Add argoRBAC support to configmap

templates/pattern-operator-configmap.yaml

@@ -13,6 +13,10 @@ data:
   {{- if .Values.main.gitops.additionalArgoAdmins }}
   gitops.additionalArgoAdmins: {{ .Values.main.gitops.additionalArgoAdmins }}
   {{- end }}
+  {{- if .Values.main.gitops.argoRBAC }}
+  gitops.argoRBAC: |
+{{ .Values.main.gitops.argoRBAC | indent 4 }}
+  {{- end }}
 
   # gitops.sourceNamespace: GitOpsDefaultCatalogSourceNamespace
   # gitops.installApprovalPlan: GitOpsDefaultApprovalPlan

tests/pattern_operator_configmap_test.yaml

@@ -66,6 +66,23 @@ tests:
           path: data["gitops.additionalArgoAdmins"]
           value: "group1,group2"
 
+  - it: Should not include gitops.argoRBAC by default
+    asserts:
+      - notExists:
+          path: data["gitops.argoRBAC"]
+
+  - it: Should set gitops.argoRBAC
+    set:
+      main:
+        gitops:
+          argoRBAC: |
+            defaultPolicy: "role:readonly"
+            policy: "g, custom-admins, role:admin"
+            scopes: "[groups,email]"
+    asserts:
+      - exists:
+          path: data["gitops.argoRBAC"]
+
   - it: Should set gitea parameters
     set:
       main:

values.yaml

@@ -27,6 +27,9 @@ main:
     # -- Comma-separated list of additional ArgoCD admin groups.
     # Only used when argoRBAC is not set.
     additionalArgoAdmins: ""
+    # -- Full ArgoCD RBAC spec as a YAML string. When set, it completely
+    # overrides the default RBAC policy and additionalArgoAdmins is ignored.
+    argoRBAC: ""
 
   # -- Settings related to the in-cluster gitea installation
   gitea: