---
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  kustomize.buildOptions: "--enable-helm"
  # External URL ArgoCD serves on (TLS terminated at the traefik-internal gateway).
  url: https://argocd.k8s.syd1.au.unkin.net
  # OIDC login via Authentik. The client secret is seeded in Vault out of band
  # and surfaced as the `argocd-oidc` Secret (labelled part-of=argocd) by VSO;
  # `$argocd-oidc:client_secret` resolves the key from that Secret.
  oidc.config: |
    name: Authentik
    issuer: https://identity.unkin.net/application/o/argocd/
    clientID: argocd
    clientSecret: $argocd-oidc:client_secret
    requestedScopes:
      - openid
      - profile
      - email
    requestedIDTokenClaims:
      groups:
        essential: true