Fix ArgoCD Keycloak configuration

terraform/main.tf

@@ -74,7 +74,7 @@ module "test_cluster" {
   aws_access_key                = var.aws_access_key
   aws_secret_key                = var.aws_secret_key
   argocd_keycloak_client_secret = var.argocd_test_keycloak_client_secret
-  argocd_url                    = "https://argocd.k8s.test.2martens.de"
+  argocd_domain                 = "argocd.k8s.test.2martens.de"
 }
 
 module "monitoring_cluster" {
@@ -125,5 +125,5 @@ module "monitoring_cluster" {
   aws_access_key                = var.aws_access_key
   aws_secret_key                = var.aws_secret_key
   argocd_keycloak_client_secret = var.argocd_monitoring_keycloak_client_secret
-  argocd_url                    = "https://argocd.k8s.monitoring.2martens.de"
+  argocd_domain                 = "argocd.k8s.monitoring.2martens.de"
 }

terraform/modules/k8s-cluster/manager-node.tf

@@ -127,11 +127,11 @@ resource "hcloud_server" "manager" {
     }))
     argocd_ha_values : base64encode(templatefile("${path.module}/templates/helm/argocd-values-ha.yaml", {
       argocd_keycloak_client_secret : var.argocd_keycloak_client_secret,
-      argocd_url : var.argocd_url
+      argocd_domain : var.argocd_domain
     }))
     argocd_values : base64encode(templatefile("${path.module}/templates/helm/argocd-values.yaml", {
       argocd_keycloak_client_secret : var.argocd_keycloak_client_secret,
-      argocd_url : var.argocd_url
+      argocd_domain : var.argocd_domain
     }))
     cluster_setup : base64encode(templatefile("${path.module}/templates/scripts/cluster-setup.sh", {
       argocd_environment : var.argocd_environment

terraform/modules/k8s-cluster/templates/helm/argocd-values-ha.yaml

@@ -1,16 +1,18 @@
 global:
+  domain: ${argocd_domain}
   logging:
     format: text
 
 configs:
   cm:
-    url: ${argocd_url}
+    url: https://${argocd_domain}
     oidc.config: |
       name: Keycloak
       issuer: https://id.2martens.de/realms/2martens
       clientID: argocd-test-oauth
       clientSecret: $oidc.keycloak.clientSecret
       requestedScopes: ["openid", "profile", "email", "groups"]
+      requestedIDTokenClaims: {"groups": {"essential": true}}
   rbac:
     policy.csv: |
       g, ArgoCDAdmins, role:admin

terraform/modules/k8s-cluster/templates/helm/argocd-values.yaml

@@ -1,21 +1,25 @@
 global:
+  domain: ${argocd_domain}
   logging:
     format: text
+
 configs:
   cm:
-    url: ${argocd_url}
+    url: https://${argocd_domain}
     oidc.config: |
       name: Keycloak
       issuer: https://id.2martens.de/realms/2martens
       clientID: argocd-test-oauth
       clientSecret: $oidc.keycloak.clientSecret
       requestedScopes: ["openid", "profile", "email", "groups"]
+      requestedIDTokenClaims: {"groups": {"essential": true}}
   rbac:
     policy.csv: |
       g, ArgoCDAdmins, role:admin
   secret:
     extra:
       oidc.keycloak.clientSecret: ${argocd_keycloak_client_secret}
+
 applicationSet:
   resources:
    limits:
@@ -24,6 +28,7 @@ applicationSet:
    requests:
      cpu: 100m
      memory: 128Mi
+
 controller:
   resources:
     limits:
@@ -32,6 +37,7 @@ controller:
     requests:
       cpu: 250m
       memory: 256Mi
+
 dex:
   resources:
     limits:
@@ -40,6 +46,7 @@ dex:
     requests:
       cpu: 10m
       memory: 32Mi
+
 notifications:
   resources:
     limits:
@@ -48,6 +55,7 @@ notifications:
     requests:
       cpu: 100m
       memory: 128Mi
+
 redis:
   resources:
     limits:
@@ -56,6 +64,7 @@ redis:
     requests:
       cpu: 100m
       memory: 64Mi
+
 repoServer:
   resources:
     limits:
@@ -64,6 +73,7 @@ repoServer:
     requests:
       cpu: 100m
       memory: 256Mi
+
 server:
   resources:
     limits:

terraform/modules/k8s-cluster/variables.tf

@@ -212,8 +212,8 @@ variable "argocd_keycloak_client_secret" {
   default     = ""
   sensitive   = true
 }
-variable "argocd_url" {
+variable "argocd_domain" {
-  description = "Base URL of ArgoCD application"
+  description = "Domain of ArgoCD application"
   type        = string
   default     = ""
   sensitive   = false