From 1d9f00dbc3080b6fa1e9428c07342b4156068bc8 Mon Sep 17 00:00:00 2001
From: admin <admin@pit4noshit.de>
Date: Sat, 5 Sep 2026 01:06:20 +0200
Subject: [PATCH] headlamp: deploy via ArgoCD with Keycloak OIDC login and
 Traefik ingress

---
 key-components/headlamp.yaml | 53 ++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 key-components/headlamp.yaml

diff --git a/key-components/headlamp.yaml b/key-components/headlamp.yaml
new file mode 100644
index 0000000..23fcfb8
--- /dev/null
+++ b/key-components/headlamp.yaml
@@ -0,0 +1,53 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: headlamp
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://kubernetes-sigs.github.io/headlamp
+    chart: headlamp
+    targetRevision: 0.45.0
+    helm:
+      releaseName: headlamp
+      values: |
+        config:
+          oidc:
+            secret:
+              create: false
+              name: headlamp-oidc
+            clientID: rke2
+            clientSecret: "set-via-headlamp-oidc-secret"
+            issuerURL: https://auth.dahmens.de/realms/dahmens
+            scopes: "openid,profile,email"
+            callbackURL: https://headlamp.pit4noshit.de/oidc-callback
+        serviceAccount:
+          create: true
+        clusterRoleBinding:
+          create: false
+        ingress:
+          enabled: true
+          ingressClassName: traefik
+          annotations:
+            cert-manager.io/cluster-issuer: letsencrypt-prod
+          hosts:
+            - host: headlamp.pit4noshit.de
+              paths:
+                - path: /
+                  pathType: Prefix
+          tls:
+            - secretName: headlamp-tls
+              hosts:
+                - headlamp.pit4noshit.de
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: headlamp
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true