unkinben
6928e71f31
Consume the two-tier Authentik RBAC (terraform-authentik): request the hierarchical `ak_groups` scope/claim and map the `akP-argocd-admin` permission group to role:admin (replacing the flat `argocd-admins`). Members of akR-global-admin inherit akP-argocd-admin, so they get ArgoCD admin. - argocd-cm: add `ak_groups` to requestedScopes + requestedIDTokenClaims - argocd-rbac-cm: scopes [ak_groups]; policy.csv g, akP-argocd-admin, role:admin
17 lines
565 B
YAML
17 lines
565 B
YAML
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: argocd-rbac-cm
|
|
namespace: argocd
|
|
data:
|
|
# Match RBAC subjects against the hierarchical `ak_groups` claim from Authentik
|
|
# (carries permission groups inherited via role groups).
|
|
scopes: "[ak_groups]"
|
|
# Authenticated users with no matching group get read-only access.
|
|
policy.default: role:readonly
|
|
# Authentik permission group -> ArgoCD role. akP-argocd-admin is granted to
|
|
# akR-global-admin members (and direct members) via terraform-authentik.
|
|
policy.csv: |
|
|
g, akP-argocd-admin, role:admin
|