70 lines
2.6 KiB
YAML
70 lines
2.6 KiB
YAML
# ------------------------------------------------------------------------------
|
|
# argocd-cm — ArgoCD Core Configuration
|
|
#
|
|
# Configures:
|
|
# - ArgoCD public URL (used in Dex redirect URIs)
|
|
# - Dex connector to Authentik OIDC
|
|
# - Gitea repo credentials reference
|
|
#
|
|
# Authentik side setup (manual — do this in guest-relations before bootstrapping):
|
|
# 1. Admin UI → Applications → Create New Application
|
|
# 2. Provider type: OAuth2/OpenID Connect
|
|
# 3. Name: argocd
|
|
# 4. Authorization flow: default-provider-authorization-explicit-consent
|
|
# 5. Client type: Confidential
|
|
# 6. Strict redirect URIs:
|
|
# https://argocd.local.mk-labs.cloud/api/dex/callback
|
|
# http://localhost:8085/auth/callback (ArgoCD CLI)
|
|
# 7. Scopes: openid, profile, email, groups
|
|
# 8. Note the Client ID and Client Secret → store in 1Password as:
|
|
# Item: "argocd-oidc"
|
|
# Fields: client-id, client-secret
|
|
# 9. Create two groups in Authentik:
|
|
# - argocd-admins (add your user)
|
|
# - argocd-viewers (read-only users)
|
|
# ------------------------------------------------------------------------------
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: argocd-cm
|
|
namespace: argocd
|
|
data:
|
|
# Public URL — must match the HTTPRoute hostname
|
|
url: https://argocd.local.mk-labs.cloud
|
|
|
|
# Dex connector to Authentik
|
|
# Using Dex (not native OIDC) to preserve ArgoCD CLI functionality
|
|
dex.config: |
|
|
connectors:
|
|
- type: oidc
|
|
id: authentik
|
|
name: Authentik
|
|
config:
|
|
# Authentik OIDC issuer — slug must match the Application slug in Authentik
|
|
# Slug is auto-generated from the app name, usually lowercase with hyphens
|
|
issuer: https://authentik.local.mk-labs.cloud/application/o/argocd/
|
|
clientID: $dex.authentik.clientID
|
|
clientSecret: $dex.authentik.clientSecret
|
|
redirectURI: https://argocd.local.mk-labs.cloud/api/dex/callback
|
|
scopes:
|
|
- openid
|
|
- profile
|
|
- email
|
|
- groups
|
|
insecureEnableGroups: true
|
|
groupsKey: groups
|
|
userIDKey: sub
|
|
userNameKey: preferred_username
|
|
emailKey: email
|
|
|
|
# Gitea repo — ArgoCD needs credentials to pull from your private repo
|
|
# Credentials are stored as a Repository secret (see repository-secret.yaml)
|
|
# This tells ArgoCD to use SSH for the repo
|
|
repositories: |
|
|
- url: git@gitea.mk-labs.cloud:rblundon/homelab.git
|
|
type: git
|
|
name: homelab
|
|
|
|
# Resource tracking via annotation (recommended over label tracking)
|
|
application.resourceTrackingMethod: annotation
|