Merge pull request #36 from mojaloop/feat/add-oidc-for-argocd

first draft
mojaloop · Mar 7, 2024 · 144ed79 · 144ed79
2 parents 6a77459 + e9ad3c1
commit 144ed79
Show file tree

Hide file tree

Showing 4 changed files with 36 additions and 0 deletions.
diff --git a/mojaloop/iac/roles/argocd/defaults/main.yaml b/mojaloop/iac/roles/argocd/defaults/main.yaml
@@ -18,3 +18,5 @@ kubectl_version: "1.24.6"
 coredns_version: "1.28.2"
 coredns_max_scale: 10
 install_nodelocaldns: false
+gitlab_oidc_issuer: http://issuer-fqdn/oidc
+argocd_fqdn: argocd.example.com
diff --git a/mojaloop/iac/roles/argocd/templates/argo-cm.yaml.j2 b/mojaloop/iac/roles/argocd/templates/argo-cm.yaml.j2
@@ -1,5 +1,12 @@
 apiVersion: v1
 data:
+  url: https://{{ argocd_fqdn }}
+  oidc.config: |
+    name: Gitlab
+    issuer: {{ gitlab_oidc_issuer }}
+    clientID: $argo-oidc.clientid
+    clientSecret: $argo-oidc.clientsecret
+    requestedScopes: ["read_api"]
   application.instanceLabelKey: argocd.argoproj.io/instance
   kustomize.buildOptions: --enable-helm
   ui.bannercontent: "argocd application install"

diff --git a/mojaloop/iac/roles/argocd/templates/argo-oidc-secrets.yaml.j2 b/mojaloop/iac/roles/argocd/templates/argo-oidc-secrets.yaml.j2
@@ -0,0 +1,26 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: argo-oidc
+spec:
+  refreshInterval: 1h
+
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: tenant-vault-secret-store
+
+  target:
+    name: argo-oidc
+    creationPolicy: Owner
+    template:
+      labels:
+        app.kubernetes.io/part-of: argocd
+  data:
+    - secretKey: clientid
+      remoteRef: 
+        key: {{ cluster_name }}/argocd_oauth_client_id
+        property: value
+    - secretKey: clientsecret
+      remoteRef: 
+        key: {{ cluster_name }}/argocd_oauth_client_secret
+        property: value
diff --git a/mojaloop/iac/roles/argocd/templates/kustomization.yaml.j2 b/mojaloop/iac/roles/argocd/templates/kustomization.yaml.j2
@@ -11,6 +11,7 @@ resources:
 - argo-gitlab.yaml
 - vault-env.yaml
 - netclient.yaml
+- argo-oidc-secrets.yaml
 
 patches:
 - path: argo-cm.yaml