From 792380b631f7f9e45255e8a56a2939f31c0acb2d Mon Sep 17 00:00:00 2001
From: Platform Engineer <platform-engineer@rogi.casa>
Date: Mon, 6 Jul 2026 00:39:54 +0000
Subject: [PATCH] fix(argocd): add RBAC ConfigMap granting platform-engineer
 account read+sync access

The platform-engineer ArgoCD account was created (argocd-cm.yaml) with
apiKey capability, but no argocd-rbac-cm ConfigMap existed, so the account
had default (empty) RBAC and every API call returned 403.

This adds the RBAC policy granting the platform-engineer role:
- get applications (all projects/namespaces)
- sync applications (all projects/namespaces)
- get projects

Needed for the platform-engineer cron jobs to read app health and trigger
syncs via the ArgoCD API.
---
 argocd/argocd-rbac-cm.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 argocd/argocd-rbac-cm.yaml

diff --git a/argocd/argocd-rbac-cm.yaml b/argocd/argocd-rbac-cm.yaml
new file mode 100644
index 0000000..9528733
--- /dev/null
+++ b/argocd/argocd-rbac-cm.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-rbac-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  policy.default: ""
+  policy.csv: |
+    p, role:platform-engineer, applications, get, */*, allow
+    p, role:platform-engineer, applications, sync, */*, allow
+    p, role:platform-engineer, projects, get, *, allow
+    g, platform-engineer, role:platform-engineer