namespace: gitops

resources:
  - ../../base
  - argocd-cluster-role.yaml
  - gitops-monitoring-cluster-role.yaml
  - namespace.yaml
  - argocd-notifications-cm.yaml
  - console-link.yaml
  - global-appproject.yaml
  - prometheus-rules.yaml

patches:
  # Update permissions for tenants and local accounts, note ACCOUNT_NAMESPACES is space separated
  - patch: |-
      - op: replace
        path: /spec/template/spec/containers/0/env
        value:
          - name: ACCOUNTS_NAMESPACES
            value: "product-catalog-pipeline=product-catalog-cicd rollouts-demo-pipeline=rollouts-demo-cicd"
          - name: ARGO_SERVER_HOST
            value: "argocd-server-gitops.${SUB_DOMAIN}"
    target:
      kind: Job
      name: create-pipeline-local-user
  - target:
      kind: ArgoCD
      name: argocd
    patch: |-
      - op: add
        path: /spec/defaultClusterScopedRoleDisabled
        value: true
      - op: add
        path: /spec/extraConfig
        value:
          resource.respectRBAC: "strict"
          exec.enabled: "true"
          globalProjects: |-
            - labelSelector:
                matchExpressions:
                  - key: argocd.argoproj.io/project-inherit
                    operator: In
                    values:
                      - global
              projectName: global
          accounts.product-catalog-pipeline: apiKey
          accounts.rollouts-demo-pipeline: apiKey
          oidc.config: |
            name: Keycloak
            issuer: https://sso.ocplab.com/realms/ocplab
            clientID: argocd
            clientSecret: $oidc.keycloak.clientSecret
            requestedScopes: ["openid", "profile", "email", "groups"]
      - op: add
        path: /spec/sourceNamespaces
        value:
          - product-catalog-gitops
          - rollouts-demo-gitops
      - op: add
        path: /spec/rbac
        value:
          defaultPolicy: 'role:none'
          policy: |
            p, role:none, *, *, */*, deny
            g, system:cluster-admins, role:admin
            g, cluster-admins, role:admin
            p, role:developers, clusters, get, *, allow
            p, role:developers, repositories, get, *, allow
            g, developers, role:developers
          scopes: "[accounts,groups]"
      - op: add
        path: /spec/server/host
        value: "argocd-server-gitops.${SUB_DOMAIN}"