remoll/k3s-infra
0
0
Fork 0
Code Issues 1 Pull Requests 4 Packages Projects Releases Wiki Activity

argo scopes reduced

Browse Source
This commit is contained in:
Remy Moll 2024-12-01 16:19:16 +01:00
parent d097dddf7a
commit 78fce20fe5
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
infrastructure/argocd/argocd-oauth.configmap.yaml
View File

@ -12,13 +12,11 @@ data:
# If you want to store sensitive data in another Kubernetes Secret, instead of argocd-secret. ArgoCD knows to check the keys under data in your Kubernetes Secret for a corresponding key whenever a value in a configmap or secret starts with $, then your Kubernetes Secret name and : (colon). # If you want to store sensitive data in another Kubernetes Secret, instead of argocd-secret. ArgoCD knows to check the keys under data in your Kubernetes Secret for a corresponding key whenever a value in a configmap or secret starts with $, then your Kubernetes Secret name and : (colon).
clientSecret: $argocd-oauth:client-secret clientSecret: $argocd-oauth:client-secret
skipAudienceCheckWhenTokenHasNoAudience: true
# Optional set of OIDC scopes to request. If omitted, defaults to: ["openid", "profile", "email", "groups"] # Optional set of OIDC scopes to request. If omitted, defaults to: ["openid", "profile", "email", "groups"]
requestedScopes: ["openid", "profile", "email", "groups"] requestedScopes: ["openid", "profile", "email", "groups"]
# Optional set of OIDC claims to request on the ID token. # Optional set of OIDC claims to request on the ID token.
requestedIDTokenClaims: {"groups": {"essential": true}} requestedIDTokenClaims: {"groups": {"essential": true}}
allowedAudiences:
- argocd

4
infrastructure/argocd/argocd-rbac.configmap.yaml
View File

@ -6,4 +6,6 @@ data:
policy.csv: | policy.csv: |
# use oidc group apps_admin as admin group in argocd # use oidc group apps_admin as admin group in argocd
g, apps_admin, role:admin g, apps_admin, role:admin
policy.default: role:readonly g, argocd, role:readonly
# all other user that might have entered via oidc, are blocked: deny everything
policy.default: deny