From d18ec755debfb248ff5e72a124e2ae58c820db8f Mon Sep 17 00:00:00 2001 From: xnoto Date: Fri, 31 Jul 2026 18:12:13 -0600 Subject: [PATCH] chore(headlamp): remove remaining resources --- bootstrap/secrets/github-oauth-secret.yaml | 9 ++- operators/headlamp/application.yaml | 70 ------------------- .../headlamp/ksops-headlamp-secrets.yaml | 10 --- operators/headlamp/kustomization.yaml | 8 --- operators/headlamp/namespace.yaml | 7 -- operators/headlamp/oidc-secret.yaml | 29 -------- operators/kustomization.yaml | 1 - 7 files changed, 4 insertions(+), 130 deletions(-) delete mode 100644 operators/headlamp/application.yaml delete mode 100644 operators/headlamp/ksops-headlamp-secrets.yaml delete mode 100644 operators/headlamp/kustomization.yaml delete mode 100644 operators/headlamp/namespace.yaml delete mode 100644 operators/headlamp/oidc-secret.yaml diff --git a/bootstrap/secrets/github-oauth-secret.yaml b/bootstrap/secrets/github-oauth-secret.yaml index 37684c0..29cf8b2 100644 --- a/bootstrap/secrets/github-oauth-secret.yaml +++ b/bootstrap/secrets/github-oauth-secret.yaml @@ -14,13 +14,11 @@ stringData: # Callback URL: https://argocd.makeitwork.cloud/api/dex/callback dex.github.clientID: ENC[AES256_GCM,data:zPuSme7WNDyFt7bpeqtPy+tZyHU=,iv:mj2QOgHFdUFNNb4zm37MDQQ43FTQtx49Hg9w4k1XEEA=,tag:vWXANlK+Z/LZI3jwaYUhmw==,type:str] dex.github.clientSecret: ENC[AES256_GCM,data:g53ok+zuNccR47ngruY9HsXRO0JbGazW32MMduvfaim2QBKs03ATCg==,iv:QqaXEDFwKpaEC1Evdaj4j1jmJzbXpevMcYXxqLF1o8U=,tag:sAQU431fwCQH3vAYOm9O1Q==,type:str] - dex.headlamp.clientSecret: ENC[AES256_GCM,data:iO6N04zWyzvaHcs8Bd2fIaYayDAHPonQM/0CI8wXynrH0nklrQpTBuFgCarJ5/iUbGKWKQsECEAH/yzTmqCNIg==,iv:eDlO8C0OJFSnp0d90Qgj2hJqCaa74Fw58dB/VNhFvZg=,tag:GcZdcjnSOab+LWfXgGb3lw==,type:str] dex.grafana.clientSecret: ENC[AES256_GCM,data:W83Zy4wsbNIUza47swtVAYjYbMiVSbLiPyBjEAj3cBHafRv4LMDtXCe/U9UWvyqMnsVdcXqsmE2FflDGQLBDcQ==,iv:nmsgCR7D35Tya0DRJZUMPtPEkElRJeqInzk4N2yMgP8=,tag:srmM2rscemUDOUjaz/fqhQ==,type:str] dex.forgejo.clientSecret: ENC[AES256_GCM,data:E1Fs089ssIsMc5vnrjPbEFjsbAQQq82obeNsS7be4vklXVs37BdedTnOWiAWCrahyPoc3MqqEE3W5Rgutd63OQ==,iv:Ael18r8WxOvZSZ5wktGYQqPyege9Ybs54e2yLU7YSG0=,tag:tRkzxr2qZOwonBUMR+c7Kg==,type:str] sops: age: - - recipient: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhSUw4bitIcHA2OHYyR21D V0tGdFBDcUh1TW03NSt2bnR0MFVSeFc1bEJZCnM4K05nRzdnTDRUQzZZV29Ca29j @@ -28,7 +26,8 @@ sops: T2dvNlRjNE1lNFVHWnJWNTA2Z2M5STgKUX9gEItGx811Wsq/GjUwe+pxyi9lt5gY uqKM/eXkZyz9S3HqinAhw5xiPEBokqmNcpaOHtHNgpgkhJY9YFCllQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-30T05:14:39Z" - mac: ENC[AES256_GCM,data:Ya/DL6Nl+L2LvDT6X/ysesBSY3C2TQpYsHd8vYcfgQPRvUx6z2hBPt7stTgMyALmMaItcxb7OJdYjgs5Hg3VlTYjH84iXyLgLcQX8DcM3Cscq4LJQWTsDmYxx/u8ebaaCXoCSEYFv1Qg8gdw4LlZCAvixmOuxgpJpevjNDgU5Fw=,iv:czbb86e4QoUwZVaY+nyImM3VYmwtADmycINhOjD0rno=,tag:Z+wqDbfOLF082SuQrntCXQ==,type:str] + recipient: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l encrypted_regex: ^(token|api-token|apiToken|clientID|clientSecret|client_id|client_secret|password|secret|github_token|CLOUDFLARE_API_TOKEN|credentials\.json|.