From db59b123df33aaf54aa1491bf107532de282033f Mon Sep 17 00:00:00 2001
From: Karan Parashar <whyredfire@gmail.com>
Date: Fri, 25 Sep 2026 01:29:56 +0530
Subject: [PATCH] feat(argocd): Prepare ArgoCD through Authentik login

---
 bootstrap/argocd-cm-oidc-patch.yaml           | 14 ++++++++++++++
 bootstrap/argocd-rbac-cm-patch.yaml           |  9 +++++++++
 bootstrap/kustomization.yaml                  |  8 ++++++++
 infra/argocd-dashboard/kustomization.yaml     |  1 +
 infra/argocd-dashboard/oidc-sealedsecret.yaml | 15 +++++++++++++++
 5 files changed, 47 insertions(+)
 create mode 100644 bootstrap/argocd-cm-oidc-patch.yaml
 create mode 100644 bootstrap/argocd-rbac-cm-patch.yaml
 create mode 100644 infra/argocd-dashboard/oidc-sealedsecret.yaml

diff --git a/bootstrap/argocd-cm-oidc-patch.yaml b/bootstrap/argocd-cm-oidc-patch.yaml
new file mode 100644
index 0000000..12fcca1
--- /dev/null
+++ b/bootstrap/argocd-cm-oidc-patch.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+data:
+  oidc.config: |
+    name: Authentik
+    issuer: https://auth.whyredfire.dev/application/o/argocd/
+    clientID: argocd
+    clientSecret: $argocd-oidc:clientSecret
+    requestedScopes:
+      - openid
+      - profile
+      - email
diff --git a/bootstrap/argocd-rbac-cm-patch.yaml b/bootstrap/argocd-rbac-cm-patch.yaml
new file mode 100644
index 0000000..68c7f2c
--- /dev/null
+++ b/bootstrap/argocd-rbac-cm-patch.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+data:
+  policy.csv: |
+    g, admins, role:admin
+  policy.default: ""
+  scopes: "[groups]"
diff --git a/bootstrap/kustomization.yaml b/bootstrap/kustomization.yaml
index cc55174..22b6e1d 100644
--- a/bootstrap/kustomization.yaml
+++ b/bootstrap/kustomization.yaml
@@ -17,6 +17,14 @@ patches:
       kind: ConfigMap
       name: argocd-cm
     path: argocd-cm-url-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-cm
+    path: argocd-cm-oidc-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-rbac-cm
+    path: argocd-rbac-cm-patch.yaml
   - target:
       kind: ConfigMap
       name: argocd-cmd-params-cm
diff --git a/infra/argocd-dashboard/kustomization.yaml b/infra/argocd-dashboard/kustomization.yaml
index 973b541..fc264a3 100644
--- a/infra/argocd-dashboard/kustomization.yaml
+++ b/infra/argocd-dashboard/kustomization.yaml
@@ -4,3 +4,4 @@ resources:
   - anubis-key-sealedsecret.yaml
   - anubis-proxy.yaml
   - httproute.yaml
+  - oidc-sealedsecret.yaml
diff --git a/infra/argocd-dashboard/oidc-sealedsecret.yaml b/infra/argocd-dashboard/oidc-sealedsecret.yaml
new file mode 100644
index 0000000..d96d477
--- /dev/null
+++ b/infra/argocd-dashboard/oidc-sealedsecret.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: argocd-oidc
+  namespace: argocd
+spec:
+  encryptedData:
+    clientSecret: AgAuadGZNylY8/lomfIg8PybwBtfZ20BXDfNacgIMMdRanRgRnLhMghaZfcQbcGuKRaAIya/aIqbUKkQwat2elypOp374wvDHilnaQ0DQ4qCBGZlPLMSzyEoz+sSuB3c0YHLcj48DIF9b5b24jsysS9mllTQCeEBNsuXiEjEuSBUpu6EbR5ztRPnEi8OnuJYTMJtnMVX0iPEqEK4DsR/c7ActayVBG+sGDK/ZyACxyLg8cuhJ2p7SyxqCwqtaS4NaKC6d4WK+3LEQcAd65PWeSKbR7zv77EcUQ8yzaM3yDXIZMmgLMzynfPgyll9aLr31n2UOaNU2uZPT6JtlnPARU1WuzQHcRCdJBjuKneDahE2D3m7sClxUCNXTgXfZqsWl6/gSvZrREukQyJgIz6mmmN3rUjYRn0lG+0CU6o1uDFGHyn9GEmzTPT4zt/U0YD7LjwdR+tWHBUmzQCPbe2DcPQLb+OwyY0M9RC52btfJVyErjMXN7TP8ut1Gmf6p0phr9ebVH9hNAPWcfbWkNG4r8c4gzHDca9ULPrwjz1oJsNeHf6ZXu3Zu26xnFsLswSQqWSSpBrHA9F5bl3U3/ScNErD+wrP6lH6dqcGGJVpMMUhDDNBKkSsu8zL8M97x5MYZPwAI+EfNF5ijdzqZbgEU0iTjJv5fHX1i+rGhbzkfqvuI3ti/8CkcSB/dEAYQXwfmSrtPJISX1zEWhqzgIfIDuPk2BmD+rKmWL906+aff7M/Ns32wZlvN3eCPVjO9w80mkn6OJY11re0Si0eg4ksUZDH
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/part-of: argocd
+      name: argocd-oidc
+      namespace: argocd