fix(argocd): add RBAC ConfigMap granting platform-engineer read+sync access

The platform-engineer ArgoCD account was created in argocd-cm.yaml but no argocd-rbac-cm.yaml existed, so ArgoCD's default-deny policy blocked all API calls with 'permission denied'. This grants the account read access to applications, clusters, repositories, and projects, plus the ability to trigger syncs — exactly what the platform-engineer bot needs.
Merge remote-tracking branch 'upstream/main'
2026-07-05 23:31:35 +00:00 · 2026-07-05 23:28:11 +00:00 · 2026-07-05 23:15:33 +00:00 · 2026-07-05 19:02:46 +00:00
7 changed files with 20 additions and 31 deletions
--- a/argocd-bootstrap.yaml
+++ b/argocd-bootstrap.yaml
@@ -22,9 +22,3 @@ spec:
      selfHeal: true
    syncOptions:
      - CreateNamespace=false
-  ignoreDifferences:
-    - group: argoproj.io
-      kind: Application
-      jsonPointers:
-        - /status
-        - /operation
--- a/argocd/argocd-rbac-cm.yaml
+++ b/argocd/argocd-rbac-cm.yaml
@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-rbac-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  # Default policy: readonly for all authenticated users
+  policy.default: role:readonly
+
+  # platform-engineer account: read all apps + trigger syncs
+  policy.csv: |
+    p, role:platform-engineer, applications, get, */*, allow
+    p, role:platform-engineer, applications, sync, */*, allow
+    p, role:platform-engineer, clusters, get, *, allow
+    p, role:platform-engineer, repositories, get, *, allow
+    p, role:platform-engineer, projects, get, *, allow
+    g, platform-engineer, role:platform-engineer
--- a/myorg-assistant/cronjobs/deadline-checker.yaml
+++ b/myorg-assistant/cronjobs/deadline-checker.yaml
@@ -53,11 +53,6 @@ spec:
                secretKeyRef:
                  name: myorg-assistant-secret
                  key: LITELLM_API_KEY
-            - name: WEB_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: myorg-assistant-secret
-                  key: WEB_SECRET_KEY
            volumeMounts:
            - name: myorg-data
              mountPath: /data/myorg
--- a/myorg-assistant/cronjobs/evening-summary.yaml
+++ b/myorg-assistant/cronjobs/evening-summary.yaml
@@ -53,11 +53,6 @@ spec:
                secretKeyRef:
                  name: myorg-assistant-secret
                  key: LITELLM_API_KEY
-            - name: WEB_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: myorg-assistant-secret
-                  key: WEB_SECRET_KEY
            volumeMounts:
            - name: myorg-data
              mountPath: /data/myorg
--- a/myorg-assistant/cronjobs/git-sync.yaml
+++ b/myorg-assistant/cronjobs/git-sync.yaml
@@ -68,11 +68,6 @@ spec:
                secretKeyRef:
                  name: myorg-assistant-secret
                  key: LITELLM_API_KEY
-            - name: WEB_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: myorg-assistant-secret
-                  key: WEB_SECRET_KEY
            volumeMounts:
            - name: myorg-data
              mountPath: /data/myorg
--- a/myorg-assistant/cronjobs/morning-briefing.yaml
+++ b/myorg-assistant/cronjobs/morning-briefing.yaml
@@ -60,11 +60,6 @@ spec:
                secretKeyRef:
                  name: myorg-assistant-secret
                  key: LITELLM_API_KEY
-            - name: WEB_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: myorg-assistant-secret
-                  key: WEB_SECRET_KEY
            volumeMounts:
            - name: myorg-data
              mountPath: /data/myorg
--- a/myorg-assistant/cronjobs/waiting-followup.yaml
+++ b/myorg-assistant/cronjobs/waiting-followup.yaml
@@ -53,11 +53,6 @@ spec:
                secretKeyRef:
                  name: myorg-assistant-secret
                  key: LITELLM_API_KEY
-            - name: WEB_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: myorg-assistant-secret
-                  key: WEB_SECRET_KEY
            volumeMounts:
            - name: myorg-data
              mountPath: /data/myorg
Author	SHA1	Message	Date
Platform Engineer Agent	086c6a8937	fix(argocd): add RBAC ConfigMap granting platform-engineer read+sync access The platform-engineer ArgoCD account was created in argocd-cm.yaml but no argocd-rbac-cm.yaml existed, so ArgoCD's default-deny policy blocked all API calls with 'permission denied'. This grants the account read access to applications, clusters, repositories, and projects, plus the ability to trigger syncs — exactly what the platform-engineer bot needs.	2026-07-05 23:31:35 +00:00
Platform Engineer Agent	53ea993438	Merge remote-tracking branch 'upstream/main'	2026-07-05 23:28:11 +00:00
Roger Oriol	63e93cbd39	configure higher cron schedules	2026-07-05 23:15:33 +00:00
Platform Engineer	a84e348263	fix(myorg-assistant): fix CronJob image refs to use full registry path + imagePullSecrets CronJobs were using bare image name 'myorg-assistant:latest' with imagePullPolicy: IfNotPresent and no imagePullSecrets. K8s tried to pull from Docker Hub → ImagePullBackOff on all 4 running CronJob pods. Changed to git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf (matching the Deployment), imagePullPolicy: Always, and added imagePullSecrets: gitea-registry to all 5 CronJob manifests.	2026-07-05 19:02:46 +00:00