From 6928e71f31b7029906f4ec6a1d9b280a4653eb45 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 18 Jul 2026 16:20:56 +1000 Subject: [PATCH] Wire ArgoCD RBAC to Authentik ak_groups / akP-argocd-admin Consume the two-tier Authentik RBAC (terraform-authentik): request the hierarchical `ak_groups` scope/claim and map the `akP-argocd-admin` permission group to role:admin (replacing the flat `argocd-admins`). Members of akR-global-admin inherit akP-argocd-admin, so they get ArgoCD admin. - argocd-cm: add `ak_groups` to requestedScopes + requestedIDTokenClaims - argocd-rbac-cm: scopes [ak_groups]; policy.csv g, akP-argocd-admin, role:admin --- clusters/au-syd1/bootstrap/argocd-cm-patch.yaml | 5 ++++- clusters/au-syd1/bootstrap/argocd-rbac-cm-patch.yaml | 10 ++++++---- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml b/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml index 1c587f2..57247fc 100644 --- a/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml +++ b/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml @@ -20,6 +20,9 @@ data: - openid - profile - email + # Hierarchical group claim from terraform-authentik (includes permission + # groups inherited via role groups). Read for RBAC below. + - ak_groups requestedIDTokenClaims: - groups: + ak_groups: essential: true diff --git a/clusters/au-syd1/bootstrap/argocd-rbac-cm-patch.yaml b/clusters/au-syd1/bootstrap/argocd-rbac-cm-patch.yaml index 4bb25ff..a27a8b0 100644 --- a/clusters/au-syd1/bootstrap/argocd-rbac-cm-patch.yaml +++ b/clusters/au-syd1/bootstrap/argocd-rbac-cm-patch.yaml @@ -5,10 +5,12 @@ metadata: name: argocd-rbac-cm namespace: argocd data: - # Match RBAC subjects against the `groups` claim from Authentik. - scopes: "[groups]" + # Match RBAC subjects against the hierarchical `ak_groups` claim from Authentik + # (carries permission groups inherited via role groups). + scopes: "[ak_groups]" # Authenticated users with no matching group get read-only access. policy.default: role:readonly - # Authentik group -> ArgoCD role. + # Authentik permission group -> ArgoCD role. akP-argocd-admin is granted to + # akR-global-admin members (and direct members) via terraform-authentik. policy.csv: | - g, argocd-admins, role:admin + g, akP-argocd-admin, role:admin