feat(argocd): Disable local admin account

apps/garage-ui/anubis-key-sealedsecret.yaml

@@ -1,12 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: anubis-key
-  namespace: garage
-spec:
-  encryptedData:
-    ED25519_PRIVATE_KEY_HEX: AgCviDZEvLfdKldhAtWubXmCxvCym6nEFBERMBDbfMftsCQdRdWFwAZ3IkQF5PqyBCjZ8jirQMttmXqL1GNKvJfEDkK4rwwYGkLpRM56IpRtkGhGHgYQOIYTa9RHzJm5OjPKnVppCRpb4Qe2MKczg8Uhp7Z3hW1HMDzK85Rzn2k41qcGqMRwEgDdmFVJxB9gviM76jcrgjnyNJvoIMinNwqRdTHmXnY451xDkBofEzkTXZC7plW42/3Vz/66bdqtHCmM68hZJkluki86ubHJqPIMuA55BJM7CRJTgKhk5va4Ex3j4RlTSF7ai+EGmF+jq6ls8Dn1QU12Osak97MulOEyCBHBQg3nnu5TZoFJKWT/Bgg0M9r1RuFyr6mrphVu6yMIIiROcyl95E3LjtMVC4o7+tWgkYmIOjYafQdpf7p6I2QPG4P6o/6qkEUWL1tqqYjk9RZ+OuOuBWe399in4OnRgfV+ZOJcCKXIsgbW1uVAiQL3lGMGI9/sDLxKtimpybGOX5F9f3O7mqFZ7FzkdvhgUtWkY+PUJIZHFNUSlF+ttmrj3wtq4JOpFdPYZqcnTCFFtwk+yDos8YWWjF0TX1RhM8Yq/+VBOVVaJnlhaolIKHiMds5JBGypsPjEBmP9fJ1ip4TjCyCP3p1/YscksgqjUWOCeASO9b50ce0OJzL9yHMGurffianLWR768q/1Zi5WQv6B9vJxCICa9TCCYgLOz0LUu0iiMd5hlPX0/i4gWi9KykIcSYHJ/RuE9+4jaqkYsTyhOipKPpkpjsqou9y1
-  template:
-    metadata:
-      name: anubis-key
-      namespace: garage

apps/garage-ui/anubis-proxy.yaml

@@ -1,44 +0,0 @@
-apiVersion: anubis.techaro.dev/v1alpha1
-kind: AnubisProxy
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: anubis
-  namespace: garage
-spec:
-  anubis:
-    envExtra:
-      - name: DIFFICULTY
-        value: "5"
-      - name: SERVE_ROBOTS_TXT
-        value: "true"
-      - name: COOKIE_DOMAIN
-        value: garage.whyredfire.dev
-      - name: REDIRECT_DOMAINS
-        value: garage.whyredfire.dev
-      - name: COOKIE_PARTITIONED
-        value: "true"
-      - name: COOKIE_HTTP_ONLY
-        value: "true"
-      - name: COOKIE_SAME_SITE
-        value: Lax
-      - name: DIFFICULTY_IN_JWT
-        value: "true"
-    image:
-      tag: v1.26.2
-    keys:
-      existingSecret: anubis-key
-    metrics:
-      enabled: false
-    persistence:
-      enabled: false
-    resources:
-      limits:
-        memory: 128Mi
-      requests:
-        cpu: 50m
-        memory: 64Mi
-  target:
-    service:
-      name: garage-ui
-      port: 80

apps/garage-ui/httproute.yaml

@@ -15,7 +15,7 @@ spec:
       sectionName: websecure
   rules:
     - backendRefs:
-        - name: anubis
+        - name: garage-ui
           port: 80
       matches:
         - path:

apps/garage-ui/kustomization.yaml

@@ -2,6 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
-  - anubis-key-sealedsecret.yaml
-  - anubis-proxy.yaml
   - httproute.yaml

