---
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  # Match RBAC subjects against the `groups` claim from Authentik.
  scopes: "[groups]"
  # Authenticated users with no matching group get read-only access.
  policy.default: role:readonly
  # Authentik group -> ArgoCD role.
  policy.csv: |
    g, argocd-admins, role:admin