From c97164773446538fce800cd6942ca082f0a308b7 Mon Sep 17 00:00:00 2001
From: platform-engineer <platform-engineer@rogi.casa>
Date: Mon, 6 Jul 2026 13:06:51 +0000
Subject: [PATCH] fix(argocd): add argocd-rbac-cm granting platform-engineer
 read+sync on applications
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The platform-engineer ArgoCD local account had apiKey+login capabilities
but no RBAC role assignment. With no argocd-rbac-cm ConfigMap in the repo,
the default policy gave the account zero permissions, so every API call
to list applications returned an empty list — the watchdog could not see
any apps to check their health.

This adds an argocd-rbac-cm ConfigMap with a role:platform-engineer that
has get (read) and sync on all applications in all projects, and assigns
the platform-engineer account to that role.
---
 argocd/argocd-rbac-cm.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 argocd/argocd-rbac-cm.yaml

diff --git a/argocd/argocd-rbac-cm.yaml b/argocd/argocd-rbac-cm.yaml
new file mode 100644
index 0000000..514a762
--- /dev/null
+++ b/argocd/argocd-rbac-cm.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-rbac-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  policy.csv: |
+    # Grant the platform-engineer local account read + sync access to all applications
+    p, role:platform-engineer, applications, get, */*, allow
+    p, role:platform-engineer, application, sync, */*, allow
+    g, platform-engineer, role:platform-engineer
+  policy.default: ""