forked from roger/k3s-cluster
The platform-engineer ArgoCD account was created (argocd-cm.yaml) with apiKey capability, but no argocd-rbac-cm ConfigMap existed, so the account had default (empty) RBAC and every API call returned 403. This adds the RBAC policy granting the platform-engineer role: - get applications (all projects/namespaces) - sync applications (all projects/namespaces) - get projects Needed for the platform-engineer cron jobs to read app health and trigger syncs via the ArgoCD API.