NG: enable sso for argocd

k8s-ng/core/argocd/dex-probes-patch.yaml

@@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-dex-server
+  namespace: argocd
+spec:
+  template:
+    spec:
+      containers:
+        - name: dex-server
+          readinessProbe:
+            tcpSocket:
+              port: 5556
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+            successThreshold: 1
+            failureThreshold: 3
+          livenessProbe:
+            tcpSocket:
+              port: 5556
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 3
+            successThreshold: 1
+            failureThreshold: 3

k8s-ng/core/argocd/kustomization.yaml

@@ -13,3 +13,6 @@ helmCharts:
     namespace: argocd
     valuesFile: values.yaml
     includeCRDs: true
+
+patches:
+  - path: dex-probes-patch.yaml

k8s-ng/core/argocd/values.yaml

@@ -18,8 +18,9 @@ configs:
     exec.enabled: true
     kustomize.buildOptions: --enable-helm
     application.instanceLabelKey: argocd.argoproj.io/instance
-    # Local admin account; the initial password is generated by Argo CD into
-    # the argocd-initial-admin-secret secret.
+    # Local admin account, kept as a break-glass login next to SSO; the initial
+    # password is generated by Argo CD into the argocd-initial-admin-secret secret.
+    # Set to false once SSO is trusted.
     admin.enabled: true
     statusbadge.enabled: true
     timeout.reconciliation: 60s
@@ -37,18 +38,52 @@ configs:
         end
       end
       return hs
+    # SSO through Dex -> Keycloak. The client id/secret come from the oidc-creds
+    # Secret (labelled app.kubernetes.io/part-of=argocd), created by hand until
+    # Vaultwarden + External Secrets are the source.
+    dex.config: |
+      connectors:
+      - type: oidc
+        id: keycloak
+        name: Keycloak
+        config:
+          issuer: https://auth.hexor.cy/auth/realms/hexor
+          clientID: $oidc-creds:id
+          clientSecret: $oidc-creds:secret
+          insecureEnableGroups: true
+          scopes:
+            - openid
+            - profile
+            - email
+            - offline_access
+          getUserInfo: true
   rbac:
     create: true
     policy.default: ""
+    policy.csv: |
+      g, game-servers-managers, GameServersManagersRole
+      # Role permissions
+      p, GameServersManagersRole, applications, get, games/*, allow
+      p, GameServersManagersRole, applications, update, games/*, allow
+      p, GameServersManagersRole, applications, sync, games/*, allow
+      p, GameServersManagersRole, applications, override, games/*, allow
+      p, GameServersManagersRole, applications, action/*, games/*, allow
+      p, GameServersManagersRole, exec, create, games/*, allow
+      p, GameServersManagersRole, logs, get, games/*, allow
+      p, GameServersManagersRole, applications, delete, games/*, deny
+
+      # Admin policy
+      g, argocd-admins, role:admin
   secret:
     createSecret: true
 
 controller:
   replicas: 1
 
-# SSO is not configured yet.
+# Dex OIDC provider (Keycloak connector configured in configs.cm.dex.config)
 dex:
-  enabled: false
+  replicas: 1
+  enabled: true
 
 redis:
   enabled: true