apps/redoost/anubis-key-sealedsecret.yaml

@@ -1,12 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: anubis-key
-  namespace: redoost
-spec:
-  encryptedData:
-    ED25519_PRIVATE_KEY_HEX: AgBM3dp5L0MgvKQxGM0ljAHXqhTDcebV8emcKAeWbIdWn/749Dz4W5n0e3JuFEm7cHwl5nSomY6iccM1aX2h77u8ip8PBB4SWvnj0ymDEDPii3p4Z50tz9qkWU+IzqJiXcOX75NdVVaTsbzRARW/0+V8Df0/1T6C2xTIXITqlWoxsLlXwREdTdwBiSosuMUYDbXAAiNOVZ6B8yQgT/J9kjS9quUD3T9/nYet8iinJ+4AuCD3Ib/M0KQY+/pMQbhOfsBP8MdP2vDUoh05sh5G3N+sRju0ROHLK53KrqNkn0ROxPIW5zs+WmBaG92HALjojJbWQbvlDjs+IpeUDnBRz8hZ7jmz60X1+nqSm/nMUKvTh3IS9+gQwxtt+ModWETj69yKcx0DXi4Q/hMi+LvFBULcmU0VDvu0uOvnbR3J873Bj/1PlF0VSWGdOL7J18GXWwMLVoo2rrRU/sbntasiScbxs9HPqGmkdWGOObbgb9eSdrlN9AK1EmeGOkYcwx9WMML/40TfhxjObkK9Cp5yJ+z8F/zeIEYW51PEeqGWvwgKomLSeOy3BDFaqI09VUa3+6jp/+QB3CSdWLZlEGdKVu1OKLS7W8aOLH6MDIpPQ33JJcbW1SoZvm6MbKlSCdpOvNg7zZb6o7qtrfi9RmAiO5lv+4AQ5o/RSpfL5EElXULOjef/XajT5yhIiIJ6ZaRT5f6kVZcQZx2dkhp1cfrIfzGEdQX0Lnc+2Uq06+oUrplO/wwM+2qTD3XI6qGecnC10zBwq8A3rD2QXOi4vWXPL1K3
-  template:
-    metadata:
-      name: anubis-key
-      namespace: redoost

apps/redoost/anubis-proxy-api.yaml

@@ -1,44 +0,0 @@
-apiVersion: anubis.techaro.dev/v1alpha1
-kind: AnubisProxy
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: anubis-api
-  namespace: redoost
-spec:
-  anubis:
-    envExtra:
-      - name: DIFFICULTY
-        value: "5"
-      - name: SERVE_ROBOTS_TXT
-        value: "true"
-      - name: COOKIE_DOMAIN
-        value: redoost.whyredfire.dev
-      - name: REDIRECT_DOMAINS
-        value: redoost.whyredfire.dev
-      - name: COOKIE_PARTITIONED
-        value: "true"
-      - name: COOKIE_HTTP_ONLY
-        value: "true"
-      - name: COOKIE_SAME_SITE
-        value: Lax
-      - name: DIFFICULTY_IN_JWT
-        value: "true"
-    image:
-      tag: v1.26.2
-    keys:
-      existingSecret: anubis-key
-    metrics:
-      enabled: false
-    persistence:
-      enabled: false
-    resources:
-      limits:
-        memory: 128Mi
-      requests:
-        cpu: 50m
-        memory: 64Mi
-  target:
-    service:
-      name: redoost-api
-      port: 8000

apps/redoost/anubis-proxy-frontend.yaml

@@ -1,46 +0,0 @@
-apiVersion: anubis.techaro.dev/v1alpha1
-kind: AnubisProxy
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: anubis-frontend
-  namespace: redoost
-spec:
-  anubis:
-    envExtra:
-      - name: DIFFICULTY
-        value: "5"
-      - name: SERVE_ROBOTS_TXT
-        value: "true"
-      - name: COOKIE_DOMAIN
-        value: redoost.whyredfire.dev
-      - name: REDIRECT_DOMAINS
-        value: redoost.whyredfire.dev
-      - name: COOKIE_PARTITIONED
-        value: "true"
-      - name: COOKIE_HTTP_ONLY
-        value: "true"
-      - name: COOKIE_SAME_SITE
-        value: Lax
-      - name: DIFFICULTY_IN_JWT
-        value: "true"
-      - name: OG_PASSTHROUGH
-        value: "true"
-    image:
-      tag: v1.26.2
-    keys:
-      existingSecret: anubis-key
-    metrics:
-      enabled: false
-    persistence:
-      enabled: false
-    resources:
-      limits:
-        memory: 128Mi
-      requests:
-        cpu: 50m
-        memory: 64Mi
-  target:
-    service:
-      name: redoost-frontend
-      port: 8080

apps/redoost/kustomization.yaml

@@ -2,6 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
-  - anubis-key-sealedsecret.yaml
-  - anubis-proxy-api.yaml
-  - anubis-proxy-frontend.yaml

argocd-apps/add-ons/anubis-operator.yaml

@@ -3,6 +3,8 @@ kind: Application
 metadata:
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
   name: anubis-operator
   namespace: argocd
 spec:

argocd-apps/add-ons/kustomization.yaml

@@ -1,7 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - anubis-operator.yaml
   - argocd-dashboard.yaml
   - argocd-repos.yaml
   - authentik.yaml

