forked from roger/k3s-cluster
086c6a8937
The platform-engineer ArgoCD account was created in argocd-cm.yaml but no argocd-rbac-cm.yaml existed, so ArgoCD's default-deny policy blocked all API calls with 'permission denied'. This grants the account read access to applications, clusters, repositories, and projects, plus the ability to trigger syncs — exactly what the platform-engineer bot needs.
21 lines
689 B
YAML
21 lines
689 B
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: argocd-rbac-cm
|
|
namespace: argocd
|
|
labels:
|
|
app.kubernetes.io/name: argocd-rbac-cm
|
|
app.kubernetes.io/part-of: argocd
|
|
data:
|
|
# Default policy: readonly for all authenticated users
|
|
policy.default: role:readonly
|
|
|
|
# platform-engineer account: read all apps + trigger syncs
|
|
policy.csv: |
|
|
p, role:platform-engineer, applications, get, */*, allow
|
|
p, role:platform-engineer, applications, sync, */*, allow
|
|
p, role:platform-engineer, clusters, get, *, allow
|
|
p, role:platform-engineer, repositories, get, *, allow
|
|
p, role:platform-engineer, projects, get, *, allow
|
|
g, platform-engineer, role:platform-engineer
|