernetes.io/instance: headlamp
    app.kubernetes.io/part-of: headlamp
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: OIDC_CLIENT_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /authentik/oidc/headlamp
        metadataPolicy: None
        property: client
    - secretKey: OIDC_CLIENT_SECRET
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /authentik/oidc/headlamp
        metadataPolicy: None
        property: secret
    - secretKey: OIDC_ISSUER_URL
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /authentik/oidc/headlamp
        metadataPolicy: None
        property: issuer
    - secretKey: OIDC_SCOPES
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /authentik/oidc/headlamp
        metadataPolicy: None
        property: scopes
    - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_IDP_ISSUER_URL
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /authentik/oidc/headlamp
        metadataPolicy: None
        property: validator-issuer-url
    - secretKey: HEADLAMP_CONFIG_OIDC_VALIDATOR_CLIENT_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /authentik/oidc/headlamp
        metadataPolicy: None
        property: validator-client-id
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: headlamp
  namespace: headlamp
  labels:
    app.kubernetes.io/name: headlamp
    app.kubernetes.io/instance: headlamp
    app.kubernetes.io/part-of: headlamp
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: traefik-gateway
      namespace: traefik
  hostnames:
    - headlamp.alexlebens.net
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - group: ''
          kind: Service
          name: headlamp
          port: 80
          weight: 100
---
apiVersion: v1
kind: Service
metadata:
  name: headlamp
  namespace: headlamp
  labels:
    helm.sh/chart: headlamp-0.40.1
    app.kubernetes.io/name: headlamp
    app.kubernetes.io/instance: headlamp
    app.kubernetes.io/version: "0.40.1"
    app.kubernetes.io/managed-by: Helm
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: http
      protocol: TCP
      name: http
  selector:
    app.kubernetes.io/name: headlamp
    app.kubernetes.io/instance: headlamp
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: headlamp-admin
  namespace: headlamp
  labels:
    app.kubernetes.io/name: headlamp-admin
    app.kubernetes.io/instance: headlamp
    app.kubernetes.io/part-of: headlamp
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: headlamp
  namespace: headlamp
  labels:
    helm.sh/chart: headlamp-0.40.1
    app.kubernetes.io/name: headlamp
    app.kubernetes.io/instance: headlamp
    app.kubernetes.io/version: "0.40.1"
    app.kubernetes.io/managed-by: Helm