From 78d2c18a3c35d9771a079ec39255cd7c8a644fdd Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Thu, 13 Aug 2026 08:45:20 -0700
Subject: [PATCH] =?UTF-8?q?feat(argocd):=20wire=20Authentik=20OIDC=20+=20l?=
 =?UTF-8?q?ocal=20rock/cicd=20accounts=20+=20RBAC=20=E2=80=94=20adds=20oid?=
 =?UTF-8?q?c.config=20(homelab-admins->admin=20SSO),=20url,=20accounts.roc?=
 =?UTF-8?q?k=20(login+apiKey)=20and=20accounts.cicd=20(apiKey=20for=20CD?=
 =?UTF-8?q?=20pipeline=20token),=20all=20role:admin?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../phase4-argocd/argocd-values.yaml          | 31 +++++++++++++++++--
 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/k8s/bootstrap/phase4-argocd/argocd-values.yaml b/k8s/bootstrap/phase4-argocd/argocd-values.yaml
index ea13c86..a8b7bc4 100644
--- a/k8s/bootstrap/phase4-argocd/argocd-values.yaml
+++ b/k8s/bootstrap/phase4-argocd/argocd-values.yaml
@@ -131,12 +131,39 @@ configs:
     application.instanceLabelKey: argocd.argoproj.io/instance
     # Let every kustomize build run the ksops exec generator.
     kustomize.buildOptions: --enable-alpha-plugins --enable-exec
-    
+    # External URL — required so OIDC redirect URIs are built correctly.
+    url: https://argocd.riotpiao.com
+    # Local accounts (in addition to Authentik SSO):
+    #   rock  — human admin; can log in with a password AND issue API tokens.
+    #   cicd  — automation-only; apiKey (token) for the CD pipeline, no UI login.
+    accounts.rock: apiKey,login
+    accounts.cicd: apiKey
+    # Authentik OIDC. clientSecret pulled from the argocd `oidc-secret` Secret
+    # (created by authentik-provision). The groups claim drives RBAC below.
+    oidc.config: |
+      name: Authentik
+      issuer: https://authentik.riotpiao.com/application/o/argocd/
+      clientID: argocd
+      clientSecret: $oidc-secret:client-secret
+      requestedScopes:
+        - openid
+        - profile
+        - email
+        - groups
+      requestedIDTokenClaims:
+        groups:
+          essential: true
+
   params:
     server.insecure: false
 
-  # RBAC (allow admin full access)
+  # RBAC. local `admin` + `rock` + the `cicd` pipeline account all get role:admin;
+  # the Authentik `homelab-admins` group (rock is a member) maps to admin so SSO
+  # logins are admin too.
   rbac:
     policy.default: role:readonly
     policy.csv: |
       g, admin, role:admin
+      g, rock, role:admin
+      g, cicd, role:admin
+      g, homelab-admins, role:admin