unkinben
9bdb328d99
## Why Consume the two-tier Authentik RBAC from terraform-authentik#7 (user → role → permissions). ArgoCD should grant admin to the `akP-argocd-admin` permission group, which `akR-global-admin` members inherit. ## Change - **argocd-cm**: request the hierarchical `ak_groups` scope + id-token claim (carries permission groups inherited via role groups; distinct from the default `groups` claim to avoid collision). - **argocd-rbac-cm**: `scopes: [ak_groups]`; `policy.csv`: `g, akP-argocd-admin, role:admin` (replaces the flat `argocd-admins`). Default stays `role:readonly`. ## Depends on terraform-authentik#7 (creates `akP-argocd-admin`, the access binding, and the `ak_groups` mapping). Merge/apply that first; then add yourself to `akR-global-admin` in Authentik. ## Validation `kustomize build` renders the patched configmaps; pre-commit clean. Note: argocd-server picks up argocd-cm/rbac-cm live. Reviewed-on: #263 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
17 lines
565 B
YAML
17 lines
565 B
YAML
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: argocd-rbac-cm
|
|
namespace: argocd
|
|
data:
|
|
# Match RBAC subjects against the hierarchical `ak_groups` claim from Authentik
|
|
# (carries permission groups inherited via role groups).
|
|
scopes: "[ak_groups]"
|
|
# Authenticated users with no matching group get read-only access.
|
|
policy.default: role:readonly
|
|
# Authentik permission group -> ArgoCD role. akP-argocd-admin is granted to
|
|
# akR-global-admin members (and direct members) via terraform-authentik.
|
|
policy.csv: |
|
|
g, akP-argocd-admin, role:admin
|