From c62fdb574a0953705b15c17ba6fed1f1b56a2c6a Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sun, 12 Jul 2026 22:36:03 +1000
Subject: [PATCH] Add argocd-admins group

Declaratively manage the group that argocd-rbac-cm maps to role:admin, so
onboarding ArgoCD SSO does not require creating the group by hand in the UI.
---
 config/groups/argocd-admins.yaml | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 config/groups/argocd-admins.yaml

diff --git a/config/groups/argocd-admins.yaml b/config/groups/argocd-admins.yaml
new file mode 100644
index 0000000..0b49b57
--- /dev/null
+++ b/config/groups/argocd-admins.yaml
@@ -0,0 +1,3 @@
+# Members of this group get ArgoCD role:admin (mapped in argocd-rbac-cm).
+# Everyone else who logs in via Authentik gets role:readonly.
+name: argocd-admins