---
# Patch argocd-cm to enable Google Workspace SSO via knoe-auth OIDC issuer.
# Applied by etc/init_argocd.sh --mode k8s after ArgoCD is installed.
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
data:
  # Set url to your ArgoCD external hostname
  url: "https://argocd.${PLATFORM_DOMAIN}"
  oidc.config: |
    name: "Google Workspace"
    issuer: "https://${FRONTDOOR_HOST}/auth"
    clientID: argocd
    clientSecret: $oidc.argocd.clientSecret
    requestedScopes:
      - openid
      - profile
      - email
      - groups
    requestedIDTokenClaims:
      groups:
        essential: true

---
# RBAC: map Google Workspace admin email to ArgoCD admin role.
# Add additional group/email → role mappings under policy.csv.
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
  labels:
    app.kubernetes.io/name: argocd-rbac-cm
    app.kubernetes.io/part-of: argocd
data:
  policy.default: role:readonly
  policy.csv: |
    g, ${BOOTSTRAP_ADMIN_EMAIL}, role:admin
    g, admin, role:admin

---
# Secret referenced by oidc.config above ($oidc.argocd.clientSecret).
# Populated by the installer from the OIDC Client Secret field.
apiVersion: v1
kind: Secret
metadata:
  name: argocd-secret
  namespace: argocd
  labels:
    app.kubernetes.io/name: argocd-secret
    app.kubernetes.io/part-of: argocd
type: Opaque
stringData:
  oidc.argocd.clientSecret: ""   # set by installer