fix(oidc): conceal argo cd client secret

k8s/infra/auth/authelia/kustomization.yaml

@@ -5,6 +5,7 @@ namespace: authelia
 resources:
   - ns.yaml
   - lldap-credentials.yaml
+  - oidc-argocd.yaml
   - http-route.yaml
 
 helmCharts:

k8s/infra/auth/authelia/oidc-argocd.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: oidc-argocd
+  namespace: authelia
+spec:
+  encryptedData:
+    clientSecret: AgA+S8MZ6s6BiCwjhrvwH25lsYE5LO1JBtHBz2CRWeL2wZnsInGi+UB5hcaZtVkK1tBrNv0I+Zl2T7IT5V4d/vcFDaW0daAt8gKZBE+QXuY+jWRaFK0Gp+3wkAyW4SezehdAsLoVCiRL6qJ3O+VKyqjg+7pXafkKFRJ42DMuJekOEF2XokSSZnUyPaCXiQ+a/15h2oS4NUF1J0gc1b09S/SKQ8oH6OPVTHbkDqNYghlAcXHjvcumnijWB5NqsV8bFLkoWiypG1re2j0ioSPRCjIivCuZhOB2AEQZcLdtQyaguiUXLjt8hAK2zFfgc10GOIWkYt4RuPuZ3bBnpJashN+9GX+YAvIV67zNkfDflDo62iI/Gbs04KjnZIq5Z26V7qt1fTfEPx5ZD+8ST1bshHL3X59dP63T8XixEEtcfYyfBMBMMXwhYQ6Pa30N5tYGB4laqDZV0aeEP9Bk8E7JE4YRhhLebtcTghv0fwFFBuPfaE6fJKkA94uI9oCddNCOHWSQM5nRVd5/gI2LN2Q+0u9JAo3WqQ3YfM2NZ+mJFSnUJoQmXQeVUGnQNdre78D0eTuKTbWfyeY5eaBoa0pVobkjh1x7k7NwqNkXk4T69pL1s1A0PQvoOYG3TUG7fMaEqaZzcAlLdk6e/pB1cOVCvyOT+MQP3vpPm9CPD1vj2ga+OdlxdrQ5twa3TyDahDlxLmLeEPGE/o2w+4TxqKvDe/UbysByFG9worQkHvb2RnJBcigZoQOgo+QM4AHKiy0sGb4UJe7/9xMJCv5E1rIXo2lUopI48B/Yp/2uZHCu91dOSaYxEd7Xd76Za+Fs6mcpsxJkWnP8N+nwFCe/bmoe5fZjQ+lR5xd4K7spkS1C5NwO0URJZg==
+  template:
+    metadata:
+      name: oidc-argocd
+      namespace: authelia

k8s/infra/auth/authelia/values.yaml

@@ -12,7 +12,7 @@ configMap:
   theme: 'dark'
 
   access_control:
-    # upgrade to 'two_factor' later
+    # TODO: upgrade to 'two_factor'
     default_policy: 'one_factor'
     rules:
       - domain_regex: '^.*\.stonegarden.dev$'
@@ -31,10 +31,6 @@ configMap:
       user: 'UID=authelia,OU=people,DC=stonegarden,DC=dev'
       password:
         secret_name: 'lldap-auth'
-        value: 'password'
-
-  #    file:
-  #      enabled: true
 
   session:
     cookies:
@@ -109,34 +105,23 @@ configMap:
       clients:
         - client_id: 'argocd'
           # TODO: CHANGE THIS COMPROMISED TEST KEY!
-          client_secret: #'$pbkdf2-sha512$310000$ms/OlHdUjXSdHDW7xdgVhQ$6HN.cN9/MlttyYmXHMRU4JB0Ngqjs5ErSi1UIkH5k9qmMq2qHnueRrLwUjXTdMmOj6lCOAd1l2pA08VUTScPNw'
-            value: '$pbkdf2-sha512$310000$ms/OlHdUjXSdHDW7xdgVhQ$6HN.cN9/MlttyYmXHMRU4JB0Ngqjs5ErSi1UIkH5k9qmMq2qHnueRrLwUjXTdMmOj6lCOAd1l2pA08VUTScPNw'
-          #  path: '/secrets/oidc.client.argocd.value'
+          client_secret:
+            path: '/secrets/oidc-argocd/clientSecret'
           client_name: 'Argo CD'
           public: false
+          # TODO: upgrade to 'two_factor'
           authorization_policy: 'one_factor'
           redirect_uris:
             - 'https://argocd.stonegarden.dev/auth/callback'
             - 'https://argocd.stonegarden.dev/applications'
-          #  - 'https://argocd.stonegarden.dev/api/dex/callback'
-          scopes:
-            - 'openid'
-            - 'groups'
-            - 'email'
-            - 'profile'
+          scopes: [ 'openid', 'groups', 'email', 'profile' ]
           userinfo_signed_response_alg: 'none'
         - client_id: 'argocd-cli'
           client_name: 'Argo CD (CLI)'
           public: true
           authorization_policy: 'one_factor'
-          redirect_uris:
-            - 'http://localhost:8085/auth/callback'
-          scopes:
-            - 'openid'
-            - 'groups'
-            - 'email'
-            - 'profile'
-            - 'offline_access'
+          redirect_uris: [ 'http://localhost:8085/auth/callback' ]
+          scopes: [ 'openid', 'groups', 'email', 'profile', 'offline_access' ]
           userinfo_signed_response_alg: 'none'
 
