From 97fc39c922200025ed53b2dc8513b8c54f45e2e8 Mon Sep 17 00:00:00 2001
From: Michele Baldessari <michele@acksyn.org>
Date: Sun, 5 Jul 2026 14:20:13 +0200
Subject: [PATCH] Add argoRBAC support to configmap

---
 templates/pattern-operator-configmap.yaml  |  4 ++++
 tests/pattern_operator_configmap_test.yaml | 17 +++++++++++++++++
 values.yaml                                |  3 +++
 3 files changed, 24 insertions(+)

diff --git a/templates/pattern-operator-configmap.yaml b/templates/pattern-operator-configmap.yaml
index 5d11f67..149b6fc 100644
--- a/templates/pattern-operator-configmap.yaml
+++ b/templates/pattern-operator-configmap.yaml
@@ -13,6 +13,10 @@ data:
   {{- if .Values.main.gitops.additionalArgoAdmins }}
   gitops.additionalArgoAdmins: {{ .Values.main.gitops.additionalArgoAdmins }}
   {{- end }}
+  {{- if .Values.main.gitops.argoRBAC }}
+  gitops.argoRBAC: |
+{{ .Values.main.gitops.argoRBAC | indent 4 }}
+  {{- end }}
 
   # gitops.sourceNamespace: GitOpsDefaultCatalogSourceNamespace
   # gitops.installApprovalPlan: GitOpsDefaultApprovalPlan
diff --git a/tests/pattern_operator_configmap_test.yaml b/tests/pattern_operator_configmap_test.yaml
index 2a43fa7..05c27a0 100644
--- a/tests/pattern_operator_configmap_test.yaml
+++ b/tests/pattern_operator_configmap_test.yaml
@@ -66,6 +66,23 @@ tests:
           path: data["gitops.additionalArgoAdmins"]
           value: "group1,group2"
 
+  - it: Should not include gitops.argoRBAC by default
+    asserts:
+      - notExists:
+          path: data["gitops.argoRBAC"]
+
+  - it: Should set gitops.argoRBAC
+    set:
+      main:
+        gitops:
+          argoRBAC: |
+            defaultPolicy: "role:readonly"
+            policy: "g, custom-admins, role:admin"
+            scopes: "[groups,email]"
+    asserts:
+      - exists:
+          path: data["gitops.argoRBAC"]
+
   - it: Should set gitea parameters
     set:
       main:
diff --git a/values.yaml b/values.yaml
index d62d986..1365be8 100644
--- a/values.yaml
+++ b/values.yaml
@@ -27,6 +27,9 @@ main:
     # -- Comma-separated list of additional ArgoCD admin groups.
     # Only used when argoRBAC is not set.
     additionalArgoAdmins: ""
+    # -- Full ArgoCD RBAC spec as a YAML string. When set, it completely
+    # overrides the default RBAC policy and additionalArgoAdmins is ignored.
+    argoRBAC: ""
 
   # -- Settings related to the in-cluster gitea installation
   gitea: