From b2f08e1cacab9b270f41c7141083834cee15ee7a Mon Sep 17 00:00:00 2001
From: xnoto <steven@makeitwork.cloud>
Date: Fri, 31 Jul 2026 17:54:48 -0600
Subject: [PATCH] chore(headlamp): prepare safe removal

---
 bootstrap/argocd-config.yaml        | 7 +++++++
 operators/headlamp/application.yaml | 2 ++
 2 files changed, 9 insertions(+)

diff --git a/bootstrap/argocd-config.yaml b/bootstrap/argocd-config.yaml
index e80bebc..6c736d6 100644
--- a/bootstrap/argocd-config.yaml
+++ b/bootstrap/argocd-config.yaml
@@ -111,6 +111,13 @@ spec:
               teamNameField: slug
               useLoginAsID: true
         staticClients:
+          # kubelogin uses this public client for kubectl OIDC authentication.
+          - id: kubectl
+            name: kubectl
+            public: true
+            redirectURIs:
+              - http://localhost:8000
+              - http://localhost:18000
           # Headlamp uses Dex as its OIDC provider (Dex bridges to GitHub).
           - id: headlamp
             name: Headlamp
diff --git a/operators/headlamp/application.yaml b/operators/headlamp/application.yaml
index 45b756c..c806073 100644
--- a/operators/headlamp/application.yaml
+++ b/operators/headlamp/application.yaml
@@ -4,6 +4,8 @@ kind: Application
 metadata:
   name: headlamp
   namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
   annotations:
     argocd.argoproj.io/sync-wave: "1"
 spec: