apiVersion: v1
kind: ConfigMap
metadata:
  name: authentik-blueprint-argocd
data:
  argocd-oidc.yaml: |
    version: 1
    metadata:
      name: ArgoCD OIDC
    entries:
      - model: authentik_providers_oauth2.oauth2provider
        id: argocd-provider
        state: present
        identifiers:
          name: ArgoCD
        attrs:
          name: ArgoCD
          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
          authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
          client_type: confidential
          client_id: argocd
          client_secret: !Env [ARGOCD_OIDC_CLIENT_SECRET, ""]
          redirect_uris:
            - matching_mode: strict
              url: https://argocd.rubenhensen.nl/auth/callback
          signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
          property_mappings:
            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
      - model: authentik_core.application
        id: argocd-app
        state: present
        identifiers:
          slug: argocd
        attrs:
          name: ArgoCD
          provider: !KeyOf argocd-provider
          meta_launch_url: https://argocd.rubenhensen.nl