modified: apps/argocd-config/argocd-cm.yaml

new file:   apps/argocd-config/argocd-rbac-cm.yaml
	modified:   apps/argocd-config/external-secret.yaml
	modified:   apps/argocd-config/kustomization.yaml

apps/argocd-config/argocd-rbac-cm.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-rbac-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  policy.csv: |
+    g, ArgoCD Admins, role:admin
+    g, ArgoCD Viewers, role:readonly
+  scopes: "[groups, email]" # Optional, falls Dex Scopes braucht