ArgoCD SSO via Keycloak OIDC

[dcmcand]

Summary

Closes #227

• Configure ArgoCD with Keycloak OIDC SSO as part of initial deployment
• Create argocd-admins (full admin) and argocd-viewers (read-only) Keycloak groups mapped to ArgoCD RBAC roles
• Pre-generate OIDC client secret in Go, inject into ArgoCD Helm values and store as K8s secret for realm-setup job
• Extend realm-setup job to create ArgoCD OIDC client, groups, and add realm admin to argocd-admins
• Update post-deploy instructions with SSO login info and break-glass admin fallback

How it works

1. deploy.go generates a client secret upfront
2. ArgoCD is installed via Helm with OIDC config (ConfigWithOIDC()) referencing Keycloak's issuer URL and the client secret
3. The secret is also stored as argocd-oidc-client-secret in the keycloak namespace
4. When Keycloak deploys (sync wave 4), the PostSync realm-setup job reads the secret and creates the matching OIDC client, groups, and group membership
5. ArgoCD's OIDC discovery is lazy, so SSO starts working once Keycloak is ready

Test plan

• Unit tests pass: go test ./... -v
• Linter clean: golangci-lint run
• Deploy to local cluster, verify ArgoCD shows "Log in via Keycloak" button
• Log in as realm admin, verify admin access (argocd-admins group)
• Create user in argocd-viewers group, verify read-only access
• Create user not in either group, verify access denied
• Re-run deploy (idempotency), verify no errors