feat(headlamp): install dashboard with ArgoCD Dex OIDC

operators/headlamp/application.yaml

@@ -0,0 +1,44 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: headlamp
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: default
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: headlamp
+  source:
+    chart: headlamp
+    repoURL: https://kubernetes-sigs.github.io/headlamp/
+    targetRevision: 0.41.0
+    helm:
+      releaseName: headlamp
+      values: |
+        config:
+          oidc:
+            # OIDC config is provided by the operators/headlamp/oidc-secret.yaml
+            # Secret which exists before this Application is reconciled.
+            secret:
+              create: false
+              name: oidc
+        serviceAccount:
+          create: true
+        clusterRoleBinding:
+          create: true
+          clusterRoleName: cluster-admin
+        resources:
+          requests:
+            cpu: 50m
+            memory: 64Mi
+          limits:
+            memory: 256Mi
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - ServerSideApply=true

operators/headlamp/ksops-headlamp-secrets.yaml

@@ -0,0 +1,10 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: ksops-headlamp-secrets
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: ksops
+files:
+  - oidc-secret.yaml

operators/headlamp/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - application.yaml
+generators:
+  - ksops-headlamp-secrets.yaml

operators/headlamp/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: headlamp
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"

operators/headlamp/oidc-secret.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: oidc
+    namespace: headlamp
+    annotations:
+        argocd.argoproj.io/sync-wave: "0"
+type: Opaque
+stringData:
+    clientID: ENC[AES256_GCM,data:b/RWN/cSdwc=,iv:/0BkklPXCiwDtcy6IIgc3ZZma+WMeDVjF2mM119L3Ls=,tag:eGvQE7d4/ogsKplLGLoaaA==,type:str]
+    clientSecret: ENC[AES256_GCM,data:pkr/0YYdyHalp+jzlFa3BDAXCLYDps0/J/N3ICk+O45sQnq0Cmmgphc+vVxcCHxCJUOAD48G6mfgwvSdtRiN2w==,iv:3KRDS+SMYSfWLlL/Q/CwsmDixVmliTCpY3AxiX3WtCQ=,tag:SEbj3VeiacpR975lBA1m8g==,type:str]
+    issuerURL: https://argocd.makeitwork.cloud/api/dex
+    scopes: openid profile email groups
+sops:
+    age:
+        - recipient: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQdXk4YlRqZW5xdTlNMzN1
+            M295aFlRTFhyTlByZjJTQUtPSDZuNnBhRUVJClF4ZWhjQUViVjZYOTJzQU5IMDVM
+            d3B5OWZ6M280Zm1PQXFuT1A4VGMvcGsKLS0tIEk2Sk9paFVUaTVYZ2xMTldwdWFG
+            U3RyQWdsL2JSU3NaOXFkdWx5NU9TTGsK5c3H5WUjUNuQkv4OEe2UygRSpF2RjnRW
+            lANaaut2T6anLCWj1Fl6buGoLosEHFROYF77qCLUMMEOu/rUTyIrTg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-30T03:23:57Z"
+    mac: ENC[AES256_GCM,data:jOC7YmhEfmO8Jp/0ZMxhovHRu9+wRalBDOS5g8RCQmiz3nS9HoXbByZZsF7TkKd4lIj1mKqf3B7xJ13jDdV3T7+fcUaZ1F6v3Xz3/5YkTqjZHNcSkz0HxjZ4RekZ9O+xWLuyFXXaSVbT+nPuLPiva8+2VWGhEsqJOPyLbdsG6sc=,iv:eYO1cedcAajmZVLE5hqg7vN4oE8TYKoUrvwVQvHbXeY=,tag:Xcj2BlG0YU5lnBUEca6vOQ==,type:str]
+    encrypted_regex: ^(token|api-token|apiToken|clientID|clientSecret|client_id|client_secret|password|secret|github_token|CLOUDFLARE_API_TOKEN|credentials\.json|.*_SERVICE_KEY|GF_AUTH_GITHUB_CLIENT_SECRET|GF_SECURITY_ADMIN_PASSWORD|dex\.[a-z]+\.clientID|dex\.[a-z]+\.clientSecret)$
+    version: 3.12.2

operators/kustomization.yaml

@@ -7,6 +7,7 @@ resources:
   - cert-manager
   - cloudflare
   - grafana
+  - headlamp
   - kube-prometheus-stack
   - tor-controller
   # ansible/ contains an OLM Subscription; AWX is being deprecated. Re-enable

workloads/apps/headlamp-app.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: headlamp
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/makeitworkcloud/kustomize-cluster.git
+    path: workloads/headlamp
+    targetRevision: main
+  destination:
+    server: https://kubernetes.default.svc
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - SkipDryRunOnMissingResource=true
+    retry:
+      limit: 5
+      backoff:
+        duration: 30s
+        maxDuration: 5m
+        factor: 2

workloads/apps/kustomization.yaml

@@ -10,6 +10,7 @@ resources:
   # Wave 1: Depend on operator CRDs (TunnelBinding requires cloudflare-operator)
   - arc-app.yaml
   - grafana-app.yaml
+  - headlamp-app.yaml
   - ../argocd  # Direct include - TunnelBinding for ArgoCD
   # ansible-app is paired with the AWX operator, which is being deprecated;
   # re-enable here only if the operator comes back.

workloads/headlamp/kustomization.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - tunnel-binding.yaml

workloads/headlamp/tunnel-binding.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: networking.cfargotunnel.com/v1alpha1
+kind: TunnelBinding
+metadata:
+  name: headlamp
+  namespace: headlamp
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+subjects:
+  - name: headlamp
+    spec:
+      fqdn: headlamp.makeitwork.cloud
+      target: http://headlamp.headlamp.svc:80
+tunnelRef:
+  kind: ClusterTunnel
+  name: cluster-apps