Merge commit 'fe564d72279f4ab061b961dd528623f0ed272667' as 'cluster-config'

cluster-config/components/gitops-operator/overlays/shared/kustomization.yaml

@@ -0,0 +1,73 @@
+namespace: gitops
+
+resources:
+  - ../../base
+  - argocd-cluster-role.yaml
+  - gitops-monitoring-cluster-role.yaml
+  - namespace.yaml
+  - argocd-notifications-cm.yaml
+  - console-link.yaml
+  - global-appproject.yaml
+  - prometheus-rules.yaml
+
+patches:
+  # Update permissions for tenants and local accounts, note ACCOUNT_NAMESPACES is space separated
+  - patch: |-
+      - op: replace
+        path: /spec/template/spec/containers/0/env
+        value:
+          - name: ACCOUNTS_NAMESPACES
+            value: "product-catalog-pipeline=product-catalog-cicd rollouts-demo-pipeline=rollouts-demo-cicd"
+          - name: ARGO_SERVER_HOST
+            value: "argocd-server-gitops.${SUB_DOMAIN}"
+    target:
+      kind: Job
+      name: create-pipeline-local-user
+  - target:
+      kind: ArgoCD
+      name: argocd
+    patch: |-
+      - op: add
+        path: /spec/defaultClusterScopedRoleDisabled
+        value: true
+      - op: add
+        path: /spec/extraConfig
+        value:
+          resource.respectRBAC: "strict"
+          exec.enabled: "true"
+          globalProjects: |-
+            - labelSelector:
+                matchExpressions:
+                  - key: argocd.argoproj.io/project-inherit
+                    operator: In
+                    values:
+                      - global
+              projectName: global
+          accounts.product-catalog-pipeline: apiKey
+          accounts.rollouts-demo-pipeline: apiKey
+          oidc.config: |
+            name: Keycloak
+            issuer: https://sso.ocplab.com/realms/ocplab
+            clientID: argocd
+            clientSecret: $oidc.keycloak.clientSecret
+            requestedScopes: ["openid", "profile", "email", "groups"]
+      - op: add
+        path: /spec/sourceNamespaces
+        value:
+          - product-catalog-gitops
+          - rollouts-demo-gitops
+      - op: add
+        path: /spec/rbac
+        value:
+          defaultPolicy: 'role:none'
+          policy: |
+            p, role:none, *, *, */*, deny
+            g, system:cluster-admins, role:admin
+            g, cluster-admins, role:admin
+            p, role:developers, clusters, get, *, allow
+            p, role:developers, repositories, get, *, allow
+            g, developers, role:developers
+          scopes: "[accounts,groups]"
+      - op: add
+        path: /spec/server/host
+        value: "argocd-server-gitops.${SUB_DOMAIN}"