From 5de4066796d1e7b0c6103800a171673c356c0d48 Mon Sep 17 00:00:00 2001 From: Vegard Hagen Date: Sat, 12 Jul 2025 15:45:23 +0200 Subject: [PATCH] feat(authelia): custom argocd claim Signed-off-by: Vegard Hagen --- k8s/infra/auth/authelia/values.yaml | 20 ++++++++++++------- k8s/infra/auth/lldap/bootstrap.yaml | 2 +- k8s/infra/auth/lldap/lldap-config.yaml | 6 +++--- .../controllers/argocd/kustomization.yaml | 2 +- k8s/infra/controllers/argocd/values.yaml | 12 ++++++++--- 5 files changed, 27 insertions(+), 15 deletions(-) diff --git a/k8s/infra/auth/authelia/values.yaml b/k8s/infra/auth/authelia/values.yaml index 08eec65..72cee40 100644 --- a/k8s/infra/auth/authelia/values.yaml +++ b/k8s/infra/auth/authelia/values.yaml @@ -54,9 +54,8 @@ configMap: password: { secret_name: lldap-auth } attributes: extra: - audiobookshelf_groups: - multi_valued: true - value_type: string + argocd: { multi_valued: true, value_type: string } + audiobookshelf: { multi_valued: true, value_type: string } identity_providers: oidc: @@ -77,15 +76,20 @@ configMap: allowed_origins_from_client_redirect_uris: true endpoints: [ userinfo, authorization, token, revocation, introspection ] claims_policies: + argocd: + custom_claims: { argocd: { attribute: argocd } } + # Argo CD requires the claims other than `groups` to be in the ID Token https://github.com/argoproj/argo-cd/issues/23768 + id_token: [ email, name, preferred_username, argocd ] audiobookshelf: - custom_claims: - audiobookshelf: { attribute: audiobookshelf_groups } + custom_claims: { audiobookshelf: { attribute: audiobookshelf } } # https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter legacy: id_token: [ email, email_verified, alt_emails, name, preferred_username, groups ] username_email: id_token: [ email, email_verified, alt_emails, name, preferred_username ] scopes: + argocd: + claims: [ argocd ] audiobookshelf: claims: [ audiobookshelf ] clients: @@ -94,11 +98,12 @@ configMap: client_name: Argo CD public: false authorization_policy: two_factor + claims_policy: argocd pre_configured_consent_duration: 1 month redirect_uris: - https://argocd.stonegarden.dev/auth/callback - https://argocd.stonegarden.dev/applications - scopes: [ openid, email, profile, offline_access, groups ] + scopes: [ openid, email, profile, offline_access, argocd ] grant_types: [ authorization_code, refresh_token ] userinfo_signed_response_alg: none id_token_signed_response_alg: ES256 @@ -108,9 +113,10 @@ configMap: client_name: Argo CD (CLI) public: true authorization_policy: two_factor + claims_policy: argocd pre_configured_consent_duration: 1 month redirect_uris: [ http://localhost:8085/auth/callback ] - scopes: [ openid, email, profile, offline_access, groups ] + scopes: [ openid, email, profile, offline_access, argocd ] id_token_signed_response_alg: ES256 access_token_signed_response_alg: ES256 revocation_endpoint_auth_method: none diff --git a/k8s/infra/auth/lldap/bootstrap.yaml b/k8s/infra/auth/lldap/bootstrap.yaml index dc21da3..675ae69 100644 --- a/k8s/infra/auth/lldap/bootstrap.yaml +++ b/k8s/infra/auth/lldap/bootstrap.yaml @@ -20,7 +20,7 @@ spec: type: RuntimeDefault containers: - name: lldap-bootstrap - image: ghcr.io/lldap/lldap:v0.6.1-alpine-rootless # renovate: docker=ghcr.io/lldap/lldap + image: ghcr.io/lldap/lldap:2025-07-10-alpine-rootless # renovate: docker=ghcr.io/lldap/lldap command: [ /app/bootstrap.sh ] securityContext: allowPrivilegeEscalation: false diff --git a/k8s/infra/auth/lldap/lldap-config.yaml b/k8s/infra/auth/lldap/lldap-config.yaml index a010032..de010b9 100644 --- a/k8s/infra/auth/lldap/lldap-config.yaml +++ b/k8s/infra/auth/lldap/lldap-config.yaml @@ -5,9 +5,9 @@ metadata: namespace: lldap spec: encryptedData: - groups.json: AgAUfZBCgp/Q9kPmj7epbVYYFkigTkTfotfGfvuIGPFzlUTM4bPRNh1e7y8PwYukh6JWZCEyaDS4St4blD7v/u/8woUcFr65P8v7OZRfhuv5m+JeP3S9e50nNH7xiX5yJK1SO2H8/OMdO3twlt80dp/X9/Uyvrhg5OXh4TZs6X2LQ4qqMeXR2B6c9wNWBIpi5/lJlRvG0C0NeXZb6qmE5LqO9NrHxQwLT41DbO0lrGS25zaKuHBtwy1mZ9313Fb9Fa1Yb+hTtdFx1Z+TBblFwbBIOhow0jOkFsCKDi7vCnaX0cTSvTH4nPqytHOD3643+WGcgrCbNpH0to0ipCyYF+oNEjjhKnbxJfqEuzMZp0xXyAkTGqzeAWkaA2qKVPaSiSZtebdSOdsC7P4Bwh+brSxnTBVCv2dQpjgSzCFcr/4HkbMSlLs21Y76UsTm8y+C0g1pD69DajsUEvzENbolBwLmhP1xkF/CYU2/1bx6vxjKYvOunA7SeBrwOQvP3fBT+pykZG9B4r/uovpZddtxNqSqcm7TBglYLfNByL07XE0oodHhF0InI2BlOfL4r52mHxWIKjCK3mxgLKwouFMiqVGJfPJQKITsWPBSAIf0B8JJMVmLlDiOhLggBd3Bctl3boiFhoWZyiIj25KSyTwDY3PSYej4H6vgBLa7yKN9FHVNfZARWTl+PGumSWidkSA/U8GPqtvDRRBsHtCVn/+lXGzQwWGQNHu1W+KkkCbwoxGfjiBFqsOosZT+ccP8XuuCmMy8lxgc2+onomBVOahhwlsbLsOSKGvfgZMayGAQAvkqtBiHyI5x6lNIbODkLb47wA== - user-schemas.json: