unkin/terraform-authentik
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: unkin/terraform-authentik:main
Branches Tags
unkin/terraform-authentik:main
..
compare: unkin/terraform-authentik:6498a04b620204e751fccf13fa6208099ca4f5ae
Branches Tags
unkin/terraform-authentik:main

3 Commits
main .. 6498a04b62

Author SHA1 Message Date
benvin 6498a04b62 Merge branch 'main' into benvin/argocd-oidc
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
2026-07-12 22:56:22 +10:00
unkinben 4a2e9675b7 Add argocd-admins group
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline failed
Details 
Declaratively manage the group that argocd-rbac-cm maps to role:admin, so
onboarding ArgoCD SSO does not require creating the group by hand in the UI.
 2026-07-12 22:36:03 +10:00
unkinben 92af7c2e92 Add ArgoCD OAuth2/OIDC provider
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline failed
Details 
Extends Authentik SSO to ArgoCD so cluster operators log in with their
Authentik identity and group membership instead of the local admin account.

- Add config/providers_oauth2/argocd.yaml: confidential OAuth2 provider +
  application (slug argocd), client_id argocd, openid/email/profile scopes,
  web SSO and CLI (localhost:8085) redirect URIs. client_secret is read from
  Vault at kv/kubernetes/namespace/argocd/default/oauth-credentials, matching
  the existing Grafana pattern.
 2026-07-12 22:31:27 +10:00
1 changed files with 2 additions and 5 deletions
Expand all files Collapse all files
modules/authentik/variables.tf
+2 -5
View File
@@ -40,12 +40,9 @@ variable "providers_oauth2" {
# Managed identifiers of scope property mappings (e.g. # Managed identifiers of scope property mappings (e.g.
# goauthentik.io/providers/oauth2/scope-openid). Resolved to ids. # goauthentik.io/providers/oauth2/scope-openid). Resolved to ids.
scope_mappings = optional(list(string), []) scope_mappings = optional(list(string), [])
# allowed_redirect_uris is list(map(string)); the API always stores a
# redirect_uri_type key, so it must be set here or every plan drifts.
redirect_uris = optional(list(object({ redirect_uris = optional(list(object({
matching_mode = optional(string, "strict") matching_mode = optional(string, "strict")
url = string url = string
redirect_uri_type = optional(string, "authorization")
})), []) })), [])
signing_key = optional(string, null) signing_key = optional(string, null)
access_token_validity = optional(string, "minutes=10") access_token_validity = optional(string, "minutes=10")