From 0348329829e2df74da6e455aba6b2442c2f56e68 Mon Sep 17 00:00:00 2001
From: Aleksandr Bogomiakov <git@hexor.cy>
Date: Tue, 6 Oct 2026 00:11:02 +0100
Subject: [PATCH] NG: enable sso for argocd

---
 k8s-ng/core/argocd/dex-probes-patch.yaml | 26 ++++++++++++++
 k8s-ng/core/argocd/kustomization.yaml    |  3 ++
 k8s-ng/core/argocd/values.yaml           | 43 +++++++++++++++++++++---
 3 files changed, 68 insertions(+), 4 deletions(-)
 create mode 100644 k8s-ng/core/argocd/dex-probes-patch.yaml

diff --git a/k8s-ng/core/argocd/dex-probes-patch.yaml b/k8s-ng/core/argocd/dex-probes-patch.yaml
new file mode 100644
index 0000000..81c3948
--- /dev/null
+++ b/k8s-ng/core/argocd/dex-probes-patch.yaml
@@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-dex-server
+  namespace: argocd
+spec:
+  template:
+    spec:
+      containers:
+        - name: dex-server
+          readinessProbe:
+            tcpSocket:
+              port: 5556
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+            successThreshold: 1
+            failureThreshold: 3
+          livenessProbe:
+            tcpSocket:
+              port: 5556
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 3
+            successThreshold: 1
+            failureThreshold: 3
diff --git a/k8s-ng/core/argocd/kustomization.yaml b/k8s-ng/core/argocd/kustomization.yaml
index 88e253c..f345e35 100644
--- a/k8s-ng/core/argocd/kustomization.yaml
+++ b/k8s-ng/core/argocd/kustomization.yaml
@@ -13,3 +13,6 @@ helmCharts:
     namespace: argocd
     valuesFile: values.yaml
     includeCRDs: true
+
+patches:
+  - path: dex-probes-patch.yaml
diff --git a/k8s-ng/core/argocd/values.yaml b/k8s-ng/core/argocd/values.yaml
index 10429b2..d456377 100644
--- a/k8s-ng/core/argocd/values.yaml
+++ b/k8s-ng/core/argocd/values.yaml
@@ -18,8 +18,9 @@ configs:
     exec.enabled: true
     kustomize.buildOptions: --enable-helm
     application.instanceLabelKey: argocd.argoproj.io/instance
-    # Local admin account; the initial password is generated by Argo CD into
-    # the argocd-initial-admin-secret secret.
+    # Local admin account, kept as a break-glass login next to SSO; the initial
+    # password is generated by Argo CD into the argocd-initial-admin-secret secret.
+    # Set to false once SSO is trusted.
     admin.enabled: true
     statusbadge.enabled: true
     timeout.reconciliation: 60s
@@ -37,18 +38,52 @@ configs:
         end
       end
       return hs
+    # SSO through Dex -> Keycloak. The client id/secret come from the oidc-creds
+    # Secret (labelled app.kubernetes.io/part-of=argocd), created by hand until
+    # Vaultwarden + External Secrets are the source.
+    dex.config: |
+      connectors:
+      - type: oidc
+        id: keycloak
+        name: Keycloak
+        config:
+          issuer: https://auth.hexor.cy/auth/realms/hexor
+          clientID: $oidc-creds:id
+          clientSecret: $oidc-creds:secret
+          insecureEnableGroups: true
+          scopes:
+            - openid
+            - profile
+            - email
+            - offline_access
+          getUserInfo: true
   rbac:
     create: true
     policy.default: ""
+    policy.csv: |
+      g, game-servers-managers, GameServersManagersRole
+      # Role permissions
+      p, GameServersManagersRole, applications, get, games/*, allow
+      p, GameServersManagersRole, applications, update, games/*, allow
+      p, GameServersManagersRole, applications, sync, games/*, allow
+      p, GameServersManagersRole, applications, override, games/*, allow
+      p, GameServersManagersRole, applications, action/*, games/*, allow
+      p, GameServersManagersRole, exec, create, games/*, allow
+      p, GameServersManagersRole, logs, get, games/*, allow
+      p, GameServersManagersRole, applications, delete, games/*, deny
+
+      # Admin policy
+      g, argocd-admins, role:admin
   secret:
     createSecret: true
 
 controller:
   replicas: 1
 
-# SSO is not configured yet.
+# Dex OIDC provider (Keycloak connector configured in configs.cm.dex.config)
 dex:
-  enabled: false
+  replicas: 1
+  enabled: true
 
 redis:
   enabled: true