Matthias Hinrichs
100 lines
2.6 KiB
YAML
100 lines
2.6 KiB
YAML
global:
|
|
domain: "argocd.k8s.hnrx.net"
|
|
|
|
extraObjects:
|
|
- apiVersion: secrets.phase.dev/v1alpha1
|
|
kind: PhaseSecret
|
|
metadata:
|
|
name: argocd-phase-secret
|
|
namespace: argocd
|
|
labels:
|
|
app.kubernetes.io/part-of: argocd
|
|
spec:
|
|
phaseApp: 'argocd' # The name of your Phase application
|
|
phaseAppEnv: 'production' # OPTIONAL - The Phase App Environment to fetch secrets from
|
|
phaseAppEnvPath: '/' # OPTIONAL Path within the Phase application environment to fetch secrets from
|
|
phaseHost: 'https://phase.hnrx.net' # OPTIONAL - URL of a Phase Console instance
|
|
authentication:
|
|
serviceToken:
|
|
serviceTokenSecretReference:
|
|
secretName: 'phase-service-token' # Name of the Phase Service Token with access to your application
|
|
secretNamespace: 'default'
|
|
managedSecretReferences:
|
|
- secretName: 'argocd-authentik-client-secret' # Name of the Kubernetes managed secret that Phase will sync
|
|
secretNamespace: 'argocd'
|
|
|
|
configs:
|
|
cm:
|
|
url: https://argocd.k8s.hnrx.net
|
|
dex.config: |
|
|
connectors:
|
|
- config:
|
|
issuer: ${AUTHENTIK_ISSUER_URL}
|
|
clientID: ${AUTHENTIK_CLIENT_ID}
|
|
clientSecret: ${AUTHENTIK_CLIENT_SECRET}
|
|
insecureEnableGroups: true
|
|
scopes:
|
|
- openid
|
|
- profile
|
|
- email
|
|
name: authentik
|
|
type: oidc
|
|
id: authentik
|
|
|
|
params:
|
|
server.insecure: true
|
|
rbac:
|
|
policy.csv: |
|
|
g, ArgoCD Admins, role:admin
|
|
g, ArgoCD Viewers, role:readonly
|
|
secret:
|
|
extra:
|
|
dex.authentik.clientSecret: "${AUTHENTIK_CLIENT_SECRET}"
|
|
cmp:
|
|
credentialTemplates:
|
|
https-creds:
|
|
url: https://git.hnrx.net
|
|
username: ${GIT_USER}
|
|
password: ${GIT_PASSWORD}
|
|
|
|
|
|
dex:
|
|
envFrom:
|
|
- secretRef:
|
|
name: argocd-authentik-client-secret
|
|
|
|
server:
|
|
httproute:
|
|
enabled: true
|
|
parentRefs:
|
|
- name: argocd-gateway
|
|
namespace: argocd
|
|
sectionName: https
|
|
hostnames:
|
|
- "argocd.k8s.hnrx.net"
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
backendRefs:
|
|
- name: argocd-server
|
|
port: 80
|
|
|
|
grpcroute:
|
|
enabled: true
|
|
parentRefs:
|
|
- name: argocd-gateway
|
|
namespace: argocd
|
|
sectionName: http
|
|
hostnames:
|
|
- "argocd.k8s.hnrx.net"
|
|
rules:
|
|
- matches:
|
|
- method:
|
|
type: Exact
|
|
service: "cluster.argoproj.v1alpha1.repositorieservice"
|
|
method: "List"
|
|
backendRefs:
|
|
- name: argocd-server
|
|
port: 443 |