Compare commits

..

2 Commits

Author SHA1 Message Date
Platform Engineer
ef17dc6c32 fix(myorg-assistant): fix CronJob image references to use Gitea registry image
CronJobs were referencing 'myorg-assistant:latest' (a local image that
doesn't exist in the cluster), causing ImagePullBackOff on all 4 active
CronJob pods. Updated all 5 CronJob manifests to use the same image as
the Deployment (git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf)
and added imagePullSecrets: gitea-registry for authentication.
2026-07-06 03:41:25 +00:00
Platform Engineer
3542bcc8fb fix(argocd): add RBAC ConfigMap granting platform-engineer account read+sync access
The platform-engineer ArgoCD account was created (argocd-cm.yaml) with
apiKey capability, but no argocd-rbac-cm ConfigMap existed, so the account
had default (empty) RBAC and every API call returned 403.

This adds the RBAC policy granting the platform-engineer role:
- get applications (all projects/namespaces)
- sync applications (all projects/namespaces)
- get projects

Needed for the platform-engineer cron jobs to read app health and trigger
syncs via the ArgoCD API.
2026-07-06 00:40:28 +00:00
6 changed files with 30 additions and 5 deletions

View File

@@ -0,0 +1,15 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: argocd-rbac-cm
namespace: argocd
labels:
app.kubernetes.io/name: argocd-rbac-cm
app.kubernetes.io/part-of: argocd
data:
policy.default: ""
policy.csv: |
p, role:platform-engineer, applications, get, */*, allow
p, role:platform-engineer, applications, sync, */*, allow
p, role:platform-engineer, projects, get, *, allow
g, platform-engineer, role:platform-engineer

View File

@@ -22,9 +22,11 @@ spec:
job: deadline-checker job: deadline-checker
spec: spec:
restartPolicy: OnFailure restartPolicy: OnFailure
imagePullSecrets:
- name: gitea-registry
containers: containers:
- name: deadline-checker - name: deadline-checker
image: myorg-assistant:latest image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
command: command:
- python - python

View File

@@ -22,9 +22,11 @@ spec:
job: evening-summary job: evening-summary
spec: spec:
restartPolicy: OnFailure restartPolicy: OnFailure
imagePullSecrets:
- name: gitea-registry
containers: containers:
- name: evening-summary - name: evening-summary
image: myorg-assistant:latest image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
command: command:
- python - python

View File

@@ -22,9 +22,11 @@ spec:
job: git-sync job: git-sync
spec: spec:
restartPolicy: OnFailure restartPolicy: OnFailure
imagePullSecrets:
- name: gitea-registry
containers: containers:
- name: git-sync - name: git-sync
image: myorg-assistant:latest image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
command: command:
- python - python

View File

@@ -22,9 +22,11 @@ spec:
job: morning-briefing job: morning-briefing
spec: spec:
restartPolicy: OnFailure restartPolicy: OnFailure
imagePullSecrets:
- name: gitea-registry
containers: containers:
- name: morning-briefing - name: morning-briefing
image: myorg-assistant:latest image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
command: command:
- python - python

View File

@@ -22,9 +22,11 @@ spec:
job: waiting-followup job: waiting-followup
spec: spec:
restartPolicy: OnFailure restartPolicy: OnFailure
imagePullSecrets:
- name: gitea-registry
containers: containers:
- name: waiting-followup - name: waiting-followup
image: myorg-assistant:latest image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
command: command:
- python - python