From 9bdb328d997471c8c2db5acf78e9b1264d968489 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sat, 18 Jul 2026 16:23:58 +1000
Subject: [PATCH] Wire ArgoCD RBAC to Authentik ak_groups / akP-argocd-admin
 (#263)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Why

Consume the two-tier Authentik RBAC from terraform-authentik#7 (user → role → permissions). ArgoCD should grant admin to the `akP-argocd-admin` permission group, which `akR-global-admin` members inherit.

## Change

- **argocd-cm**: request the hierarchical `ak_groups` scope + id-token claim (carries permission groups inherited via role groups; distinct from the default `groups` claim to avoid collision).
- **argocd-rbac-cm**: `scopes: [ak_groups]`; `policy.csv`: `g, akP-argocd-admin, role:admin` (replaces the flat `argocd-admins`). Default stays `role:readonly`.

## Depends on
terraform-authentik#7 (creates `akP-argocd-admin`, the access binding, and the `ak_groups` mapping). Merge/apply that first; then add yourself to `akR-global-admin` in Authentik.

## Validation
`kustomize build` renders the patched configmaps; pre-commit clean. Note: argocd-server picks up argocd-cm/rbac-cm live.

Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/263
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
---
 clusters/au-syd1/bootstrap/argocd-cm-patch.yaml      |  5 ++++-
 clusters/au-syd1/bootstrap/argocd-rbac-cm-patch.yaml | 10 ++++++----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml b/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml
index 1c587f2..57247fc 100644
--- a/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml
+++ b/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml
@@ -20,6 +20,9 @@ data:
       - openid
       - profile
       - email
+      # Hierarchical group claim from terraform-authentik (includes permission
+      # groups inherited via role groups). Read for RBAC below.
+      - ak_groups
     requestedIDTokenClaims:
-      groups:
+      ak_groups:
         essential: true
diff --git a/clusters/au-syd1/bootstrap/argocd-rbac-cm-patch.yaml b/clusters/au-syd1/bootstrap/argocd-rbac-cm-patch.yaml
index 4bb25ff..a27a8b0 100644
--- a/clusters/au-syd1/bootstrap/argocd-rbac-cm-patch.yaml
+++ b/clusters/au-syd1/bootstrap/argocd-rbac-cm-patch.yaml
@@ -5,10 +5,12 @@ metadata:
   name: argocd-rbac-cm
   namespace: argocd
 data:
-  # Match RBAC subjects against the `groups` claim from Authentik.
-  scopes: "[groups]"
+  # Match RBAC subjects against the hierarchical `ak_groups` claim from Authentik
+  # (carries permission groups inherited via role groups).
+  scopes: "[ak_groups]"
   # Authenticated users with no matching group get read-only access.
   policy.default: role:readonly
-  # Authentik group -> ArgoCD role.
+  # Authentik permission group -> ArgoCD role. akP-argocd-admin is granted to
+  # akR-global-admin members (and direct members) via terraform-authentik.
   policy.csv: |
-    g, argocd-admins, role:admin
+    g, akP-argocd-admin, role:admin