initial scaffold

apps/kubernetes-dashboard/helmrelease.yaml

@@ -0,0 +1,22 @@
+# Deliberately no ingress here — the official Dashboard grants whatever the
+# logged-in identity can do, and a leaked cluster-admin token to a publicly
+# reachable Dashboard is a well-known real-world breach vector (see e.g. the
+# 2018 Tesla incident). Access is via `kubectl port-forward` only
+# (docs/SETUP.md step 12) — no standing hostname, no attack surface between
+# sessions.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: kubernetes-dashboard
+      version: ">=7.0.0"
+      sourceRef:
+        kind: HelmRepository
+        name: kubernetes-dashboard
+        namespace: kubernetes-dashboard
+  values: {}