*_SERVICE_KEY|GF_AUTH_GITHUB_CLIENT_SECRET|GF_SECURITY_ADMIN_PASSWORD|dex\.[a-z]+\.clientID|dex\.[a-z]+\.clientSecret)$ + lastmodified: "2026-08-01T00:10:39Z" + mac: ENC[AES256_GCM,data:6Lo/bz7h9abvXCOGDd6ZEZKxh2eYJddMzFRLkNYGUPGbJ69giWkLrVzbiVBjGGVrAVc6yrx+a+OUohWciqCt8kO3R9Hf1fG7rIQjAxbg3lqACPeQzg/2k8TOmTVJj/1Y05bDaM1xP9axSJJwKvIYl6TPC9R3h2V/OeX6ZjGhGzw=,iv:vpIVXDqbUCvWukusbNXJTwgyOtExZA0F4/PrM1EwRJk=,tag:UizM+5eQ6Oai0cCAOE1D1g==,type:str] version: 3.12.2 diff --git a/operators/headlamp/application.yaml b/operators/headlamp/application.yaml deleted file mode 100644 index c806073..0000000 --- a/operators/headlamp/application.yaml +++ /dev/null @@ -1,70 +0,0 @@ ---- -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: headlamp - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io - annotations: - argocd.argoproj.io/sync-wave: "1" -spec: - project: default - destination: - server: https://kubernetes.default.svc - namespace: headlamp - source: - chart: headlamp - repoURL: https://kubernetes-sigs.github.io/headlamp/ - targetRevision: 0.41.0 - helm: - releaseName: headlamp - values: | - config: - oidc: - # The chart envFroms this Secret into the container, so its keys - # must match Headlamp's expected env-var names (OIDC_CLIENT_ID, - # OIDC_CLIENT_SECRET, OIDC_ISSUER_URL, OIDC_SCOPES). See - # operators/headlamp/oidc-secret.yaml. - externalSecret: - enabled: true - name: headlamp-oidc - # Skip the chart's auto-generated Secret entirely — externalSecret - # supplies everything the Deployment needs. - secret: - create: false - # Store the auth session in a cookie so the popup callback flow - # doesn't depend on window.opener postMessage (which drops state - # across cross-origin redirects through Dex/GitHub). - useCookie: true - # Pin the callback URL Headlamp advertises to Dex so it doesn't - # depend on Host-header inference behind the Cloudflare proxy. - # Actual env value comes from headlamp-oidc Secret's OIDC_CALLBACK_URL. - callbackURL: "set-by-secret" - serviceAccount: - create: true - clusterRoleBinding: - create: true - clusterRoleName: cluster-admin - resources: - requests: - cpu: 50m - memory: 64Mi - limits: - memory: 256Mi - # Kubernetes defaults `pod.spec.hostUsers: true` server-side; the chart - # doesn't declare it, so ArgoCD sees permanent drift on the Deployment. - # Ignore that one path. - ignoreDifferences: - - group: apps - kind: Deployment - name: headlamp - jsonPointers: - - /spec/template/spec/hostUsers - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - ServerSideApply=true - - RespectIgnoreDifferences=true diff --git a/operators/headlamp/ksops-headlamp-secrets.yaml b/operators/headlamp/ksops-headlamp-secrets.yaml deleted file mode 100644 index fcc9c4a..0000000 --- a/operators/headlamp/ksops-headlamp-secrets.