cm.azure-ad.patch.yaml

#
#  Author: Hari Sekhon
#  Date: 2021-06-11 17:03:23 +0100 (Fri, 11 Jun 2021)
#
#  vim:ts=2:sts=2:sw=2:et
#  lint: k8s
#
#  https://github.com/HariSekhon/Kubernetes-configs
#
#  License: see accompanying Hari Sekhon LICENSE file
#
#  If you're using my code you're welcome to connect with me on LinkedIn and optionally send me feedback to help steer this or other code I publish
#
#  https://www.linkedin.com/in/HariSekhon
#

# ============================================================================ #
#                  A r g o C D   A z u r e   A D   C o n f i g
# ============================================================================ #

# https://argoproj.github.io/argo-cd/operator-manual/user-management/microsoft/#azure-ad-app-registration-auth-using-oidc

# 1. Register App in Azure:
#
#     https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app
#
# 2. Populate XXX: Edit fields in this and rbac-cm.patch.yaml
#
# 3. Apply both patches, then Log In via Azure button will appear in UI


# Patch to configure ArgoCD settings configmap
#
# Apply like so:
#
#   run: kubectl patch configmap argocd-cm --namespace argocd --patch "$(cat cm.azure-ad.patch.yaml)"
#
#  Add Azure AD secret to horrid master multi-secret:
#
#   echo "$AZURE_SECRET" | kubectl patch secret argocd-secret --namespace argocd --patch '{"data": { "oidc.azure.clientSecret": "'"$(base64)"'" } }'

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  annotations:
    checkov.io/skip1: CKV_K8S_21=breaks kustomize patching of base
  namespace: argocd  # breaks kustomize patching of argocd base if using url based install rather than helm, see cm.repos.patch.yaml for details why
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd  # necessary for configmap to be picked up my ArgoCD
data:
  # XXX: Edit
  url: https://argocd.DOMAIN.COM/
  oidc.config: |
    name: AzureAD
    # XXX: Edit tenant
    issuer: https://login.microsoftonline.com/{directory_tenant_id}/v2.0
    clientID: {azure_ad_application_client_id}  # XXX: Edit
    clientSecret: $oidc.azuread.clientSecret    # XXX: add key to argocd-secret - see description above
    requestedIDTokenClaims:
      groups:
        essential: true
    requestedScopes:
      - openid
      - profile
      - email