feat: add oidc-rbac component for service account issuer discovery

Allow unauthenticated access to OIDC discovery endpoints by deploying
the oidc-reviewer ClusterRoleBinding to all site and global clusters.

Author: skrobul

charts/argocd-understack/templates/application-oidc-rbac.yaml

@@ -0,0 +1,30 @@
+{{- if or (eq (include "understack.isEnabled" (list $.Values.global "oidc_rbac")) "true") (eq (include "understack.isEnabled" (list $.Values.site "oidc_rbac")) "true") }}
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: {{ printf "%s-%s" $.Release.Name "oidc-rbac" }}
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/compare-options: ServerSideDiff=true,IncludeMutationWebhook=true
+{{- include "understack.appLabelsBlock" $ | nindent 2 }}
+spec:
+  destination:
+    namespace: kube-system
+    server: {{ $.Values.cluster_server }}
+  project: understack-infra
+  sources:
+  - path: components/oidc-rbac
+    ref: understack
+    repoURL: {{ include "understack.understack_url" $ }}
+    targetRevision: {{ include "understack.understack_ref" $ }}
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+    - ServerSideApply=true
+    - RespectIgnoreDifferences=true
+    - ApplyOutOfSyncOnly=true
+{{- end }}

charts/argocd-understack/values.yaml

@@ -166,6 +166,12 @@ global:
     # @default -- false
     enabled: false
 
+  # -- OIDC RBAC (ClusterRoleBindings for OIDC service account issuer discovery)
+  oidc_rbac:
+    # -- Enable/disable deploying OIDC RBAC
+    # @default -- true
+    enabled: true
+
   # -- OpenEBS
   openebs:
     # -- Enable/disable deploying OpenEBS
@@ -505,6 +511,12 @@ site:
     # @default -- false
     enabled: false
 
+  # -- OIDC RBAC (ClusterRoleBindings for OIDC service account issuer discovery)
+  oidc_rbac:
+    # -- Enable/disable deploying OIDC RBAC
+    # @default -- true
+    enabled: true
+
   # -- OpenEBS
   openebs:
     # -- Enable/disable deploying OpenEBS

components/oidc-rbac/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - oidc-reviewer.yaml

components/oidc-rbac/oidc-reviewer.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: oidc-reviewer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:service-account-issuer-discovery
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: Group
+  name: system:unauthenticated

docs/deploy-guide/components/oidc-rbac.md

@@ -0,0 +1,44 @@
+---
+kustomize_paths:
+- components/oidc-rbac
+deploy_overrides:
+  helm:
+    mode: none
+  kustomize:
+    mode: none
+---
+
+# oidc-rbac
+
+OIDC RBAC configuration for Kubernetes service account issuer discovery.
+
+## Deployment Scope
+
+- Cluster scope: global, site
+- Values key: `global.oidc_rbac`, `site.oidc_rbac`
+- ArgoCD Application template: `charts/argocd-understack/templates/application-oidc-rbac.yaml`
+
+## How ArgoCD Builds It
+
+{{ component_argocd_builds() }}
+
+## How to Enable
+
+This component is enabled by default. To disable it:
+
+```yaml title="$CLUSTER_NAME/deploy.yaml"
+global:
+  oidc_rbac:
+    enabled: false
+site:
+  oidc_rbac:
+    enabled: false
+```
+
+## Deployment Repo Content
+
+{{ secrets_disclaimer }}
+
+Required or commonly required items:
+
+- None for this Application today. It deploys the shared `components/oidc-rbac` base directly and does not consume deploy-repo values or overlay manifests.