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: viaduct.ai/v1 -kind: ksops -metadata: - name: ksops-headlamp-secrets - annotations: - config.kubernetes.io/function: | - exec: - path: ksops -files: - - oidc-secret.yaml diff --git a/operators/headlamp/kustomization.yaml b/operators/headlamp/kustomization.yaml deleted file mode 100644 index 699eece..0000000 --- a/operators/headlamp/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - namespace.yaml - - application.yaml -generators: - - ksops-headlamp-secrets.yaml diff --git a/operators/headlamp/namespace.yaml b/operators/headlamp/namespace.yaml deleted file mode 100644 index 1388c99..0000000 --- a/operators/headlamp/namespace.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: headlamp - annotations: - argocd.argoproj.io/sync-wave: "0" diff --git a/operators/headlamp/oidc-secret.yaml b/operators/headlamp/oidc-secret.yaml deleted file mode 100644 index b43b16e..0000000 --- a/operators/headlamp/oidc-secret.yaml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: headlamp-oidc - namespace: headlamp - annotations: - argocd.argoproj.io/sync-wave: "0" -type: Opaque -stringData: - OIDC_CLIENT_ID: ENC[AES256_GCM,data:KpDxUsoRQdE=,iv:V3ZbGfbfu+LtMhUcjEslwouiNUlsIv0FBz4FVXemriE=,tag:PIui9KnoC+o7G7Cl6oOwAw==,type:str] - OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:TXBMWVAEU7OLNJx6mrZcK3rbLlTB9GL5hTAAXTwwzSa9xTXLU8l/MJ51g2YcbmSWu8bNGa5mi1bExzkvSGhwXQ==,iv:xKDnl7qCPM2ttNWW2OU2a1f4FNzHDz+loLLKuBdN5+g=,tag:CT1vk4kf0sEKdXy9CUVgbg==,type:str] - OIDC_ISSUER_URL: https://argocd.makeitwork.cloud/api/dex - OIDC_SCOPES: openid profile email groups - OIDC_CALLBACK_URL: https://headlamp.makeitwork.cloud/oidc-callback -sops: - age: - - recipient: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmU0wzYlpJZnNlMnVxdTc2 - RDNuYTRvZ2J2bGZVL2NTdEsxTmdLMEhLM1cwCmcvUmNmZloxb0ZDZVVkbFRTcTI5 - Y0Q3eU9kMk5CL1lScVQ5MUl0a3NQR0EKLS0tIGFsajNjcjNtbGNzWk9DQldGeWk3 - Y2FhOENiWW1aNy9WbER3eXIvNXhXRnMKzdWk5njxD8yiSjhv5a1jZ9giCZWTnNpK - jvqHY7FMWuQMowlEwkbpgUeEbcf4kabl5clCr4w7mh0doYWt3u/7SQ== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-30T04:08:46Z" - mac: ENC[AES256_GCM,data:E2iADOwXoG6bcZesH+S6s9GCeas+Yqty6CYr1BhI2fNeyb7I2IlaPwadhx40cEH7DN/Rr4aId1VF3M6e4Vti3EA6qDfAEqOsPEX65QeVQHXwjHQQr8185EvxvNz0mILFtl5FWWTYUcP8JkTzkSmKwFlNmakV0QWpniJknKRH9O8=,iv:dXObwnkkpZ8woN4+v9eDCpKIXnBlmJzmZO5d9/YK8ag=,tag:QPrVNoUuYH/gJCaoaNrClQ==,type:str] - encrypted_regex: ^(token|api-token|apiToken|clientID|clientSecret|client_id|client_secret|password|secret|github_token|CLOUDFLARE_API_TOKEN|credentials\.json|.*_SERVICE_KEY|GF_AUTH_GITHUB_CLIENT_SECRET|GF_SECURITY_ADMIN_PASSWORD|dex\.[a-z]+\.clientID|dex\.[a-z]+\.clientSecret|OIDC_CLIENT_(ID|SECRET))$ - version: 3.12.2 diff --git a/operators/kustomization.yaml b/operators/kustomization.yaml index 1e7b01e..19165a9 100644 --- a/operators/kustomization.yaml +++ b/operators/kustomization.yaml @@ -9,6 +9,5 @@ resources: - cloudflare - forgejo - grafana - - headlamp - kube-prometheus-stack - tor-controller