fix(argocd): preserve roger admin access + set default readonly in RBAC ConfigMap

CronJobs were referencing 'myorg-assistant:latest' (a local image that
doesn't exist in the cluster), causing ImagePullBackOff on all 4 active
CronJob pods. Updated all 5 CronJob manifests to use the same image as
the Deployment (git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf)
and added imagePullSecrets: gitea-registry for authentication.

argocd-bootstrap.yaml

@@ -22,9 +22,3 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=false
-  ignoreDifferences:
-    - group: argoproj.io
-      kind: Application
-      jsonPointers:
-        - /status
-        - /operation

argocd/argocd-rbac-cm.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-rbac-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  policy.default: role:readonly
+  policy.csv: |
+    p, role:platform-engineer, applications, get, */*, allow
+    p, role:platform-engineer, applications, sync, */*, allow
+    p, role:platform-engineer, projects, get, *, allow
+    g, platform-engineer, role:platform-engineer
+    g, roger, role:admin

myorg-assistant/cronjobs/deadline-checker.yaml

@@ -27,7 +27,7 @@ spec:
           containers:
           - name: deadline-checker
             image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
-            imagePullPolicy: Always
+            imagePullPolicy: IfNotPresent
             command:
             - python
             - run_job.py
@@ -53,11 +53,6 @@ spec:
                 secretKeyRef:
                   name: myorg-assistant-secret
                   key: LITELLM_API_KEY
-            - name: WEB_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: myorg-assistant-secret
-                  key: WEB_SECRET_KEY
             volumeMounts:
             - name: myorg-data
               mountPath: /data/myorg

myorg-assistant/cronjobs/evening-summary.yaml

@@ -27,7 +27,7 @@ spec:
           containers:
           - name: evening-summary
             image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
-            imagePullPolicy: Always
+            imagePullPolicy: IfNotPresent
             command:
             - python
             - run_job.py
@@ -53,11 +53,6 @@ spec:
                 secretKeyRef:
                   name: myorg-assistant-secret
                   key: LITELLM_API_KEY
-            - name: WEB_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: myorg-assistant-secret
-                  key: WEB_SECRET_KEY
             volumeMounts:
             - name: myorg-data
               mountPath: /data/myorg

myorg-assistant/cronjobs/git-sync.yaml

@@ -27,7 +27,7 @@ spec:
           containers:
           - name: git-sync
             image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
-            imagePullPolicy: Always
+            imagePullPolicy: IfNotPresent
             command:
             - python
             - run_job.py
@@ -68,11 +68,6 @@ spec:
                 secretKeyRef:
                   name: myorg-assistant-secret
                   key: LITELLM_API_KEY
-            - name: WEB_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: myorg-assistant-secret
-                  key: WEB_SECRET_KEY
             volumeMounts:
             - name: myorg-data
               mountPath: /data/myorg

myorg-assistant/cronjobs/morning-briefing.yaml

@@ -27,7 +27,7 @@ spec:
           containers:
           - name: morning-briefing
             image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
-            imagePullPolicy: Always
+            imagePullPolicy: IfNotPresent
             command:
             - python
             - run_job.py
@@ -60,11 +60,6 @@ spec:
                 secretKeyRef:
                   name: myorg-assistant-secret
                   key: LITELLM_API_KEY
-            - name: WEB_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: myorg-assistant-secret
-                  key: WEB_SECRET_KEY
             volumeMounts:
             - name: myorg-data
               mountPath: /data/myorg

myorg-assistant/cronjobs/waiting-followup.yaml

@@ -27,7 +27,7 @@ spec:
           containers:
           - name: waiting-followup
             image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
-            imagePullPolicy: Always
+            imagePullPolicy: IfNotPresent
             command:
             - python
             - run_job.py
@@ -53,11 +53,6 @@ spec:
                 secretKeyRef:
                   name: myorg-assistant-secret
                   key: LITELLM_API_KEY
-            - name: WEB_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: myorg-assistant-secret
-                  key: WEB_SECRET_KEY
             volumeMounts:
             - name: myorg-data
               mountPath: /data/myorg