feat(apps): add Crossview Crossplane dashboard behind SSO + Headlamp plugin

[devantler]

What

Adds the Crossview (crossplane-contrib) web dashboard as a Hetzner-only Flux app so the cluster's Crossplane resources get a UI — surfaced both as a Homepage tile and inside Headlamp via the crossview-headlamp plugin. Crossplane landed on the platform in #2039; this gives it a frontend.

What's included

• New app k8s/bases/apps/crossview/
  • helm-release.yaml — chart crossview 4.4.0 (latest stable; 4.5.0-rc.1 skipped as an RC) from https://crossplane-contrib.github.io/crossview/
  • helm-repository.yaml, namespace.yaml (PSS restricted), httproute.yaml, networkpolicy.yaml
• SSO — crossview.${domain} fronted by oauth2-proxy/Dex, mirroring coroot/opencost/longhorn:
  • auth-proxy ConfigMap router + service → crossview-service.crossview.svc:80
  • oauth2-proxy ReferenceGrant entry for the crossview namespace
  • HTTPRoute backends to oauth2-proxy with X-Auth-Request-Redirect + HSTS filters
• Headlamp — crossview-headlamp plugin 0.1.4 added to the pluginsManager list
• Registered in bases/apps/kustomization.yaml; Homepage tile via gethomepage.dev/* annotations (group Kubernetes)

Key decisions

• GitOps-clean embed. Crossview is Flux-managed; the Headlamp plugin only opens/embeds it. The plugin's Install/Update/Uninstall buttons run a cluster-admin Helm Job — intentionally unused (noted in-code). Don't click them.
• Ephemeral Postgres. The chart bundles Postgres with a 10Gi PVC by default; database.persistence.enabled: false runs it ephemeral so we don't place a stateful Longhorn volume on prod (the autoscaler-node data-loss footgun). Acceptable for a read-only, SSO-fronted dashboard — session/user rows reset on restart.
• Hetzner-only. Registered via bases/apps, which only the hetzner provider includes (docker deploys no apps). The auth-proxy/ReferenceGrant entries live in the controllers layer (both providers) but are inert on local/CI — no local HTTPRoute routes crossview.${domain} — mirroring the existing longhorn precedent.

Validation

• ksail workload validate and ksail --config ksail.prod.yaml workload validate → 347 files validated, exit 0 (all 5 crossview manifests included).
• kubectl kustomize of clusters/local + clusters/prod, plus the providers/{hetzner,docker}/{apps,infrastructure/controllers} paths → all build; Crossview present in hetzner/apps, absent from docker/apps; auth-proxy router present in both (inert on local).

Note: static validation doesn't render HelmRelease values against the chart (Flux does that at runtime); values keys were taken from the chart's values.yaml.

Runtime-verify / follow-ups (can't be checked statically)

• SSO identity passthrough — oauth2-proxy gates access (secure regardless), but whether Crossview's auth.mode: session + trustedHeader: X-Auth-User seamlessly adopts the proxy identity may need header mapping (oauth2-proxy emits X-Auth-Request-*).
• iframe embed inside Headlamp ("Open Crossview") may need CSP/frame-ancestors tuning given the SSO redirect.
• Bundled postgres:latest under PSS restricted + ephemeral should run but is unverified on this cluster; pin a real tag if it misbehaves.
• Secrets hardening — chart defaults (admin/password, empty session secret) are used; recommend a SOPS-encrypted override of secrets.adminPassword/sessionSecret/dbPassword.

🤖 Generated with Claude Code

[botantler-1]

🎉 This PR is included in version 1.67.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