 secret:
@@ -145,4 +130,8 @@ secret:
       items:
         - key: 'password'
           path: 'authentication.ldap.password.txt'
+    oidc-argocd:
+      items:
+        - key: 'clientSecret'
+          path: 'clientSecret'
 

k8s/infra/controllers/argocd/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
   - ns.yaml
   - http-route.yaml
+  - oidc.yaml
 
 helmCharts:
   - name: argo-cd

k8s/infra/controllers/argocd/oidc.yaml

@@ -0,0 +1,15 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: oidc
+  namespace: argocd
+spec:
+  encryptedData:
+    authelia.clientSecret: AgAHAPZBVVE8seuSJQeWKSDzUI9NjGrMWvwGt0M3IbyuyXR/Fjmg6x+wCTPvhcWU2ww/BELSgarkI8/URltUqsvsZmvGn12aZw5lRUUoVz2j003lu1ZSEOTfhmCT9N+C1fK/RwEwgUVhdnTjhH4SinIARDWEyMnRkGJfG0ryNaQQMX+VyO6UWTkzeihbrBIvpDHWJm1wMfnW7FRnbBVyE/E+eiPdeNdaC/vmNZJqYG6Ofvum5vOfhfSisaTSpLczvApslv9eFQGweuPhWfVacccC3/pRB/BX/vIpVFb4J8WlNGoLZy3S9UhbAY7C36DiHWJtvMeNigLYNgp+jH10ZJdQNlUDvZmvPY2e3TTVvXoKyyY8LJJdROTiqKVi8sKkaqkdavrnCTU4UQgrZOo3NhGPMbrt3PZuFwRg4ZmbD4l0sN4umH17zKB0eYVhwh6DgaRtAmuOwoAPzbrNcUR0W2PWOR+tyhFjOwihpObhmNndHO/llOsCFG5B7oxV0srI6s2dGJ45HLPau6PCJOwM9B1ZmIpNWqKQeGGRKW76HEU6kYubqaCTA9cxQIZrU9JchFrwdP4SQFDLWCqFL2+DXkwOzGQ0eB5QXRZQDFrdVkoDagR7XbaN8DAx1q953vQzgZvJDd5KL5xilQib53ulDs0iqg2lYjdp5psn9XiSDHfv8sipRw06fQxqSpekjwZImoeKlNCIGnlERrScu5uvddyI8ILbX7dLcKkLRGEJPrd/nN7rAgnVNpcqcRIhJK1YOUeusK0npVw//NwZabGx97BqEHLwIyu2nLk=
+  template:
+    metadata:
+      labels:
+        # https://github.com/argoproj/argo-cd/issues/13928#issuecomment-2146020186
+        app.kubernetes.io/part-of: argocd
+      name: oidc
+      namespace: argocd

k8s/infra/controllers/argocd/values.yaml

@@ -3,19 +3,16 @@ configs:
   cm:
     create: true
     application.resourceTrackingMethod: "annotation+label"
-    # TODO: CHANGE THIS COMPROMISED TEST CLIENT SECRET
+    admin.enabled: false
     url: 'https://argocd.stonegarden.dev'
+    # https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#sensitive-data-and-sso-client-secrets
     oidc.config: |
       name: 'Authelia'
       issuer: 'https://authelia.stonegarden.dev'
       clientID: 'argocd'
-      clientSecret: 'kW2GrLDNZwpschHCU496oFKSE-mjRc8yOYbXpafRB6kJp-cF_wcfGaVF55.~rF_qSSEYUcth'
+      clientSecret: $oidc:authelia.clientSecret
       cliClientID: 'argocd-cli'
-      requestedScopes:
-        - 'openid'
-        - 'profile'
-        - 'email'
-        - 'groups'
+      requestedScopes: [ 'openid', 'profile', 'email', 'groups' ]
   cmp:
     create: true
     plugins: