unkin/terraform-authentik
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: unkin/terraform-authentik:main
Branches Tags
unkin/terraform-authentik:main
...
compare: unkin/terraform-authentik:6498a04b620204e751fccf13fa6208099ca4f5ae
Branches Tags
unkin/terraform-authentik:main

3 Commits
main ... 6498a04b62

Author SHA1 Message Date
benvin 6498a04b62 Merge branch 'main' into benvin/argocd-oidc
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
2026-07-12 22:56:22 +10:00
unkinben 4a2e9675b7 Add argocd-admins group
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline failed
Details 
Declaratively manage the group that argocd-rbac-cm maps to role:admin, so
onboarding ArgoCD SSO does not require creating the group by hand in the UI.
 2026-07-12 22:36:03 +10:00
unkinben 92af7c2e92 Add ArgoCD OAuth2/OIDC provider
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline failed
Details 
Extends Authentik SSO to ArgoCD so cluster operators log in with their
Authentik identity and group membership instead of the local admin account.

- Add config/providers_oauth2/argocd.yaml: confidential OAuth2 provider +
  application (slug argocd), client_id argocd, openid/email/profile scopes,
  web SSO and CLI (localhost:8085) redirect URIs. client_secret is read from
  Vault at kv/kubernetes/namespace/argocd/default/oauth-credentials, matching
  the existing Grafana pattern.
 2026-07-12 22:31:27 +10:00
2 changed files with 24 additions and 0 deletions
Expand all files Collapse all files
config/groups/argocd-admins.yaml
+3
View File
@@ -0,0 +1,3 @@
# Members of this group get ArgoCD role:admin (mapped in argocd-rbac-cm).
# Everyone else who logs in via Authentik gets role:readonly.
name: argocd-admins
config/providers_oauth2/argocd.yaml
+21
View File
@@ -0,0 +1,21 @@
# OAuth2/OIDC provider + application for the in-cluster ArgoCD
# (argocd.k8s.syd1.au.unkin.net). client_secret is read from Vault, not committed.
name: ArgoCD
authorization_flow: default-provider-authorization-implicit-consent
invalidation_flow: default-provider-invalidation-flow
client_type: confidential
client_id: argocd
client_secret_vault:
mount: kv
path: kubernetes/namespace/argocd/default/oauth-credentials
scope_mappings:
- goauthentik.io/providers/oauth2/scope-openid
- goauthentik.io/providers/oauth2/scope-email
- goauthentik.io/providers/oauth2/scope-profile
redirect_uris:
# Web UI SSO callback.
- matching_mode: strict
url: https://argocd.k8s.syd1.au.unkin.net/auth/callback
# `argocd login --sso` CLI callback (local listener).
- matching_mode: strict
url: http://localhost:8085/auth/callback