AgCPVK8yQGu754tIgpLQSvp6eZBDT0ic2g0QVYvsbN7gTCdhT4AtqyhiDQnmEXOOPULlQUBpAaEjs0t+PmnkFn/cgGk1erSXCSa+u1cZ2cqRQHpOhwFoGdhDz/gGyH76Smlmf6CfZM/pXM0mAFy2YSYkLA8ZcUHF/ggb9VscaQqGmwuDA//f/FovpfZznQ04E3Sr0TqlKitkLu9cD6sjsVJGpPG2dIbE/gO/EUTfKvZpmv3oLOgxu9MRTbYDwg7hQPWXj4dmyee/mnHBSHJC9BSLQZu0pShOvh9BWrKRY9xu6CPm4uwjE4u6uEi1id+QH7/Ymv+WeOE2WkHqN9M8zdjqjRe2fqVHSSXylu0y3g/W8ykr0dhtItgBSyTNxjcAPepjDWgXUYWmo4zT2ZJgs+Z6wpjeAkgVJ+A2S1DZiheDexlMg87rHK9hFZgERdgSPm+0Ktm9thcdZY32AAInsu2jDk/2BkPd1HjKOPxhj6mMY8e7gtVyPkyFn9X311SWD5MQs3kQHTlJNOTSjbOBuFrp3PjqoFBscOt5juNV7LA05YQw9faohd6N9rRXLnmsK3TAAOF7ZmepGRyNq7AcPx8LkfmDlwgS1HLSzck/uMIQJwQN7u4geXWBXjINzSwmwFVGnduSI1TLqqbx2cQKPOPm1yJuNJ1jVHkBKivef302xqTlJYPUmc5yApW4uboiFrC1YwKneJGgoCrwEYmmAV+Hzs5lg3UfhJvEdo513Pk32BEXO0O33cK/vSd4vOBhzZJZT2JkTCOpYedo2DlmSmuRZPjyWxBPTXbwZEg8NhOFdDEGpCCRupzCz/vixCh/1bO8JgmrFrcItQeATabXEDzc9NK5E4cwuYq1u0gNXv/xHbXeKWIqPXHUMOQt8lO4o+Nr4g== - users.json: AgCEy0ru2yQNtIePuqhF/B6HnIW4ThnExm25jkMoL32u3zdQRCXZI6zXq6DWhayNypHk0d3OWfoe6NXCONX8xi7Dw9D9i5ANQYK0Ig0llvODaUIF5gWOw946dqAeTjRY0N50mPPJcmue8M/wOP85M2mv4RcUjg5BDFmAQ6WIIxzFg77UBO3wbYsi2L5zJYxaqdbcB4fykjqLzgBkKIskAK2/EA7NBf+bN10UQLSkke1j8waAFJWrj35w3H5oGSLg4DOfrV4pD6oZFynROGQ3uHK6UMAGDCSlYabYcZywd+W1Ajh0MGAL4LAYtKVzKlcgNbMzUb+tJZ15D9Pebl65kjm2lGh713NegTNTw5OYqQZktoJ2Y0k6619KxAuQCBu9ZaHW+RB7Xe2WsqGOuWihdt0uAwg6gijwH4Zve8qpqFAVC5MuCfe+vcnGf/NrBaPADXx2TbnRb3EgpuGcnedu9hWI4UzWi4LToTxj6QfM1E6d5D5pz1TlInDJVLFviTUZfPpNiE0E/qXzNc0ivemaZkaeZBh8KhycusidIYnMKmaWZQ+G8/HeXTa1yjFfh5Ax2DmcmGuab0QrYsssEt2/hXfLH7gn4Yb7ncUg6QiCoaOIkSHNjqru+cHVb4GPz/i1A6ZJ2HWPyd5alslOrgWmheD3HlIERW1Gttu/QygAH6cHZhEjuVkAcSRgvd8gubhIMSghD1lWZTnisdCm4H3k60FniOVd0Ll469VELePBpq35UlG65Y/utOalVsaomUGGhW2+vsmEKunpwtauVnnV5vKYmSIRc0WYPMdzgY5NncT03R9Utg8U9sPY6sOL7VbrWDoVWo+VaFCDg0RrBkxl7ahRthF9DKQ/cvH2zFRQI0TudF0UflM3ZVo5JYOzqTX1GlGLPO9udKH975xH9orNOl3Dpr5ilNCfeai83uMiBNJo+laH5zfG6Zl2MgXjwao/qupafil6I84QsT33a9dAbiWA0s+pEc0D7nAhJYkDGkNlQlqYK21Fhx8Q7DHMWjjLdyuyofCdrJcamdOclBUgj5jz8oDewnFxDAMyhKVVEt78uSYDKWLcAfODxr5Ei+YSEBA5FEeMhL4i/w2aoS2vH5ajzOGJBfkaMAt4+155A1b8u8vbkmo18UzFxGzHE0HGoXfKgmk34R/t+c1Sv5NJHgtxpkU/eJD/WYtWbDH7q3nbFbq4IEqDk1HwkxK2ubfs7fQ3shXGu/9llPVHzYtvr247TtA8mbWyuFRAbKP2HZQftkQW+fPg48s0n5Cp7K4xizIurnRS2YzNaNyqLpEsNffFJAH7ymmvSR7/d/oktynqt8n8Wv3/N1SmX86hbF3w8eegjFM+W/73NNdtLPx3UzS5DC0mMxBI2J+gy8pafoEdyjyDsE1K8MZzkF3DPr5CIBWngg5PlNoGDWDYVmvu3GT1NJxVlvBH+EqpMr9lLm7j6Lhe6mps0WCFmxCJkoSvZEjoUb/RxEsY9It+Kw5b/flZyb0YxYbkPSDcbVahlIQ3WtA4ENwwQTvaYxE0pCWI5sx1Py2yxeMnXimCbYFqsizki0Qd+mc2+DuYySWO6VDN3631oURxdCIr6t9sCj9UboC2uTbLLcHtacww5ZsH+s3aYGevl+uzIroxQ3YUppRzXdsyODQMHKOvAb+TUmNy6RfsbqXhyXsiwJKCQbsxQIih5ICirYq8iZ+N9vek5UtxOLvKuCv+07iH8sh4WDdymvuZ7Fg6zrZMIfYya4NpK2PWizXNG5uNR04Jt+aaZqv8uToAW9AN50QbohxRbMWII9x1G1wdy5x/P7PR5B86FsiNFJwWeS4zGUOZXPQevjk/ZTithnzOAau+Q/aOu7MdqsgBBxhCSZPQf8YF14/Px1MVjukHxNM3zgPVZeGCU3V5Hk5j3IdiOT2+FGGut1XCTktTp777Zc1qVCCONqxlb+XaRJvTHRpBv1DhedeQqgJxHTivqB9PgiEEtuHvwWJ9i+l5YQSBdn1/izHctGJetctfapTyXkKsaGQQsdJarSKoqPBcIy8/3cyx9e6jY/SLkEBUY1riiGPq58kVX6Xo9VBCQvQKTYGwgnKl2Y8oyaOFVbWz+rAnC1H+oItkaSKcuwzR5fL9ZbucivGngQM7drsqHBoIsHQRsLKK7TtnYLNTYqYNUTldqz7EkuEZZS4XnhOtG7wioBkA/3Ec4e1/WkZD0NU19QUVwSMUF7Xxd0P2FLDOlXmZYcsj3SjXJKu2n8RViWENY7xsfPkiVQQ+YE6UcK+4y6oS3av6cqvzJOdXI+HDW8Jp4ErC8tHY80/O8TwCg2gb2XW+m9/lAUrHA3N10YkqGfEVO5a9VhLKeGq+YcM3joqyOfv20cmobxt14RRNQAU3sDWS878/KxTf8G/L5R65q8eP0j8TnnhD37/3eHiHoA3a45lQWm04w2A4+gY= + groups.json: AgAgf9uRqyB2aPEad6Nldr5F/UCFdDA5t3O1kdRNZ7QK4WFwtweqa4MOnXz0oMLuegEDEU+UNMzJYNKAmmhPvliPvuB1sQuOXJT4LWvUDAvIj+fj50tDeVVzWU3LMO5DrilfPr9+/cpnM1II9U01PNDL0+FImN6hF8dHEVDR2Kvn3z3RsUWGoI1tqIv9BYzu7OR/7CjueyoavrtBk7VacaGFpQpiSFG2xIag+weBwo2Lt7SP1xru1kHdLo3UH/KiNFw0S8/WaibqzjqjLWQZ1KaSPxoOIl3OLju49CpCATxOxt5+2dDmLCbgxnqu0te7GXM9y9MT3KzLMXx7A1YTrwCI5FRxmNvoRmlppdZA1CNXJ7YgtOm9SnId8kXTqMXRYE73DBQQ1eJAQ35VOGFcaPUHxmolRA2R2VKJKmot/77akPWjLrAIxQ4TJydmqp+25klmyLwfEsdkP05LAPJ808urp4KNrfR3pJaTD92+w3aYsf5haf7jQNocFoKGg+4KX9Nm+1gUFMWAIYSrHtMdvWpBbok0KbqceB4EufUbVa57oiPENDLBgP5n8OsDE9hY3bEaooh28f44wlWlYb597m6pOnHwFxNw57CLXZJMewYSimGeXqO2Na+fHboLIaZOVd92jJrsRa0DpbBuQLs8n2qOqG8/Br4yQ0e1Zq95LkrFOUZCccZEETe5Ehn3UTHZJyvLsFEf0+Yvwxp0Y1LBDK8jWEajtO5TgPLRlth0HgAdvK+K + user-schemas.json: AgCQctcH1gcUlBnCTnMermgdGckl9h5MYb7vQ3bVoxQSD6m82EJsHhHE5Jl7Fl9nBkVjhx25E68sV+mZu92LdKOw6wf9s7bMkCNuM/tTeqmcvHJuFTvSozhsyY/ii98sHAlpt/quhRTBRikjSWH5C4JdAjzQqfSueR9q7dgS7NwBId1rljTTxa/sZYsFfGFqe/FU22MRVDS1MWvP+vEG/MHhgfvDIN94mI8xypr0M6g9Eez6TXKUKizv9bxu+VU9yPR9dOJ427h/6+6bKHvKnB7Ud+th5Td48/NYzWHAVA60FW6gwZFGGGgVDj94edPTyOlRIMW11Ed8xkzvAZcuGQxxtUQ3U9zOpDJSLUOKK8xXCje8EKhuICYY7uyK3okOewOoia/LMmp4ifvNSg8y8irSp95yb4wrnPW1eo6sn7WHDgr453q9BgvkTMVZwzJ1tBA8TRzqC7dqM83ptPIcw5KXTe0st/EXPQ8YCw7QgdJRU7ktXAewB9NM8oyGkUKgzbyXouA9rcLRJkd7jxnUL8zQkui4dPODsdvXG4TtagRfC/uP9qeD6Dteb3BOULWn0JqhZdGMUoFZ49TRkBIpSdo4KE3BpXPgi94iNqeaosmtZ4rle8SF09o5vAa4Ez64wQmh4vVrnfPlo0JuGMKpPLNI/tF7bGYbKrZKesj43QRjrmgzOvl/rNp2858/Sazso5nZAb5Q6yhQkti31hGAZxsKl2TMkxVNXTUBCGo1flpHIZAYAAtBeinH1FfV8rSpQBqA+G99pqYvYlo8PNDoP33VwXiPAvjOPhaVDq/WtCts4Z3xwbqD/WQadE9n/LgYWm5pP23BKiDUlxNx98iGjBm4bvsvz4wNekD8DTxuaMGKanGr0+27P4nUzjJOT/kEjB1W+NpoT4vbli0NkwR0QfocnqLSpq6srvxRIldQP6QAdaIugSkvtVL6xVtP68MowxEbvZy/21N52Muf86yg3LwmxbB7HdTubeoMLHFyaKuiu8Kb3H4KwAvzWsvVEekPz7y6xfQkEDeiBlQFVWHLJp1mIhKPeoV/Z8fkdwg= + users.json: AgCVtjHccQqUuj0GnANRHd2WopCHq3eIUh+DJhW/y4jg1dkS0WsYhzR7Zs8jSJMG0F8yQD/+mefNBDOIooHqlRvfsQF01LkFxHKFcjhcyesiJcqTst1Ix39ZviY2qOOuTLm4a4hqwb+NtXOgRbVR0U/EMRUt56rDdaAntFjGmrDUeZYoGp/GkKtOfu5ITCvn3jzQSAkJTx52/Rhoa0tcSnpb3W4htdULtAPXZV52kHStiQZk9WDt3G/Ps9uKCCXEcR+ujze1hbWu4JOj0cmFeXACrnMgcDGMZsLLhv+vskBkd05oMlG1sZRyoudvUVwy+/ZtYuy8u0Gth5NG+rwztYjdZ5ha6avJAjgjuDexUlpTCXLciEGk9bsWTaBRqfA5sRpes33MNj2mLioufG8mnZi1/zH4aA58gTNwYsCY97nal/rYFOLprdk0N6JOsfpxy4/wO77vzI1TKmGqzq8uWKDERqENjlm3evDbKrEg+uARG7yr/3Rqcv3UgcVYM7yedyMDWQHuWN5aQMMoKApL6M/ANWZ4jOR9R5sl4bo+BaCkw76dWFQ0vdOYAm/9ivQXPslYKUXvrVKwbktCKR3tbqDtlnQ4DgUFW7miuGCOIav7nnUaslAxmaolgZKW1Of5eP+lez3OSwNVVWQ4Kefs7qZblg4+FBGtR4ZB/VsRb94f09LPk9XfkdQT6LL+nN2J5sZM+IXZIaA9p5IPG9s9QjMQwKmc2BumuaYOFPmi028qwCODZSjIeEpl2yM3q8pQvQ23ReuTKWEAkvP7+hmH9ZUZswt9baXMxw4gJtI0HSp3ldLnN7SkDQ3237gEbdlMtQ6JEU3dJk5QnH1ImMB3fnfZ8wNpeAWL6DcVaM+6f/haGXaZkr2IT38vajwOP00EeyVzhJBBPtsC1BcHn19JS7iGqdyu4lIHx+Trtyb6CUME1G0qBIqZsnlBLUMJpu92gpHD8KZNRaHD5of8ohDBIXrWwTTt//T+UqT3YypL7AYnLSl1xYCvb43d/qw7J/Kyx7Nm+VH6U2NDxMKL5GMLjiJapTflN/FpI5ygouso7++1GB4TFa23K6zl7dje4EntagBPQpUhRes1slM/8YQBLNF056z4Z9nqxvII7hlpck14o3+uur9o1KJDF3dtnA2JeUTc5s5Gw0YKYPZbi/Y8WofK7HwTEWH8poUmvqrWZGsEabmhIZ0a0vVi4HPGM0AkD2H3UgLXv+TNx+K89qxY7w//1R3V3HBHdTrWKQWH8AOuUskeyMjjVIZo3kkkBj3PgIXFZmKqqsmoBXb8/Uvk/rKUT1vQEwSz7YelhfDSRqRsIO2Un5ECjueWOzVpExQiO53b9qXi/GPX4HLglc5rDowXmE98XVOYbBDmd2KhwcuiY8Rw1wRt4cbGwNtqTWedasKW0ZTbYhPAwzDoKWFtYI/g/1jfc5vM/oVtlJjXJpj2XdIm8rQ5Mc3c6uCgaJOvney02wMSWrMI0YYln38fKUdIOJXqzSU7lPvxEDVKj2Aj2wFrfsjshEh9BQ0jUSKR+0Tl5pu2kEqQALSan6coPqG/oGtYpYtzkh73RJOmsYyPbntDXqjF7H18XvXLH/9luhCX8Qj8ExBDIKI7aNUYAcTfniAn2Z6arSUsHv6KanBFUU23+Yv5lhLVm3IGRA98xM/vl1TlogH5GBDokeohx+NwugXY7GKJnqDdRUIYHdwTPI31NoW/Ip5LIruuWtwAwEIis4LfEVqi7Am5C9NC36sDJpr3JZyTbz43TYOOPdRrlYPXkG04Fn+zpQ2Ju2jMj8V2OcFvDj1d0HZqngA5KcWnehec171/yoXIFdPqCSSIREnjuUkfxe0NNNhYoPxQp84uAKZQX61jDLtOkvxWgW8y00RRah21ZPJHAXjs5lSxK7k1JY7HOzwtCGu2DOzfVwGncpGJn1uU7p9aISEWRJh5fw3glr0rR7BowOMKL+ZQ1kID7b9iOyrLwoZ4PspMp8RmL2Ur2iAU5/wiW7VyXEIKs5VlXCKP6g1RU/gJo/tRkXP7DzxWfUQQ7D1Ok3iFrAAkMOMJFQmSBHQS+tKxiqQ4MpAMwjON9cEoDDf2COoJfrGU7uMDdfS+NI6WJ1/YlGv/KFAlIHImH6B2YjOiyzmP8+nxDvQGecz1VIwRVqqoczGD/jZ7f2QXSygAnKOvQgu9UGHb5j57QjsJiuU= template: metadata: name: lldap-config diff --git a/k8s/infra/controllers/argocd/kustomization.yaml b/k8s/infra/controllers/argocd/kustomization.yaml index 4116555..a6483a3 100644 --- a/k8s/infra/controllers/argocd/kustomization.yaml +++ b/k8s/infra/controllers/argocd/kustomization.yaml @@ -9,7 +9,7 @@ resources: helmCharts: - name: argo-cd repo: https://argoproj.github.io/argo-helm - version: 8.0.15 + version: 8.1.3 releaseName: "argocd" namespace: argocd valuesFile: values.yaml diff --git a/k8s/infra/controllers/argocd/values.yaml b/k8s/infra/controllers/argocd/values.yaml index 7c66220..b421eb1 100644 --- a/k8s/infra/controllers/argocd/values.yaml +++ b/k8s/infra/controllers/argocd/values.yaml @@ -13,8 +13,13 @@ configs: clientID: 'argocd' clientSecret: $oidc:authelia.clientSecret cliClientID: 'argocd-cli' - requestedScopes: [ 'openid', 'profile', 'email', 'groups', 'offline_access' ] + requestedScopes: [ 'openid', 'profile', 'email', 'offline_access', 'argocd' ] enableUserInfoGroups: true + requestedIDTokenClaims: + argocd: { essential: true } + profile: { essential: false } + email: { essential: false } + offline_access: { essential: false } userInfoPath: /api/oidc/userinfo userInfoCacheExpiration: '5m' @@ -29,9 +34,10 @@ configs: controller.diff.server.side: true server.insecure: true rbac: + scopes: '[ argocd ]' policy.csv: | - g, argocd:admin, role:admin - g, argocd:read_all, role:readonly + g, admin, role:admin + g, read, role:readonly crds: install: true