cilium, argo

argocd/argocd-cm.yaml

@@ -0,0 +1,69 @@
+# ------------------------------------------------------------------------------
+# argocd-cm — ArgoCD Core Configuration
+#
+# Configures:
+#   - ArgoCD public URL (used in Dex redirect URIs)
+#   - Dex connector to Authentik OIDC
+#   - Gitea repo credentials reference
+#
+# Authentik side setup (manual — do this in guest-relations before bootstrapping):
+#   1. Admin UI → Applications → Create New Application
+#   2. Provider type: OAuth2/OpenID Connect
+#   3. Name: argocd
+#   4. Authorization flow: default-provider-authorization-explicit-consent
+#   5. Client type: Confidential
+#   6. Strict redirect URIs:
+#        https://argocd.local.mk-labs.cloud/api/dex/callback
+#        http://localhost:8085/auth/callback        (ArgoCD CLI)
+#   7. Scopes: openid, profile, email, groups
+#   8. Note the Client ID and Client Secret → store in 1Password as:
+#        Item: "argocd-oidc"
+#        Fields: client-id, client-secret
+#   9. Create two groups in Authentik:
+#        - argocd-admins  (add your user)
+#        - argocd-viewers (read-only users)
+# ------------------------------------------------------------------------------
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+  namespace: argocd
+data:
+  # Public URL — must match the HTTPRoute hostname
+  url: https://argocd.local.mk-labs.cloud
+
+  # Dex connector to Authentik
+  # Using Dex (not native OIDC) to preserve ArgoCD CLI functionality
+  dex.config: |
+    connectors:
+      - type: oidc
+        id: authentik
+        name: Authentik
+        config:
+          # Authentik OIDC issuer — slug must match the Application slug in Authentik
+          # Slug is auto-generated from the app name, usually lowercase with hyphens
+          issuer: https://authentik.local.mk-labs.cloud/application/o/argocd/
+          clientID: $dex.authentik.clientID
+          clientSecret: $dex.authentik.clientSecret
+          redirectURI: https://argocd.local.mk-labs.cloud/api/dex/callback
+          scopes:
+            - openid
+            - profile
+            - email
+            - groups
+          insecureEnableGroups: true
+          groupsKey: groups
+          userIDKey: sub
+          userNameKey: preferred_username
+          emailKey: email
+
+  # Gitea repo — ArgoCD needs credentials to pull from your private repo
+  # Credentials are stored as a Repository secret (see repository-secret.yaml)
+  # This tells ArgoCD to use SSH for the repo
+  repositories: |
+    - url: git@gitea.mk-labs.cloud:rblundon/homelab.git
+      type: git
+      name: homelab
+
+  # Resource tracking via annotation (recommended over label tracking)
+  application.resourceTrackingMethod: annotation