52 lines
3.7 KiB
Django/Jinja
52 lines
3.7 KiB
Django/Jinja
# Noble lab — web UIs (LAN)
|
|
|
|
> **Sensitive:** This file may include **passwords read from Kubernetes Secrets** when credential fetch ran. It is **gitignored** — do not commit or share.
|
|
|
|
**DNS:** point **`*.apps.noble.lab.pcenicni.dev`** at the Traefik **LoadBalancer** (MetalLB **`192.168.50.211`** by default — see `clusters/noble/apps/traefik/values.yaml`).
|
|
|
|
**TLS:** **cert-manager** + **`letsencrypt-prod`** on each Ingress (public **DNS-01** for **`pcenicni.dev`**).
|
|
|
|
This file is **generated** by Ansible (`noble_landing_urls` role). Use it as a temporary landing page to find services after deploy.
|
|
|
|
| UI | What | Kubernetes service | Namespace | URL |
|
|
|----|------|----------------------|-----------|-----|
|
|
{% for e in noble_lab_ui_entries %}
|
|
| {{ e.name }} | {{ e.description }} | `{{ e.service }}` | `{{ e.namespace }}` | [{{ e.url }}]({{ e.url }}) |
|
|
{% endfor %}
|
|
|
|
## Initial access (logins)
|
|
|
|
| App | Username / identity | Password / secret |
|
|
|-----|---------------------|-------------------|
|
|
| **Argo CD** | `admin` | {% if (noble_fetch_argocd_pw_b64 is defined) and (noble_fetch_argocd_pw_b64.rc | default(1) == 0) and (noble_fetch_argocd_pw_b64.stdout | default('') | length > 0) %}`{{ noble_fetch_argocd_pw_b64.stdout | b64decode }}`{% else %}*(not fetched — use commands below)*{% endif %} |
|
|
| **Grafana** | {% if (noble_fetch_grafana_user_b64 is defined) and (noble_fetch_grafana_user_b64.rc | default(1) == 0) and (noble_fetch_grafana_user_b64.stdout | default('') | length > 0) %}`{{ noble_fetch_grafana_user_b64.stdout | b64decode }}`{% else %}*(from Secret — use commands below)*{% endif %} | {% if (noble_fetch_grafana_pw_b64 is defined) and (noble_fetch_grafana_pw_b64.rc | default(1) == 0) and (noble_fetch_grafana_pw_b64.stdout | default('') | length > 0) %}`{{ noble_fetch_grafana_pw_b64.stdout | b64decode }}`{% else %}*(not fetched — use commands below)*{% endif %} |
|
|
| **Headlamp** | ServiceAccount **`headlamp`** | {% if (noble_fetch_headlamp_token is defined) and (noble_fetch_headlamp_token.rc | default(1) == 0) and (noble_fetch_headlamp_token.stdout | default('') | trim | length > 0) %}Token ({{ noble_landing_urls_headlamp_token_duration | default('48h') }}): `{{ noble_fetch_headlamp_token.stdout | trim }}`{% else %}*(not generated — use command below)*{% endif %} |
|
|
| **Prometheus** | — | No auth in default install (lab). |
|
|
| **Alertmanager** | — | No auth in default install (lab). |
|
|
| **Longhorn** | — | No default login unless you enable access control in the UI settings. |
|
|
| **Vault** | Token | Root token is only from **`vault operator init`** (not stored in git). See `clusters/noble/apps/vault/README.md`. |
|
|
|
|
### Commands to retrieve passwords (if not filled above)
|
|
|
|
```bash
|
|
# Argo CD initial admin (Secret removed after you change password)
|
|
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d
|
|
echo
|
|
|
|
# Grafana admin user / password
|
|
kubectl -n monitoring get secret kube-prometheus-grafana -o jsonpath='{.data.admin-user}' | base64 -d
|
|
echo
|
|
kubectl -n monitoring get secret kube-prometheus-grafana -o jsonpath='{.data.admin-password}' | base64 -d
|
|
echo
|
|
```
|
|
|
|
To generate this file **without** calling kubectl, run Ansible with **`-e noble_landing_urls_fetch_credentials=false`**.
|
|
|
|
## Notes
|
|
|
|
- **Argo CD** `argocd-initial-admin-secret` disappears after you change the admin password.
|
|
- **Grafana** password is random unless you set `grafana.adminPassword` in chart values.
|
|
- **Vault** UI needs **unsealed** Vault; tokens come from your chosen auth method.
|
|
- **Prometheus / Alertmanager** UIs are unauthenticated by default — restrict when hardening (`talos/CLUSTER-BUILD.md` Phase G).
|
|
- **Headlamp** token above expires after the configured duration; re-run Ansible or `kubectl create token` to refresh.
|