feat(argocd): Log in to ArgoCD through Authentik

infra/authentik/blueprints.yaml

@@ -4,6 +4,65 @@ metadata:
   name: authentik-blueprints
   namespace: authentik
 data:
+  argocd.yaml: |
+    version: 1
+    metadata:
+      name: ArgoCD
+    entries:
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: mounted/cm-authentik-blueprints/google-login.yaml
+          required: true
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: default/flow-default-provider-authorization-implicit-consent.yaml
+          required: true
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: default/flow-default-provider-invalidation.yaml
+          required: true
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: system/providers-oauth2.yaml
+          required: true
+      - model: authentik_providers_oauth2.oauth2provider
+        id: provider
+        identifiers:
+          name: argocd
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          client_id: argocd
+          client_secret: !Env ARGOCD_OIDC_CLIENT_SECRET
+          client_type: confidential
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+          redirect_uris:
+            - matching_mode: strict
+              url: https://argo.whyredfire.dev/auth/callback
+            # argocd CLI (argocd login --sso)
+            - matching_mode: strict
+              url: http://localhost:8085/auth/callback
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+      - model: authentik_core.application
+        id: application
+        identifiers:
+          slug: argocd
+        attrs:
+          meta_launch_url: https://argo.whyredfire.dev
+          name: ArgoCD
+          provider: !KeyOf provider
+      - model: authentik_policies.policybinding
+        identifiers:
+          group: !Find [authentik_core.group, [name, admins]]
+          order: 0
+          target: !KeyOf application
   # Google is the only way in: its source has no enrollment flow, so a Google
   # account can only log in when a user with the same email already exists.
   google-login.yaml: |