feat: deploy dexidp

[bo0tzz]

No description provided.

[github-actions]

--- kubernetes/flux Kustomization: flux-system/cluster HelmRepository: flux-system/dex

+++ kubernetes/flux Kustomization: flux-system/cluster HelmRepository: flux-system/dex

@@ -0,0 +1,14 @@

+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: dex
+  namespace: flux-system
+spec:
+  interval: 30m
+  timeout: 3m
+  url: https://charts.dexidp.io
+
--- kubernetes/apps Kustomization: flux-system/cluster-apps Namespace: flux-system/authentication

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Namespace: flux-system/authentication

@@ -0,0 +1,9 @@

+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: authentication
+
--- kubernetes/apps Kustomization: flux-system/cluster-apps OnePasswordItem: authentication/github-oauth-client

+++ kubernetes/apps Kustomization: flux-system/cluster-apps OnePasswordItem: authentication/github-oauth-client

@@ -0,0 +1,12 @@

+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: github-oauth-client
+  namespace: authentication
+spec:
+  itemPath: vaults/Kubernetes/items/github-oauth-client
+
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/dexidp

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/dexidp

@@ -0,0 +1,26 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: dexidp
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: dexidp
+  dependsOn:
+  - name: cluster-apps-onepassword
+  interval: 30m
+  path: ./kubernetes/apps/authentication/dexidp/app
+  prune: true
+  retryInterval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: immich-kubernetes
+  targetNamespace: authentication
+  timeout: 5m
+  wait: true
+
--- kubernetes/apps/authentication/dexidp/app Kustomization: flux-system/dexidp HelmRelease: authentication/dex

+++ kubernetes/apps/authentication/dexidp/app Kustomization: flux-system/dexidp HelmRelease: authentication/dex

@@ -0,0 +1,88 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: dexidp
+    kustomize.toolkit.fluxcd.io/name: dexidp
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: dex
+  namespace: authentication
+spec:
+  chart:
+    spec:
+      chart: dex
+      interval: 5m
+      sourceRef:
+        kind: HelmRepository
+        name: dex
+        namespace: flux-system
+      version: 0.15.3
+  interval: 5m
+  values:
+    config:
+      connectors:
+      - config:
+          clientID: $GITHUB_CLIENT_ID
+          clientSecret: $GITHUB_CLIENT_SECRET
+          orgs:
+          - name: immich-app
+          redirectURI: https://auth.immich.cloud/callback
+        id: github
+        name: GitHub
+        type: github
+      enablePasswordDB: false
+      expiry:
+        idTokens: 24h
+        signingKeys: 6h
+      frontend:
+        issuer: immich
+        issuerUrl: https://auth.immich.cloud
+        logoUrl: https://github.com/immich-app/immich/raw/main/design/immich-logo-no-outline.png
+      issuer: https://auth.immich.cloud
+      logger:
+        format: text
+        level: debug
+      oauth2:
+        alwaysShowLoginScreen: false
+        responseTypes:
+        - code
+        - token
+        - id_token
+        skipApprovalScreen: true
+      staticClients: []
+      storage:
+        config:
+          inCluster: true
+        type: kubernetes
+      web:
+        http: 0.0.0.0:5556
+    env:
+      KUBERNETES_POD_NAMESPACE: authentication
+    envFrom:
+    - secretRef:
+        name: github-oauth-client
+    image:
+      repository: ghcr.io/dexidp/dex
+      tag: v2.37.0
+    ingress:
+      annotations:
+        cert-manager.io/cluster-issuer: letsencrypt-production
+      className: nginx
+      enabled: true
+      hosts:
+      - host: auth.immich.cloud
+        paths:
+        - path: /
+          pathType: Prefix
+      tls:
+      - hosts:
+        - auth.immich.cloud
+        secretName: dex-tls
+    resources:
+      limits:
+        memory: 100Mi
+      requests:
+        cpu: 10m
+        memory: 100Mi
+

[github-actions]

--- HelmRelease: authentication/dex ServiceAccount: authentication/dex

+++ HelmRelease: authentication/dex ServiceAccount: authentication/dex

@@ -0,0 +1,10 @@

+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: dex
+  labels:
+    app.kubernetes.io/name: dex
+    app.kubernetes.io/instance: dex
+    app.kubernetes.io/managed-by: Helm
+
--- HelmRelease: authentication/dex ClusterRole: authentication/dex