argocd-apps/services/redoost.yaml

@@ -27,12 +27,6 @@ spec:
                   name: traefik-gateway
                   namespace: traefik
                   sectionName: websecure
-              apiBackendRef:
-                name: anubis-api
-                port: 80
-              frontendBackendRef:
-                name: anubis-frontend
-                port: 80
             sites:
               parentRefs:
                 - kind: Gateway

bootstrap/argocd-cm-admin-disabled-patch.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+data:
+  admin.enabled: "false"

bootstrap/kustomization.yaml

@@ -21,6 +21,10 @@ patches:
       kind: ConfigMap
       name: argocd-cm
     path: argocd-cm-oidc-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-cm
+    path: argocd-cm-admin-disabled-patch.yaml
   - target:
       kind: ConfigMap
       name: argocd-rbac-cm

infra/argocd-dashboard/anubis-key-sealedsecret.yaml

@@ -1,12 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: anubis-key
-  namespace: argocd
-spec:
-  encryptedData:
-    ED25519_PRIVATE_KEY_HEX: AgCR+UcOTNv+hAcK3jE3fb0AE5lQBuxl0Y7Yqt3Lg/Bhh89aPH2dRs0o2n/1MuCXNGOtBAXdyKtW6W3VtenD1uKsoz8da2UjO3+qvknLmrZzUqjcilmiJCS7POoECHhciCMJu1RrLkSQChjg+Kl6fZUbDSTK5GTh75yy7o1uRtXqbgXFtdVDYA8fwXLoAG4nWlSgRgGTUnTKTKooyx+ADEJOQWrFCP0zFkZJKUcGc60d6+5PyYGODDNjh1qed30O7xWyZcCVVUzeSkH5QCpBvALRzKLGBRjNTHAS4IGVelemPqsN5ti4w6fYGtkqi4OPuAuaC47kdEnLUvZeDB+Qxnwx6Qe7MEI4u8H2N6mP8jMH9MjQv4gzCTtPy90Vqikf7hJ0KFsI5CGXONbQkkyM1B3MNbyqkgmtZJchVbmeN9MZhZOS7JYUuexYosdiqRvyIOAWr1/rSN9LzwesXNAPojq8IZPDjIPcbFCBv1ROjsS/kXKawlLBMX+XEsQZUWUfTh9Cfn3N9muo4Sz+nQ11smXthSkVRaniJLIsd+MPXg/lHayP6MYWncPhj8ZZQHKwBNxsCHljh1cFsjfm/IrIDmre6eaREnsBrxh7QKtsoiWWclqgF4ziA4BVWHwkfpb1LjIQNDIkD+i66ijOmwpQoiCD8tWRKrvcGWy6bTDPMO0ErA5QVzDx8YMFmSC5Ii0iSWIR2ci+qlKgUHFedVnp2kOw4FyOxWsDnfJDBmwyPvXrfrbDcvSfKMTLn6VohWC4Zais5bIuhD0uAmCdfJzyRe+H
-  template:
-    metadata:
-      name: anubis-key
-      namespace: argocd

infra/argocd-dashboard/anubis-proxy.yaml

@@ -1,44 +0,0 @@
-apiVersion: anubis.techaro.dev/v1alpha1
-kind: AnubisProxy
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: anubis
-  namespace: argocd
-spec:
-  anubis:
-    envExtra:
-      - name: DIFFICULTY
-        value: "5"
-      - name: SERVE_ROBOTS_TXT
-        value: "true"
-      - name: COOKIE_DOMAIN
-        value: argo.whyredfire.dev
-      - name: REDIRECT_DOMAINS
-        value: argo.whyredfire.dev
-      - name: COOKIE_PARTITIONED
-        value: "true"
-      - name: COOKIE_HTTP_ONLY
-        value: "true"
-      - name: COOKIE_SAME_SITE
-        value: Lax
-      - name: DIFFICULTY_IN_JWT
-        value: "true"
-    image:
-      tag: v1.26.2
-    keys:
-      existingSecret: anubis-key
-    metrics:
-      enabled: false
-    persistence:
-      enabled: false
-    resources:
-      limits:
-        memory: 128Mi
-      requests:
-        cpu: 50m
-        memory: 64Mi
-  target:
-    service:
-      name: argocd-server
-      port: 80

infra/argocd-dashboard/httproute.yaml

@@ -15,7 +15,7 @@ spec:
       sectionName: websecure
   rules:
     - backendRefs:
-        - name: anubis
+        - name: argocd-server
           port: 80
       matches:
         - path:

infra/argocd-dashboard/kustomization.yaml

@@ -1,7 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - anubis-key-sealedsecret.yaml
-  - anubis-proxy.yaml
   - httproute.yaml
   - oidc-sealedsecret.yaml