Glance dashboard for mk-labs, deployed on fastpass (Talos/Kubernetes).
Managed by ArgoCD. All config is code. No manual kubectl required after initial bootstrap.

Repo layout

cluster/
  argocd/
    the-hub-application.yaml   # ArgoCD Application — drop this in with your platform apps
  applications/
    the-hub/
      namespace.yaml
      rbac.yaml                # ServiceAccount + ClusterRole (read-only K8s access)
      externalsecret.yaml      # ESO ExternalSecret — pulls tokens from 1Password
      deployment.yaml
      service.yaml
      ingress.yaml
      configmap.yaml           # glance.yml lives here — this is where you edit the dashboard

URL

https://the-hub.local.mk-labs.cloud

TLS via cert-manager + Cloudflare DNS-01 (letsencrypt-prod ClusterIssuer).

Secrets (1Password → ESO)

Create a 1Password vault item named the-hub with these fields:

Field	Value
`proxmox_token`	`user@pam!token-name=<uuid>`
`pbs_token`	`PBSAPIToken=user@pam!token-name=<uuid>`
`grafana_token`	Grafana service account token (read-only)
`gitea_token`	Gitea personal access token (read-only)

ESO syncs these into the the-hub-secrets Kubernetes Secret. The Deployment mounts them as environment variables, which glance.yml references via ${VAR_NAME} syntax.

Proxmox API token setup

Create a read-only API token in Proxmox:

Datacenter → Permissions → API Tokens → Add
User: any read-only user (or root@pam for lab use)
Token ID: glance
Uncheck "Privilege Separation" only if you want full access
Assign role PVEAuditor to the token at the / path

Token format in 1Password: user@pam!glance=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

SSO (Authentik forward-auth)

SSO annotations are present but commented out in ingress.yaml. Uncomment when guest-relations Authentik SSO is configured for fastpass ingress.

Editing the dashboard

The entire dashboard lives in configmap.yaml under the glance.yml key.

Edit cluster/applications/the-hub/configmap.yaml
Commit + push
ArgoCD syncs automatically (or argocd app sync the-hub)
Glance hot-reloads the config — no pod restart needed for content changes (pod restarts only needed when env var secrets change)

Pages

Page	Purpose
Overview	Service health monitors + bookmarks + Gitea repo activity
Infrastructure	Proxmox node stats, PBS status, Grafana iframe
Updates	Homelab YouTuber RSS, K8s/Argo release tracking, tech news