Initial commit

apps/rancher/manifests/external-secret.yaml

@@ -0,0 +1,23 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: rancher-oauth
+  namespace: cattle-system
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: rancher-oauth-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: client-id
+      remoteRef:
+        key: secret/rancher-oauth
+        property: client-id
+    - secretKey: client-secret
+      remoteRef:
+        key: secret/rancher-oauth
+        property: client-secret

apps/rancher/manifests/istio-virtualservice.yaml

@@ -0,0 +1,16 @@
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: rancher
+  namespace: cattle-system
+spec:
+  hosts:
+    - rancher.kube.huskypup.net
+  gateways:
+    - istio-system/edge
+  http:
+    - route:
+        - destination:
+            host: rancher.cattle-system.svc.cluster.local
+            port:
+              number: 80

apps/rancher/values.yaml

@@ -0,0 +1,47 @@
+# apps/rancher/values.yaml
+# Rancher - Kubernetes Management Platform with Authentik SSO
+
+hostname: rancher.kube.huskypup.net
+
+# Exposed via Istio edge Gateway + VirtualService (apps/rancher/istio-virtualservice.yaml)
+ingress:
+  enabled: false
+
+# TLS terminates at Istio ingressgateway
+tls: external
+
+# Single replica for homelab (scale up if needed)
+replicas: 1
+
+# Storage class for Rancher's internal state
+# Note: Rancher itself is mostly stateless; state is in etcd/k8s
+resources:
+  requests:
+    cpu: 50m
+    memory: 512Mi
+  limits:
+    memory: 2Gi
+
+# Allow Rancher to manage the local cluster
+addLocal: "true"
+
+# Audit logging
+auditLog:
+  level: 1
+  maxAge: 7
+  maxBackup: 3
+  maxSize: 100
+
+# Bootstrap password - will be rotated post-deploy via Authentik SSO
+# This is used only for initial access before SSO is configured
+bootstrapPassword: "ChangeMe-BootstrapOnly"
+
+# Extra environment variables (not used for OIDC - configured via AuthConfig CRD post-deploy)
+extraEnv: []
+
+# Disable Rancher's bundled cert-manager (we already have it)
+certmanager:
+  version: ""
+
+# Feature flags
+features: "multi-cluster-management=true"