From e4b597be150c8421d2e9ccf6ea9bcf1ad9ce325d Mon Sep 17 00:00:00 2001
From: Platform Engineer <platform-engineer@rogi.casa>
Date: Mon, 6 Jul 2026 02:46:21 +0000
Subject: [PATCH] fix(argocd): add RBAC policy for platform-engineer account

The platform-engineer ArgoCD account was created in argocd-cm.yaml but
had no RBAC role binding, causing 403 permission denied on all API calls
to /api/v1/applications/<name>. This adds argocd-rbac-cm.yaml granting
the platform-engineer role full access to applications, projects,
clusters, and repositories.
---
 argocd/argocd-rbac-cm.yaml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 argocd/argocd-rbac-cm.yaml

diff --git a/argocd/argocd-rbac-cm.yaml b/argocd/argocd-rbac-cm.yaml
new file mode 100644
index 0000000..8048ab1
--- /dev/null
+++ b/argocd/argocd-rbac-cm.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-rbac-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  policy.default: role:readonly
+  policy.csv: |
+    p, role:platform-engineer, applications, *, */*, allow
+    p, role:platform-engineer, projects, *, *, allow
+    p, role:platform-engineer, clusters, *, *, allow
+    p, role:platform-engineer, repositories, *, *, allow
+    g, platform-engineer, role:platform-engineer