Declare Kubernetes Dashboard Argo adoption without pruning

2026-10-23 14:43:03 +02:00
parent 53ba9da07d
commit e8dccbaa1c
6 changed files with 150 additions and 0 deletions
@@ -0,0 +1,14 @@
+# Site policy: the Authentik-protected Dashboard proxy acts as cluster-admin.
+# The chart owns the admin-user ServiceAccount and rotates its projected token.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: admin-user
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  name: admin-user
+  namespace: kubernetes-dashboard
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- admin-user-binding.yaml
@@ -0,0 +1,64 @@
+app:
+  security:
+    existingCsrfSecret: true
+    podDisruptionBudget:
+      enabled: true
+      maxUnavailable: 1
+  settings:
+    global:
+      clusterName: arschrock
+      defaultNamespace: default
+
+auth:
+  scaling:
+    replicas: 2
+    revisionHistoryLimit: 3
+  containers:
+    resources:
+      requests: {cpu: 25m, memory: 200Mi}
+      limits: {cpu: 250m, memory: 400Mi}
+api:
+  scaling:
+    replicas: 2
+    revisionHistoryLimit: 3
+  containers:
+    resources:
+      requests: {cpu: 25m, memory: 200Mi}
+      limits: {cpu: 250m, memory: 400Mi}
+web:
+  scaling:
+    replicas: 2
+    revisionHistoryLimit: 3
+  containers:
+    resources:
+      requests: {cpu: 25m, memory: 200Mi}
+      limits: {cpu: 250m, memory: 400Mi}
+metricsScraper:
+  scaling:
+    revisionHistoryLimit: 3
+  containers:
+    resources:
+      requests: {cpu: 25m, memory: 200Mi}
+      limits: {cpu: 250m, memory: 400Mi}
+kong:
+  replicaCount: 2
+  resources:
+    requests: {cpu: 25m, memory: 256Mi}
+    limits: {cpu: 500m, memory: 512Mi}
+  proxy:
+    type: ClusterIP
+    http:
+      enabled: false
+    tls:
+      enabled: true
+cert-manager:
+  enabled: false
+nginx:
+  enabled: false
+metrics-server:
+  enabled: false
+
+authProxy:
+  enabled: true
+  serviceAccountName: admin-user
+  traefikNamespace: default