This repository maintains a narrowly patched copy of the final upstream Kubernetes Dashboard 7.14.0 chart, with the optional Authentik-facing authentication proxy used by this homelab. Dashboard is archived upstream, so treat this as a compatibility deployment rather than a source of application updates.

The chart keeps the upstream resource names and the Kong subchart. Its sole upstream-template change adds app.security.existingCsrfSecret: when true, the chart references the existing kubernetes-dashboard-csrf Secret but does not render or rotate it. The Secret must contain private.key and is deliberately not stored in the public GitOps repository. For a fresh, ordinary install, leave this option false so the upstream chart creates the key. The optional authProxy.enabled adds the private nginx proxy, projected service-account token, Service, ConfigMap, NetworkPolicy, and PDB. The site-specific cluster-admin binding and public Traefik route are not part of this chart.

For an independent test installation:

./install.sh

The homelab deployment is managed by Argo CD from homelab-gitops. Do not run install.sh against that Argo-managed release. Its values and cluster-admin binding are in apps/kubernetes-dashboard/ in GitOps; the existing CSRF Secret is a separately preserved cluster bootstrap object. Argo skips the vendored Kong CRDs because this release does not use Kong's Ingress Controller.

On main, Gitea Actions lints and packages the chart, publishes it to the public indexed repository, and promotes its exact chart version in GitOps. The Git tag v7.14.0 follows the upstream Dashboard chart release; chart-only commits append Git describe count and hash.