---
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  # Match RBAC subjects against the hierarchical `ak_groups` claim from Authentik
  # (carries permission groups inherited via role groups).
  scopes: "[ak_groups]"
  # Authenticated users with no matching group get read-only access.
  policy.default: role:readonly
  # Authentik permission group -> ArgoCD role. akP-argocd-admin is granted to
  # akR-global-admin members (and direct members) via terraform-authentik.
  policy.csv: |
    g, akP-argocd-admin, role:admin