initial scaffold

apps/kubernetes-dashboard/helmrelease.yaml

@@ -0,0 +1,22 @@
+# Deliberately no ingress here — the official Dashboard grants whatever the
+# logged-in identity can do, and a leaked cluster-admin token to a publicly
+# reachable Dashboard is a well-known real-world breach vector (see e.g. the
+# 2018 Tesla incident). Access is via `kubectl port-forward` only
+# (docs/SETUP.md step 12) — no standing hostname, no attack surface between
+# sessions.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: kubernetes-dashboard
+      version: ">=7.0.0"
+      sourceRef:
+        kind: HelmRepository
+        name: kubernetes-dashboard
+        namespace: kubernetes-dashboard
+  values: {}

apps/kubernetes-dashboard/helmrepository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+spec:
+  interval: 1h
+  url: https://kubernetes.github.io/dashboard/

apps/kubernetes-dashboard/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - rbac.yaml
+  - helmrepository.yaml
+  - helmrelease.yaml

apps/kubernetes-dashboard/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kubernetes-dashboard

apps/kubernetes-dashboard/rbac.yaml

@@ -0,0 +1,32 @@
+# Cluster-admin ServiceAccount + long-lived token, used both to log in to
+# the Dashboard (docs/SETUP.md step 12) and as the client identity for
+# direct LAN kubectl access if you'd rather not manage the SSH-fetched
+# kubeconfig from step 6. Fine for a single-user homelab; split into
+# narrower-scoped accounts if more people get access later.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: admin-user
+  namespace: kubernetes-dashboard
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: admin-user
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: admin-user
+    namespace: kubernetes-dashboard
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: admin-user-token
+  namespace: kubernetes-dashboard
+  annotations:
+    kubernetes.io/service-account.name: admin-user
+type: kubernetes.io/service-account-token