apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
  labels:
    app.kubernetes.io/name: argocd-rbac-cm
    app.kubernetes.io/part-of: argocd
data:
  # policy.csv is an file containing user-defined RBAC policies and role definitions (optional).
  # Policy rules are in the form:
  #   p, subject, resource, action, object, effect
  # Role definitions and bindings are in the form:
  #   g, subject, inherited-subject
  # See https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/rbac.md for additional information.
  # Replace <your_azure_ad_group_id> with your own value
  policy.csv: |
    g, <your_azure_ad_group_id>, role:admin

  # policy.default is the name of the default role which Argo CD will falls back to, when
  # authorizing API requests (optional). If omitted or empty, users may be still be able to login,
  # but will see no apps, projects, etc...
  policy.default: role:readonly