# values/argocd.values.yaml

global:
  domain: argocd.kube.huskypup.net

configs:
  cm:
    url: https://argocd.kube.huskypup.net
    oidc.config: |
      name: Authentik
      issuer: https://auth.kube.huskypup.net/application/o/argocd/
      clientID: $oidc.authentik.clientId
      clientSecret: $oidc.authentik.clientSecret
      requestedScopes:
        - openid
        - profile
        - email
        - groups
  
  rbac:
    policy.default: role:readonly
    policy.csv: |
      g, Authentik Admins, role:admin
      g, ArgoCD Admins, role:admin

server:
  extraArgs:
    - --insecure  # TLS is terminated at Istio gateway

  ingress:
    enabled: false

  env:
    - name: oidc.authentik.clientId
      valueFrom:
        secretKeyRef:
          name: argocd-oauth-secret
          key: client-id
    - name: oidc.authentik.clientSecret
      valueFrom:
        secretKeyRef:
          name: argocd-oauth-secret
          key: client-secret

dex:
  enabled: false  # using Authentik instead of built-in Dex

# Enable Prometheus metrics
metrics:
  enabled: true
  serviceMonitor:
    enabled: true
    additionalLabels:
      release: prometheus

controller:
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
      additionalLabels:
        release: prometheus

repoServer:
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
      additionalLabels:
        release: prometheus

applicationSet:
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
      additionalLabels:
        release: prometheus