+++ HelmRelease: authentication/dex ClusterRole: authentication/dex

@@ -0,0 +1,18 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: dex
+  labels:
+    app.kubernetes.io/name: dex
+    app.kubernetes.io/instance: dex
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - list
+  - create
+
--- HelmRelease: authentication/dex ClusterRoleBinding: authentication/dex-cluster

+++ HelmRelease: authentication/dex ClusterRoleBinding: authentication/dex-cluster

@@ -0,0 +1,18 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: dex-cluster
+  labels:
+    app.kubernetes.io/name: dex
+    app.kubernetes.io/instance: dex
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  kind: ClusterRole
+  apiGroup: rbac.authorization.k8s.io
+  name: dex
+subjects:
+- kind: ServiceAccount
+  namespace: authentication
+  name: dex
+
--- HelmRelease: authentication/dex Role: authentication/dex

+++ HelmRelease: authentication/dex Role: authentication/dex

@@ -0,0 +1,17 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: dex
+  labels:
+    app.kubernetes.io/name: dex
+    app.kubernetes.io/instance: dex
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups:
+  - dex.coreos.com
+  resources:
+  - '*'
+  verbs:
+  - '*'
+
--- HelmRelease: authentication/dex RoleBinding: authentication/dex

+++ HelmRelease: authentication/dex RoleBinding: authentication/dex

@@ -0,0 +1,18 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: dex
+  labels:
+    app.kubernetes.io/name: dex
+    app.kubernetes.io/instance: dex
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  kind: Role
+  apiGroup: rbac.authorization.k8s.io
+  name: dex
+subjects:
+- kind: ServiceAccount
+  namespace: authentication
+  name: dex
+
--- HelmRelease: authentication/dex Service: authentication/dex

+++ HelmRelease: authentication/dex Service: authentication/dex

@@ -0,0 +1,26 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dex
+  labels:
+    app.kubernetes.io/name: dex
+    app.kubernetes.io/instance: dex
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+  - name: http
+    port: 5556
+    targetPort: http
+    protocol: TCP
+    appProtocol: http
+  - name: telemetry
+    port: 5558
+    targetPort: telemetry
+    protocol: TCP
+    appProtocol: http
+  selector:
+    app.kubernetes.io/name: dex
+    app.kubernetes.io/instance: dex
+
--- HelmRelease: authentication/dex Deployment: authentication/dex

+++ HelmRelease: authentication/dex Deployment: authentication/dex

@@ -0,0 +1,73 @@

+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dex
+  labels:
+    app.kubernetes.io/name: dex
+    app.kubernetes.io/instance: dex
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: dex
+      app.kubernetes.io/instance: dex
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: dex
+        app.kubernetes.io/instance: dex
+    spec:
+      serviceAccountName: dex
+      securityContext: {}
+      containers:
+      - name: dex
+        securityContext: {}
+        image: ghcr.io/dexidp/dex:v2.37.0
+        imagePullPolicy: IfNotPresent
+        args:
+        - dex
+        - serve
+        - --web-http-addr
+        - 0.0.0.0:5556
+        - --telemetry-addr
+        - 0.0.0.0:5558
+        - /etc/dex/config.yaml
+        env:
+        - name: KUBERNETES_POD_NAMESPACE
+          value: authentication
+        envFrom:
+        - secretRef:
+            name: github-oauth-client
+        ports:
+        - name: http
+          containerPort: 5556
+          protocol: TCP
+        - name: telemetry
+          containerPort: 5558
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /healthz/live
+            port: telemetry
+        readinessProbe:
+          httpGet:
+            path: /healthz/ready
+            port: telemetry
+        resources:
+          limits:
+            memory: 100Mi
+          requests:
+            cpu: 10m
+            memory: 100Mi
+        volumeMounts:
+        - name: config
+          mountPath: /etc/dex
+          readOnly: true
+      volumes:
+      - name: config
+        secret:
+          secretName: dex
+
--- HelmRelease: authentication/dex Ingress: authentication/dex

+++ HelmRelease: authentication/dex Ingress: authentication/dex

@@ -0,0 +1,29 @@

+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dex
+  labels:
+    app.kubernetes.io/name: dex
+    app.kubernetes.io/instance: dex
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - auth.immich.cloud
+    secretName: dex-tls
+  rules:
+  - host: auth.immich.cloud
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: dex
+            port:
+              number: 5556
+