Add OIDC to argocd

argocd/kustomization.yaml

@@ -16,4 +16,5 @@ patches:
       kind: ReplicaSet
       name: argocd-notifications-controller
     path: overlays/argocd-notifications-controller-patch.yaml
-  - path: overlays/argocd-cm.patch.yaml
+  - path: overlays/argocd-cm.patch.yaml
+  - path: overlays/argocd-rbac-cm.patch.yaml

argocd/overlays/argocd-cm.patch.yaml

@@ -6,7 +6,16 @@ metadata:
     app.kubernetes.io/name: argocd-cm
     app.kubernetes.io/part-of: argocd
 data:
-  # kustomize.buildOptions: "--enable-helm" 
+  url: https://argocd.rubenhensen.nl
+  oidc.config: |
+    name: Authentik
+    issuer: https://authentik.rubenhensen.nl/application/o/argocd/
+    clientID: argocd
+    clientSecret: $oidc.authentik.clientSecret
+    requestedScopes:
+      - openid
+      - profile
+      - email
   resource.exclusions: |
     - apiGroups:
       - "velero.io"

argocd/overlays/argocd-rbac-cm.patch.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+  labels:
+    app.kubernetes.io/name: argocd-rbac-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  policy.csv: |
+    g, ik@rubenhensen.nl, role:admin
+  scopes: "[email]"

argocd/webhook-es.yaml

@@ -10,12 +10,16 @@ spec:
     kind: ClusterSecretStore
   target:
     template:
-      type: kubernetes.io/dockerconfigjson
       data:
-        webhook.github.secret: "{{ .mysecret | toString }}"
+        webhook.github.secret: "{{ .webhook_secret | toString }}"
+        oidc.authentik.clientSecret: "{{ .oidc_client_secret | toString }}"
     name: argocd-secret
-    creationPolicy: Owner
+    creationPolicy: Merge
   data:
-  - secretKey: mysecret
+  - secretKey: webhook_secret
     remoteRef:
       key: github_secret
+  - secretKey: oidc_client_secret
+    remoteRef:
+      key: kv/argocd-oidc
+      property: client_secret