From ae573445b7e5cf0afdd922565c7243a1255fa4bb Mon Sep 17 00:00:00 2001
From: Jim Martens <jma@hbt.de>
Date: Tue, 10 Sep 2024 08:08:24 +0200
Subject: [PATCH] Fix ArgoCD Keycloak configuration

---
 terraform/main.tf                                    |  4 ++--
 terraform/modules/k8s-cluster/manager-node.tf        |  4 ++--
 .../k8s-cluster/templates/helm/argocd-values-ha.yaml |  4 +++-
 .../k8s-cluster/templates/helm/argocd-values.yaml    | 12 +++++++++++-
 terraform/modules/k8s-cluster/variables.tf           |  4 ++--
 5 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/terraform/main.tf b/terraform/main.tf
index 8fd495a..7cde98b 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -74,7 +74,7 @@ module "test_cluster" {
   aws_access_key                = var.aws_access_key
   aws_secret_key                = var.aws_secret_key
   argocd_keycloak_client_secret = var.argocd_test_keycloak_client_secret
-  argocd_url                    = "https://argocd.k8s.test.2martens.de"
+  argocd_domain                 = "argocd.k8s.test.2martens.de"
 }
 
 module "monitoring_cluster" {
@@ -125,5 +125,5 @@ module "monitoring_cluster" {
   aws_access_key                = var.aws_access_key
   aws_secret_key                = var.aws_secret_key
   argocd_keycloak_client_secret = var.argocd_monitoring_keycloak_client_secret
-  argocd_url                    = "https://argocd.k8s.monitoring.2martens.de"
+  argocd_domain                 = "argocd.k8s.monitoring.2martens.de"
 }
\ No newline at end of file
diff --git a/terraform/modules/k8s-cluster/manager-node.tf b/terraform/modules/k8s-cluster/manager-node.tf
index 3ccaf5b..b42e1c5 100644
--- a/terraform/modules/k8s-cluster/manager-node.tf
+++ b/terraform/modules/k8s-cluster/manager-node.tf
@@ -127,11 +127,11 @@ resource "hcloud_server" "manager" {
     }))
     argocd_ha_values : base64encode(templatefile("${path.module}/templates/helm/argocd-values-ha.yaml", {
       argocd_keycloak_client_secret : var.argocd_keycloak_client_secret,
-      argocd_url : var.argocd_url
+      argocd_domain : var.argocd_domain
     }))
     argocd_values : base64encode(templatefile("${path.module}/templates/helm/argocd-values.yaml", {
       argocd_keycloak_client_secret : var.argocd_keycloak_client_secret,
-      argocd_url : var.argocd_url
+      argocd_domain : var.argocd_domain
     }))
     cluster_setup : base64encode(templatefile("${path.module}/templates/scripts/cluster-setup.sh", {
       argocd_environment : var.argocd_environment
diff --git a/terraform/modules/k8s-cluster/templates/helm/argocd-values-ha.yaml b/terraform/modules/k8s-cluster/templates/helm/argocd-values-ha.yaml
index 5cbdf73..439f4f1 100644
--- a/terraform/modules/k8s-cluster/templates/helm/argocd-values-ha.yaml
+++ b/terraform/modules/k8s-cluster/templates/helm/argocd-values-ha.yaml
@@ -1,16 +1,18 @@
 global:
+  domain: ${argocd_domain}
   logging:
     format: text
 
 configs:
   cm:
-    url: ${argocd_url}
+    url: https://${argocd_domain}
     oidc.config: |
       name: Keycloak
       issuer: https://id.2martens.de/realms/2martens
       clientID: argocd-test-oauth
       clientSecret: $oidc.keycloak.clientSecret
       requestedScopes: ["openid", "profile", "email", "groups"]
+      requestedIDTokenClaims: {"groups": {"essential": true}}
   rbac:
     policy.csv: |
       g, ArgoCDAdmins, role:admin
diff --git a/terraform/modules/k8s-cluster/templates/helm/argocd-values.yaml b/terraform/modules/k8s-cluster/templates/helm/argocd-values.yaml
index 532d0ea..70b05d7 100644
--- a/terraform/modules/k8s-cluster/templates/helm/argocd-values.yaml
+++ b/terraform/modules/k8s-cluster/templates/helm/argocd-values.yaml
@@ -1,21 +1,25 @@
 global:
+  domain: ${argocd_domain}
   logging:
     format: text
+
 configs:
   cm:
-    url: ${argocd_url}
+    url: https://${argocd_domain}
     oidc.config: |
       name: Keycloak
       issuer: https://id.2martens.de/realms/2martens
       clientID: argocd-test-oauth
       clientSecret: $oidc.keycloak.clientSecret
       requestedScopes: ["openid", "profile", "email", "groups"]
+      requestedIDTokenClaims: {"groups": {"essential": true}}
   rbac:
     policy.csv: |
       g, ArgoCDAdmins, role:admin
   secret:
     extra:
       oidc.keycloak.clientSecret: ${argocd_keycloak_client_secret}
+
 applicationSet:
   resources:
    limits:
@@ -24,6 +28,7 @@ applicationSet:
    requests:
      cpu: 100m
      memory: 128Mi
+
 controller:
   resources:
     limits:
@@ -32,6 +37,7 @@ controller:
     requests:
       cpu: 250m
       memory: 256Mi
+
 dex:
   resources:
     limits:
@@ -40,6 +46,7 @@ dex:
     requests:
       cpu: 10m
       memory: 32Mi
+
 notifications:
   resources:
     limits:
@@ -48,6 +55,7 @@ notifications:
     requests:
       cpu: 100m
       memory: 128Mi
+
 redis:
   resources:
     limits:
@@ -56,6 +64,7 @@ redis:
     requests:
       cpu: 100m
       memory: 64Mi
+
 repoServer:
   resources:
     limits:
@@ -64,6 +73,7 @@ repoServer:
     requests:
       cpu: 100m
       memory: 256Mi
+
 server:
   resources:
     limits:
diff --git a/terraform/modules/k8s-cluster/variables.tf b/terraform/modules/k8s-cluster/variables.tf
index 37f9750..a7be816 100644
--- a/terraform/modules/k8s-cluster/variables.tf
+++ b/terraform/modules/k8s-cluster/variables.tf
@@ -212,8 +212,8 @@ variable "argocd_keycloak_client_secret" {
   default     = ""
   sensitive   = true
 }
-variable "argocd_url" {
-  description = "Base URL of ArgoCD application"
+variable "argocd_domain" {
+  description = "Domain of ArgoCD application"
   type        = string
   default     = ""
   sensitive   = false