changes for amdin -2

templates/backstage-configmap.yaml

@@ -169,3 +169,17 @@ data:
 
     argoWorkflows:
       baseUrl: {{ .Values.integrations.argoWorkflows.url }}
+
+    # Google Workspace Admin Directory API configuration
+    # Used to list all organization users in the Admin page
+    {{- if .Values.googleAdmin.enabled }}
+    googleAdmin:
+      # Service account credentials JSON from GCP Secret Manager
+      serviceAccountCredentials: ${GOOGLE_ADMIN_SA_CREDENTIALS}
+      # Admin email to impersonate (must have admin rights in Google Workspace)
+      adminEmail: {{ .Values.googleAdmin.adminEmail }}
+      # Domain to query for users
+      domain: {{ .Values.googleAdmin.domain }}
+      # Cache TTL in minutes
+      cacheTtlMinutes: {{ .Values.googleAdmin.cacheTtlMinutes | default 5 }}
+    {{- end }}

templates/backstage-rbac.yaml

@@ -11,7 +11,8 @@ rules:
     resources: ["namespaces"]
     verbs: ["get", "list", "watch", "delete"]
 
-  # Read access to environment resources for display, plus ConfigMap management for allhosts
+  # Read access to environment resources for display, plus ConfigMap management
+  # Used for: allhosts ConfigMap, environment-admin-users, environment-tracked-users
   - apiGroups: [""]
     resources: ["resourcequotas", "limitranges", "pods", "services", "configmaps"]
     verbs: ["get", "list", "watch", "create", "patch", "update"]

templates/tracked-users-configmap.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.trackedUsers.enabled -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: environment-tracked-users
+  namespace: {{ .Values.namespaceOverride }}
+  labels:
+    {{- include "backstage.labels" . | nindent 4 }}
+    app.kubernetes.io/component: tracked-users
+data:
+  users.json: |
+    {
+      "users": []
+    }
+{{- end }}

values.yaml

@@ -130,6 +130,27 @@ adminUsers:
   users:
     - vaibhav.pathak
 
+# Tracked Users for Portal Sign-in Tracking
+# Automatically tracks users who sign in via Google OAuth
+trackedUsers:
+  enabled: true
+
+# Google Workspace Admin Directory API configuration
+# Used to list all organization users in the Admin page
+# Prerequisites:
+#   1. Create a Service Account in GCP Console
+#   2. Generate a JSON key and store it in GCP Secret Manager as GOOGLE_ADMIN_SA_CREDENTIALS
+#   3. Enable Domain-Wide Delegation in Google Workspace Admin Console
+#   4. Grant scope: https://www.googleapis.com/auth/admin.directory.user.readonly
+googleAdmin:
+  enabled: true
+  # Admin email to impersonate (must have admin rights in Google Workspace)
+  adminEmail: "admin@onlinesales.ai"
+  # Domain to query for users
+  domain: "onlinesales.ai"
+  # Cache TTL in minutes (default: 5)
+  cacheTtlMinutes: 5
+
 # Service accounts
 serviceAccount:
   create: true