fix(oidc): conceal argo cd client secret

k8s/infra/controllers/argocd/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
   - ns.yaml
   - http-route.yaml
+  - oidc.yaml
 
 helmCharts:
   - name: argo-cd

k8s/infra/controllers/argocd/oidc.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: oidc
+  namespace: argocd
+spec:
+  encryptedData:
+    authelia.clientSecret: AgBttJGK9jnTbBMormFxHkh1jxvI//S20LYtSpajeISak0XNLn/QK6vvM9NMlrYawfTJ13B3snbCe/hPEdc2aIZxd+HWzQ/H4S+VoTkeGcQ658zuZER17PPTiKK4rpLOuWsxdnjNzO1yKzTKXMk22iNup8/s+7zdQZnCvtC86xK+mkysfUM8erL52oJpUpnNHndQhrfCezq/bngrx7PLWCNzlwPFBkQbJwcEd1Dg16TSAj4A27xnf8Tobw9ixOxzdfYlSZ9oTqlgjEKBbzfAgpcfSYv6TvghnpNfvvEHFQQtfBb6bQb+MUgZPoSeB8dtrXoaERgESIzSPWDvkpm2xUeBM1dIDvBhP1KVPfR1Mu8pXDtPDdueDDvKyundffPi+N3SuJ5gPRcGcPvJCoirSZGCNSFFaOxttIRnMyHtgOd5Bd4Orx5LT5CcTQI47ty0njCRTIE2uJvw8J+KgxXTTCgoAWQyOVFCq/PWB1+wm6OxKmHGX6Klx+4TwmUZn1ux9s+5R9ZksypBqG/LEbpebKT8S2jcB/uVCHiEi1h31OZcUt52FqCwFTQ/DXd3YTD+Fnp34vT2Zo3HH8kg60DauQZjmfqsq6hKLfq1ayyFsZPZSbxjfqw7fifE/HdP0tezWw/moRNFjiFb0g+A2beoX2eFuYfpjetHO9HoMT/hlqn4fTrMn/KKZlGAue+5/KTfRHTI15sM+zVCApsLqijrubZuaP93/ykjsrgFSc0GwQXHJh9/WqLy+x94hJMNOD9EUscpRCOpFYFYyQO+8lqheeKn71PJWuBOemU=
+  template:
+    metadata:
+      name: oidc
+      namespace: argocd

k8s/infra/controllers/argocd/values.yaml

@@ -3,19 +3,17 @@ configs:
   cm:
     create: true
     application.resourceTrackingMethod: "annotation+label"
-    # TODO: CHANGE THIS COMPROMISED TEST CLIENT SECRET
+    #admin.enabled: false
     url: 'https://argocd.stonegarden.dev'
+    # https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#sensitive-data-and-sso-client-secrets
+#    oidc.config: $oidc:authelia.config
     oidc.config: |
       name: 'Authelia'
       issuer: 'https://authelia.stonegarden.dev'
       clientID: 'argocd'
-      clientSecret: 'kW2GrLDNZwpschHCU496oFKSE-mjRc8yOYbXpafRB6kJp-cF_wcfGaVF55.~rF_qSSEYUcth'
+      clientSecret: $oidc:authelia.clientSecret
       cliClientID: 'argocd-cli'
-      requestedScopes:
-        - 'openid'
-        - 'profile'
-        - 'email'
-        - 'groups'
+      requestedScopes: ['openid', 'profile', 'email', 'groups']
   cmp:
     create: true
     plugins: