Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-05-05 17:50:31

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

k8s/apps/k8s-secrets/ingress.yaml

@@ -0,0 +1,46 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: auth-proxy
+spec:
+  forwardAuth:
+    address: http://auth-proxy.auth-proxy.svc:80/auth
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-Auth-Request-User
+      - X-Auth-Request-Email
+      - X-Auth-Request-Groups
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: secret-reader
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`pass.hexor.cy`)
+      kind: Rule
+      middlewares:
+        - name: auth-proxy
+      services:
+        - name: secret-reader
+          port: 80
+  tls:
+    secretName: secret-reader-tls
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: secret-reader-tls
+spec:
+  secretName: secret-reader-tls
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+  dnsNames:
+    - pass.hexor.cy
+

k8s/core/argocd/values.yaml

@@ -24,31 +24,30 @@ configs:
     statusbadge.enabled: true
     timeout.reconciliation: 60s
     oidc.config: |
-      name: Authentik
+      name: Keycloak
-      issuer: https://idm.hexor.cy/application/o/argocd/
+      issuer: https://auth.hexor.cy/auth/realms/hexor
       clientID: $oidc-creds:id
       clientSecret: $oidc-creds:secret
-      requestedScopes: ["openid", "profile", "email", "groups", "offline_access"]
+      requestedScopes: ["openid", "profile", "email", "offline_access"]
       requestedIDTokenClaims: {"groups": {"essential": true}}
       refreshTokenThreshold: 2m
   rbac:
     create: true
     policy.default: ""
     policy.csv: |
-      # Bound OIDC Group and internal role
+        g, game-servers-managers, GameServersManagersRole
-      g, Game Servers Managers, GameServersManagersRole
+        # Role permissions
-      # Role permissions
+        p, GameServersManagersRole, applications, get, games/*, allow
-      p, GameServersManagersRole, applications, get, games/*, allow
+        p, GameServersManagersRole, applications, update, games/*, allow
-      p, GameServersManagersRole, applications, update, games/*, allow
+        p, GameServersManagersRole, applications, sync, games/*, allow
-      p, GameServersManagersRole, applications, sync, games/*, allow
+        p, GameServersManagersRole, applications, override, games/*, allow
-      p, GameServersManagersRole, applications, override, games/*, allow
+        p, GameServersManagersRole, applications, action/*, games/*, allow
-      p, GameServersManagersRole, applications, action/*, games/*, allow
+        p, GameServersManagersRole, exec, create, games/*, allow
-      p, GameServersManagersRole, exec, create, games/*, allow
+        p, GameServersManagersRole, logs, get, games/*, allow
-      p, GameServersManagersRole, logs, get, games/*, allow
+        p, GameServersManagersRole, applications, delete, games/*, deny
-      p, GameServersManagersRole, applications, delete, games/*, deny
+    
-
+        # Admin policy
-      # Admin policy
+        g, argocd-admins, role:admin
-      g, ArgoCD Admins, role:admin
 
   secret:
     createSecret: true

k8s/core/auth-proxy/deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: auth-proxy
-          image: ultradesu/rsauth2-proxy:0.1.0
+          image: ultradesu/rsauth2-proxy:latest
           ports:
             - containerPort: 8080
               name: http

k8s/core/auth-proxy/kustomization.yaml

@@ -7,4 +7,5 @@ resources:
   - deployment.yaml
   - service.yaml
   - ingress.yaml
+  - servicemonitor.yaml
 # routes.yaml ConfigMap is managed by Terraform (kubernetes_config_map)