From 0fd7bf1135db936ce4cf30b1876273845de6cb44 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Mon, 6 Apr 2026 18:44:32 +0200 Subject: [PATCH] Add OIDC to argocd --- apps/templates/authentik-helm.yaml | 17 ++++++++++ argocd/kustomization.yaml | 3 +- argocd/overlays/argocd-cm.patch.yaml | 11 ++++++- argocd/overlays/argocd-rbac-cm.patch.yaml | 11 +++++++ argocd/webhook-es.yaml | 12 ++++--- authentik/blueprint-argocd-oidc.yaml | 40 +++++++++++++++++++++++ authentik/external-secret.yaml | 18 ++++++++++ 7 files changed, 106 insertions(+), 6 deletions(-) create mode 100644 argocd/overlays/argocd-rbac-cm.patch.yaml create mode 100644 authentik/blueprint-argocd-oidc.yaml diff --git a/apps/templates/authentik-helm.yaml b/apps/templates/authentik-helm.yaml index bbac4a9..16ced28 100644 --- a/apps/templates/authentik-helm.yaml +++ b/apps/templates/authentik-helm.yaml @@ -71,6 +71,11 @@ spec: secretKeyRef: name: stalwart-oidc-client-secret key: client_secret + - name: ARGOCD_OIDC_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: argocd-oidc-client-secret + key: client_secret server: volumes: - name: blueprint-vault @@ -82,6 +87,9 @@ spec: - name: blueprint-ldap configMap: name: authentik-blueprint-ldap + - name: blueprint-argocd + configMap: + name: authentik-blueprint-argocd volumeMounts: - name: blueprint-vault mountPath: /blueprints/custom/vault-oidc.yaml @@ -92,6 +100,9 @@ spec: - name: blueprint-ldap mountPath: /blueprints/custom/ldap.yaml subPath: ldap.yaml + - name: blueprint-argocd + mountPath: /blueprints/custom/argocd-oidc.yaml + subPath: argocd-oidc.yaml ingress: enabled: true ingressClassName: nginx @@ -114,6 +125,9 @@ spec: - name: blueprint-ldap configMap: name: authentik-blueprint-ldap + - name: blueprint-argocd + configMap: + name: authentik-blueprint-argocd volumeMounts: - name: blueprint-vault mountPath: /blueprints/custom/vault-oidc.yaml @@ -124,6 +138,9 @@ spec: - name: blueprint-ldap mountPath: /blueprints/custom/ldap.yaml subPath: ldap.yaml + - name: blueprint-argocd + mountPath: /blueprints/custom/argocd-oidc.yaml + subPath: argocd-oidc.yaml postgresql: enabled: false redis: diff --git a/argocd/kustomization.yaml b/argocd/kustomization.yaml index 415cb72..679bfc5 100644 --- a/argocd/kustomization.yaml +++ b/argocd/kustomization.yaml @@ -16,4 +16,5 @@ patches: kind: ReplicaSet name: argocd-notifications-controller path: overlays/argocd-notifications-controller-patch.yaml - - path: overlays/argocd-cm.patch.yaml \ No newline at end of file + - path: overlays/argocd-cm.patch.yaml + - path: overlays/argocd-rbac-cm.patch.yaml \ No newline at end of file diff --git a/argocd/overlays/argocd-cm.patch.yaml b/argocd/overlays/argocd-cm.patch.yaml index d428658..afd92d9 100644 --- a/argocd/overlays/argocd-cm.patch.yaml +++ b/argocd/overlays/argocd-cm.patch.yaml @@ -6,7 +6,16 @@ metadata: app.kubernetes.io/name: argocd-cm app.kubernetes.io/part-of: argocd data: - # kustomize.buildOptions: "--enable-helm" + url: https://argocd.rubenhensen.nl + oidc.config: | + name: Authentik + issuer: https://authentik.rubenhensen.nl/application/o/argocd/ + clientID: argocd + clientSecret: $oidc.authentik.clientSecret + requestedScopes: + - openid + - profile + - email resource.exclusions: | - apiGroups: - "velero.io" diff --git a/argocd/overlays/argocd-rbac-cm.patch.yaml b/argocd/overlays/argocd-rbac-cm.patch.yaml new file mode 100644 index 0000000..102836d --- /dev/null +++ b/argocd/overlays/argocd-rbac-cm.patch.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: argocd-rbac-cm + labels: + app.kubernetes.io/name: argocd-rbac-cm + app.kubernetes.io/part-of: argocd +data: + policy.csv: | + g, ik@rubenhensen.nl, role:admin + scopes: "[email]" diff --git a/argocd/webhook-es.yaml b/argocd/webhook-es.yaml index f05e6e1..07e7d1c 100644 --- a/argocd/webhook-es.yaml +++ b/argocd/webhook-es.yaml @@ -10,12 +10,16 @@ spec: kind: ClusterSecretStore target: template: - type: kubernetes.io/dockerconfigjson data: - webhook.github.secret: "{{ .mysecret | toString }}" + webhook.github.secret: "{{ .webhook_secret | toString }}" + oidc.authentik.clientSecret: "{{ .oidc_client_secret | toString }}" name: argocd-secret - creationPolicy: Owner + creationPolicy: Merge data: - - secretKey: mysecret + - secretKey: webhook_secret remoteRef: key: github_secret + - secretKey: oidc_client_secret + remoteRef: + key: kv/argocd-oidc + property: client_secret diff --git a/authentik/blueprint-argocd-oidc.yaml b/authentik/blueprint-argocd-oidc.yaml new file mode 100644 index 0000000..61a0bed --- /dev/null +++ b/authentik/blueprint-argocd-oidc.yaml @@ -0,0 +1,40 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: authentik-blueprint-argocd +data: + argocd-oidc.yaml: | + version: 1 + metadata: + name: ArgoCD OIDC + entries: + - model: authentik_providers_oauth2.oauth2provider + id: argocd-provider + state: present + identifiers: + name: ArgoCD + attrs: + name: ArgoCD + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + client_type: confidential + client_id: argocd + client_secret: !Env [ARGOCD_OIDC_CLIENT_SECRET, ""] + redirect_uris: + - matching_mode: strict + url: https://argocd.rubenhensen.nl/auth/callback + signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]] + property_mappings: + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]] + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]] + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]] + - model: authentik_core.application + id: argocd-app + state: present + identifiers: + slug: argocd + attrs: + name: ArgoCD + provider: !KeyOf argocd-provider + meta_launch_url: https://argocd.rubenhensen.nl diff --git a/authentik/external-secret.yaml b/authentik/external-secret.yaml index b65939f..143f05e 100644 --- a/authentik/external-secret.yaml +++ b/authentik/external-secret.yaml @@ -81,3 +81,21 @@ spec: remoteRef: key: kv/stalwart-oidc property: client_secret +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: argocd-oidc-client-secret +spec: + secretStoreRef: + name: vault-backend + kind: ClusterSecretStore + refreshInterval: 15m + target: + name: argocd-oidc-client-secret + creationPolicy: Owner + data: + - secretKey: client_secret + remoteRef: + key: kv/argocd-oidc + property: client_secret