feat(weave-gitops): enable OAuth

[martinohmann]

No description provided.

[github-actions]

--- kubernetes/apps/default/authelia/app Kustomization: flux-system/authelia ConfigMap: default/authelia

+++ kubernetes/apps/default/authelia/app Kustomization: flux-system/authelia ConfigMap: default/authelia

@@ -104,12 +104,21 @@

             public: false
             authorization_policy: two_factor
             pre_configured_consent_duration: 1y
             scopes: ["openid", "profile", "groups", "email"]
             redirect_uris: ["https://kube-web-view.18b.haus/oauth2/callback"]
             userinfo_signed_response_alg: none
+          - id: weave-gitops
+            description: Weave GitOps
+            secret: "${WEAVE_GITOPS_OIDC_CLIENT_SECRET_DIGEST}"
+            public: false
+            authorization_policy: two_factor
+            pre_configured_consent_duration: 1y
+            scopes: ["openid", "profile", "groups", "email"]
+            redirect_uris: ["https://gitops.18b.haus/oauth2/callback"]
+            userinfo_signed_response_alg: none
 kind: ConfigMap
 metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/substitute: disabled
   labels:
     app.kubernetes.io/name: authelia
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/weave-gitops

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/weave-gitops

@@ -5,12 +5,15 @@

   labels:
     kustomize.toolkit.fluxcd.io/name: cluster-apps
     kustomize.toolkit.fluxcd.io/namespace: flux-system
   name: weave-gitops
   namespace: flux-system
 spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: weave-gitops
   decryption:
     provider: sops
     secretRef:
       name: sops-age
   interval: 30m
   path: ./kubernetes/apps/flux-system/weave-gitops/app
@@ -22,9 +25,10 @@

       name: cluster-secrets
   prune: true
   retryInterval: 1m
   sourceRef:
     kind: GitRepository
     name: home-kubernetes
+  targetNamespace: flux-system
   timeout: 5m
   wait: false
 
--- kubernetes/apps/flux-system/weave-gitops/app Kustomization: flux-system/weave-gitops HelmRelease: flux-system/weave-gitops

+++ kubernetes/apps/flux-system/weave-gitops/app Kustomization: flux-system/weave-gitops HelmRelease: flux-system/weave-gitops

@@ -1,11 +1,12 @@

 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   labels:
+    app.kubernetes.io/name: weave-gitops
     kustomize.toolkit.fluxcd.io/name: weave-gitops
     kustomize.toolkit.fluxcd.io/namespace: flux-system
   name: weave-gitops
   namespace: flux-system
 spec:
   chart:
@@ -49,12 +50,10 @@

         - gitops.18b.haus
     metrics:
       enabled: true
     networkPolicy:
       create: false
     podAnnotations:
-      secret.reloader.stakater.com/reload: cluster-user-auth
+      secret.reloader.stakater.com/reload: cluster-user-auth,oidc-auth
     rbac:
       create: true
-      impersonationResourceNames:
-      - admin
 
--- kubernetes/apps/flux-system/weave-gitops/app Kustomization: flux-system/weave-gitops ClusterRoleBinding: flux-system/wego-admin-oidc

+++ kubernetes/apps/flux-system/weave-gitops/app Kustomization: flux-system/weave-gitops ClusterRoleBinding: flux-system/wego-admin-oidc

@@ -0,0 +1,18 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: weave-gitops
+    kustomize.toolkit.fluxcd.io/name: weave-gitops
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: wego-admin-oidc
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: wego-admin-cluster-role
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: Group
+  name: admins
+

[github-actions]

--- HelmRelease: flux-system/weave-gitops ClusterRole: flux-system/weave-gitops

+++ HelmRelease: flux-system/weave-gitops ClusterRole: flux-system/weave-gitops

@@ -8,14 +8,12 @@

   - ''
   resources:
   - users
   - groups
   verbs:
   - impersonate
-  resourceNames:
-  - admin
 - apiGroups:
   - ''
   resources:
   - secrets
   verbs:
   - get
--- HelmRelease: flux-system/weave-gitops Deployment: flux-system/weave-gitops

+++ HelmRelease: flux-system/weave-gitops Deployment: flux-system/weave-gitops

@@ -15,13 +15,13 @@

     matchLabels:
       app.kubernetes.io/name: weave-gitops
       app.kubernetes.io/instance: weave-gitops
   template:
     metadata:
       annotations:
-        secret.reloader.stakater.com/reload: cluster-user-auth
+        secret.reloader.stakater.com/reload: cluster-user-auth,oidc-auth
       labels:
         app.kubernetes.io/name: weave-gitops
         app.kubernetes.io/instance: weave-gitops
         app.kubernetes.io/part-of: weave-gitops
         weave.works/app: weave-gitops-oss
     spec: