unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Wire ArgoCD RBAC to Authentik ak_groups / akP-argocd-admin #263

Merged
benvin merged 1 commits from benvin/argocd-akgroups into main 2026-07-18 16:23:59 +10:00
Conversation 0 Commits 1 Files Changed 2
+10 -5
unkinben commented 2026-07-18 16:21:11 +10:00
Owner
Copy Link
Copy Source

Why

Consume the two-tier Authentik RBAC from terraform-authentik#7 (user → role → permissions). ArgoCD should grant admin to the akP-argocd-admin permission group, which akR-global-admin members inherit.

Change

  • argocd-cm: request the hierarchical ak_groups scope + id-token claim (carries permission groups inherited via role groups; distinct from the default groups claim to avoid collision).
  • argocd-rbac-cm: scopes: [ak_groups]; policy.csv: g, akP-argocd-admin, role:admin (replaces the flat argocd-admins). Default stays role:readonly.

Depends on

terraform-authentik#7 (creates akP-argocd-admin, the access binding, and the ak_groups mapping). Merge/apply that first; then add yourself to akR-global-admin in Authentik.

Validation

kustomize build renders the patched configmaps; pre-commit clean. Note: argocd-server picks up argocd-cm/rbac-cm live.

## Why Consume the two-tier Authentik RBAC from terraform-authentik#7 (user → role → permissions). ArgoCD should grant admin to the `akP-argocd-admin` permission group, which `akR-global-admin` members inherit. ## Change - **argocd-cm**: request the hierarchical `ak_groups` scope + id-token claim (carries permission groups inherited via role groups; distinct from the default `groups` claim to avoid collision). - **argocd-rbac-cm**: `scopes: [ak_groups]`; `policy.csv`: `g, akP-argocd-admin, role:admin` (replaces the flat `argocd-admins`). Default stays `role:readonly`. ## Depends on terraform-authentik#7 (creates `akP-argocd-admin`, the access binding, and the `ak_groups` mapping). Merge/apply that first; then add yourself to `akR-global-admin` in Authentik. ## Validation `kustomize build` renders the patched configmaps; pre-commit clean. Note: argocd-server picks up argocd-cm/rbac-cm live.
unkinben added 1 commit 2026-07-18 16:21:11 +10:00
Wire ArgoCD RBAC to Authentik ak_groups / akP-argocd-admin
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
6928e71f31 
Consume the two-tier Authentik RBAC (terraform-authentik): request the
hierarchical `ak_groups` scope/claim and map the `akP-argocd-admin` permission
group to role:admin (replacing the flat `argocd-admins`). Members of
akR-global-admin inherit akP-argocd-admin, so they get ArgoCD admin.

- argocd-cm: add `ak_groups` to requestedScopes + requestedIDTokenClaims
- argocd-rbac-cm: scopes [ak_groups]; policy.csv g, akP-argocd-admin, role:admin
benvin merged commit 9bdb328d99 into main 2026-07-18 16:23:59 +10:00
benvin deleted branch benvin/argocd-akgroups 2026-07-18 16:23:59 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#263
Delete Branch "benvin/argocd-akgroups"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?