feat(open-webui): migrate to k8s

kubernetes/apps/default/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - bento-pdf/ks.yaml
   - homepage/ks.yaml
   - rackpeek/ks.yaml
+  - open-webui/ks.yaml

kubernetes/apps/default/open-webui/app/external-secret.yaml

@@ -0,0 +1,23 @@
+---
+# yaml-language-server: $schema=https://kube-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: &name open-webui-secrets
+spec:
+  secretStoreRef:
+    name: bitwarden-secrets-manager
+    kind: ClusterSecretStore
+  data:
+    - secretKey: OPENAI_API_KEYS
+      remoteRef:
+        key: "7bb7c8f6-cff8-4376-9b16-b44d001faec8"
+    - secretKey: OAUTH_CLIENT_ID
+      remoteRef:
+        key: "876c897e-46ba-4e80-aa8c-b3ee018293b6"
+    - secretKey: OAUTH_CLIENT_SECRET
+      remoteRef:
+        key: "070a254e-dcac-45b5-b815-b3ee0180a339"
+    - secretKey: DATABASE_URL
+      remoteRef:
+        key: "4f53b805-b2d7-45d6-ae5b-b43a0039a86b"

kubernetes/apps/default/open-webui/app/helmrelease.yaml

@@ -0,0 +1,65 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: open-webui
+spec:
+  interval: 15m
+  chartRef:
+    kind: OCIRepository
+    name: open-webui
+  values:
+    ollama:
+      enabled: false
+    pipelines:
+      enabled: false
+    tika:
+      enabled: false
+    terminals:
+      enabled: false
+    workload:
+      kind: Deployment
+    image:
+      repository: ghcr.io/open-webui/open-webui
+      tag: v0.9.5
+      pullPolicy: "IfNotPresent"
+      useSlim: false
+    route:
+      enabled: true
+      hostnames: ["chat.mafyuh.dev"]
+      parentRefs:
+        - name: envoy-external
+          namespace: kube-system
+          sectionName: https
+    persistence:
+      enabled: true
+      accessMode:
+        - ReadWriteOnce
+      size: 1Gi
+      storageClass: ceph-block
+    enableOpenaiApi: true
+    openaiBaseApiUrls:
+      - "https://integrate.api.nvidia.com/v1"
+      - "https://openrouter.ai/api/v1"
+      - "http://10.20.10.55:8080/v1" # copilot-api https://github.com/ericc-ch/copilot-api
+    openaiApiKeysExistingSecret: "open-webui-secrets"
+    openaiApiKeysExistingSecretKey: "OPENAI_API_KEYS"
+    databaseUrl: "${DATABASE_URL}"
+    sso:
+      enabled: true
+      enableSignup: true
+      mergeAccountsByEmail: true
+      oidc:
+        enabled: true
+        providerName: "Authentik"
+        providerUrl: "https://auth.mafyuh.io/application/o/open-webui/.well-known/openid-configuration"
+        scopes: "openid email profile"
+        clientExistingSecret: "open-webui-secrets"
+        clientIdExistingSecretKey: "OAUTH_CLIENT_ID"
+        clientExistingSecretKey: "OAUTH_CLIENT_SECRET"
+    extraEnvVars:
+      - name: ENABLE_LOGIN_FORM
+        value: "false"
+      - name: OPENID_REDIRECT_URI
+        value: "https://chat.mafyuh.dev/oauth/oidc/callback"

kubernetes/apps/default/open-webui/app/source.yaml

@@ -0,0 +1,14 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/ocirepository_v1.json
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: open-webui
+spec:
+  interval: 15m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 14.5.0
+  url: oci://ghcr.io/open-webui/helm-charts/open-webui

kubernetes/apps/default/open-webui/ks.yaml

@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app open-webui
+  namespace: &ns default
+spec:
+  targetNamespace: *ns
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  interval: 30m
+  timeout: 5m
+  path: ./kubernetes/apps/default/open-webui/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: iac
+    namespace: flux-system
+  wait: false
+  postBuild:
+    substitute:
+      APP: open-webui
+    substituteFrom:
+      - kind: Secret
+        name: open-webui-secrets