From 6f1826761e06dcae4846080a22f1fe28223c4311 Mon Sep 17 00:00:00 2001
From: Platform Engineer <platform-engineer@rogi.casa>
Date: Mon, 6 Jul 2026 08:28:14 +0000
Subject: [PATCH] fix(argocd): preserve roger admin access + set default
 readonly in RBAC ConfigMap

---
 argocd/argocd-rbac-cm.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/argocd/argocd-rbac-cm.yaml b/argocd/argocd-rbac-cm.yaml
index 9528733..32cff15 100644
--- a/argocd/argocd-rbac-cm.yaml
+++ b/argocd/argocd-rbac-cm.yaml
@@ -7,9 +7,10 @@ metadata:
     app.kubernetes.io/name: argocd-rbac-cm
     app.kubernetes.io/part-of: argocd
 data:
-  policy.default: ""
+  policy.default: role:readonly
   policy.csv: |
     p, role:platform-engineer, applications, get, */*, allow
     p, role:platform-engineer, applications, sync, */*, allow
     p, role:platform-engineer, projects, get, *, allow
     g, platform-engineer, role:platform-engineer
+    g, roger, role:admin