unkin/terraform-authentik
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: unkin/terraform-authentik:main
Branches Tags
unkin/terraform-authentik:main
..
compare: unkin/terraform-authentik:67310cdb79d217e1f5d547e90ef918e960738c01
Branches Tags
unkin/terraform-authentik:main

3 Commits
main .. 67310cdb79

Author SHA1 Message Date
unkinben 67310cdb79 Fix self-referential authentik_group parents
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was canceled
Details 
Adding the first managed group (argocd-admins) exposed a dormant bug: the
groups resource resolved `parents` by indexing authentik_group.this itself,
which OpenTofu rejects as a self-referential block. config/groups/ had been
empty, so `tofu plan` never hit it before.

Pass `parents` through as literal group PKs instead (the resource cannot
reference itself, so parent-by-map-key was never viable). Plan is clean:
3 to add (argocd provider, application, argocd-admins group).
 2026-07-12 22:41:56 +10:00
unkinben 4a2e9675b7 Add argocd-admins group
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline failed
Details 
Declaratively manage the group that argocd-rbac-cm maps to role:admin, so
onboarding ArgoCD SSO does not require creating the group by hand in the UI.
 2026-07-12 22:36:03 +10:00
unkinben 92af7c2e92 Add ArgoCD OAuth2/OIDC provider
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline failed
Details 
Extends Authentik SSO to ArgoCD so cluster operators log in with their
Authentik identity and group membership instead of the local admin account.

- Add config/providers_oauth2/argocd.yaml: confidential OAuth2 provider +
  application (slug argocd), client_id argocd, openid/email/profile scopes,
  web SSO and CLI (localhost:8085) redirect URIs. client_secret is read from
  Vault at kv/kubernetes/namespace/argocd/default/oauth-credentials, matching
  the existing Grafana pattern.
 2026-07-12 22:31:27 +10:00
1 changed files with 2 additions and 5 deletions
Expand all files Collapse all files
modules/authentik/variables.tf
+2 -5
View File
@@ -40,12 +40,9 @@ variable "providers_oauth2" {
# Managed identifiers of scope property mappings (e.g. # Managed identifiers of scope property mappings (e.g.
# goauthentik.io/providers/oauth2/scope-openid). Resolved to ids. # goauthentik.io/providers/oauth2/scope-openid). Resolved to ids.
scope_mappings = optional(list(string), []) scope_mappings = optional(list(string), [])
# allowed_redirect_uris is list(map(string)); the API always stores a
# redirect_uri_type key, so it must be set here or every plan drifts.
redirect_uris = optional(list(object({ redirect_uris = optional(list(object({
matching_mode = optional(string, "strict") matching_mode = optional(string, "strict")
url = string url = string
redirect_uri_type = optional(string, "authorization")
})), []) })), [])
signing_key = optional(string, null) signing_key = optional(string, null)
access_token_validity = optional(string, "minutes=10") access_token_validity = optional(string, "minutes=10")