REFACTOR(headlamp): switch to authelia

- Remove OIDC config from helm-values
- Remove ExternalSecret (not needed)
- Add Authelia middleware to ingress
- Headlamp uses ServiceAccount for K8s API access

headlamp/ingress.yaml

@@ -5,6 +5,7 @@ metadata:
   namespace: headlamp
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.middlewares: authelia-authelia-auth@kubernetescrd
 spec:
   ingressClassName: traefik
   tls: