feat: add dex chart

[CasLubbers]

📌 Summary

🔍 Reviewer Notes

🧹 Checklist

• Code is readable, maintainable, and robust.
• Unit tests added/updated

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[Copilot]

🟡 Changes recommended

Dex’s generated config currently contains at least one invalid setting that can prevent Dex from starting and/or causes continuous Secret churn (and rollouts) when enabled.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR introduces Dex as a new (currently disabled-by-default) APL “core app”, including a vendored Helm chart, APL values templates (Helmfile + Go templates), schema/defaults wiring, and an ADR describing the longer-term direction for using Dex as an OIDC issuer.

Changes:

• Add Dex Helm chart under charts/dex/ and register it in charts/dependencies.yaml.
• Wire Dex into APL’s values pipeline (defaults, derived values, schema, Helmfile releases, fixtures) and add ExternalSecret-based configuration/secrets generation.
• Add an ADR documenting the Dex-as-issuer design rationale and tradeoffs.

File summaries

File	Description
values/dex/dex.gotmpl	APL chart values template for Dex (image override, routing, RBAC, resources).
values/dex/dex-raw.gotmpl	Raw manifests for Dex (ServiceEntry + ExternalSecrets + generators).
values-schema.yaml	Adds apps.dex schema (enablement, replicas, resources, idp clientID, etc.).
tests/fixtures/env/apps/dex.yaml	Adds Dex app fixture values for template/values validation.
helmfile.d/snippets/dex-config.gotmpl	Dex config.yaml template rendered into an ExternalSecret-managed Secret.
helmfile.d/snippets/derived.gotmpl	Adds _derived.dexDomain for consistent domain computation.
helmfile.d/snippets/defaults.yaml	Adds Dex defaults under apps.dex (disabled by default).
helmfile.d/helmfile-05.init.yaml.gotmpl	Adds dex-artifacts (raw) and dex (chart) releases gated by apps.dex.enabled.
core.yaml	Adds the dex namespace to the platform namespaces list.
charts/dex/values.yaml	Vendored Dex chart default values.
charts/dex/templates/tests/no-config-secret.yaml	Helm test template for the “no config secret creation” scenario.
charts/dex/templates/servicemonitor.yaml	ServiceMonitor template (optional Prometheus scrape).
charts/dex/templates/serviceaccount.yaml	ServiceAccount template (optional).
charts/dex/templates/service.yaml	Service template (http/https/grpc/telemetry).
charts/dex/templates/secret.yaml	Config Secret template (when configSecret.create is true).
charts/dex/templates/rbac.yaml	RBAC templates for Dex CRDs/CRs access.
charts/dex/templates/poddisruptionbudget.yaml	PDB template (optional).
charts/dex/templates/NOTES.txt	Helm install notes for accessing Dex.
charts/dex/templates/networkpolicy.yaml	NetworkPolicy template (optional).
charts/dex/templates/ingress.yaml	Ingress template (optional).
charts/dex/templates/httproute.yaml	Gateway API HTTPRoute template (optional).
charts/dex/templates/hpa.yaml	HPA template (optional).
charts/dex/templates/deployment.yaml	Deployment template for Dex workload.
charts/dex/templates/_helpers.tpl	Chart helper templates (names/labels/namespace helpers).
charts/dex/README.md	Vendored chart README.
charts/dex/LICENSE	Vendored chart license.
charts/dex/Chart.yaml	Dex chart metadata.
charts/dex/.helmignore	Helm ignore patterns for the chart.
charts/dependencies.yaml	Registers Dex dependency (repo + version).
adr/2026-08-06-dex-as-issuer.md	Architectural decision record for Dex as issuer direction.

Review details

• Files reviewed: 30/30 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[svcAPLBot]

Comparison of Helm chart templating output:

# New file added: dex-dex
# New file added: dex-dex-artifacts
# otomi-api/templates/core-config.yaml

@@ data.core.yaml @@
! ± value change in multiline text (one insert, no deletions)
  adminApps:
  - deps:
    - prometheus
    name: alertmanager
  
  [536 lines unchanged)]
  
    - app: grafana
      name: grafana
    - disableIstioInjection: true
      name: istio-system
+   - app: dex
+     name: dex
    - name: keycloak
    - disableIstioInjection: true
      name: apl-keycloak-operator
    - app: knative
  
  [66 lines unchanged)]
  
    path: /explore?orgId=1&left=%7B"datasource":"loki","queries":%5B%7B"refId":"A","expr":"","queryType":"range","datasource":%7B"type":"loki","uid":"loki"%7D%7D%5D,"range":%7B"from":"now-1h","to":"now"%7D%7D
    useHost: grafana
  - name: tekton
    ownHost: true

# otomi-api/templates/deployment.yaml

# rabbitmq-cluster-operator/templates/messaging-topology-operator/validating-webhook-configuration.yaml

# values-repo.yaml

@@ apps @@
! + one map entry added:
+ dex:
+   resources:
+     limits:
+       cpu: 200m
+       memory: 128Mi
+     requests:
+       cpu: 20m
+       memory: 64Mi
+   _rawValues: {}
+   enabled: true
+   replicas: 1
+   idp:
+     clientID: otomi