roger/k3s-cluster
1
0
Fork 1
Code Issues Pull Requests 6 Actions Packages Projects Releases Wiki Activity

fix(argocd): add RBAC ConfigMap for platform-engineer account #5

Closed
platform-engineer-agent wants to merge 1 commits from platform-engineer-agent/k3s-cluster:fix-argocd-rbac into main
pull from: platform-engineer-agent/k3s-cluster:fix-argocd-rbac
merge into: roger:main
Conversation 0 Commits 1 Files Changed 1 +15
platform-engineer-agent commented 2026-07-06 02:40:44 +02:00
Collaborator
Copy Link

The platform-engineer ArgoCD account was created in argocd-cm.yaml with apiKey capability, but no argocd-rbac-cm ConfigMap exists in the repo.

This means the account has default (empty) RBAC — every API call (GET /api/v1/applications, GET /api/v1/applications/<name>, etc.) returns 403 Forbidden.

The platform-engineer cron jobs cannot read app health or trigger syncs.

Fix: Add argocd/argocd-rbac-cm.yaml granting the platform-engineer role:

  • applications, get, */*, allow
  • applications, sync, */*, allow
  • projects, get, *, allow

No changes to existing resources. ArgoCD will pick this up via GitOps selfHeal.

The `platform-engineer` ArgoCD account was created in `argocd-cm.yaml` with `apiKey` capability, but **no `argocd-rbac-cm` ConfigMap exists** in the repo. This means the account has default (empty) RBAC — every API call (`GET /api/v1/applications`, `GET /api/v1/applications/<name>`, etc.) returns **403 Forbidden**. The platform-engineer cron jobs cannot read app health or trigger syncs. **Fix:** Add `argocd/argocd-rbac-cm.yaml` granting the `platform-engineer` role: - `applications, get, */*, allow` - `applications, sync, */*, allow` - `projects, get, *, allow` No changes to existing resources. ArgoCD will pick this up via GitOps selfHeal.
platform-engineer-agent added 1 commit 2026-07-06 02:40:46 +02:00
fix(argocd): add RBAC ConfigMap granting platform-engineer account read+sync access 3542bcc8fb 
The platform-engineer ArgoCD account was created (argocd-cm.yaml) with
apiKey capability, but no argocd-rbac-cm ConfigMap existed, so the account
had default (empty) RBAC and every API call returned 403.

This adds the RBAC policy granting the platform-engineer role:
- get applications (all projects/namespaces)
- sync applications (all projects/namespaces)
- get projects

Needed for the platform-engineer cron jobs to read app health and trigger
syncs via the ArgoCD API.

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
platform-engineer-agent roger
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: roger/k3s-cluster#5
No description provided.
Delete Branch "platform-engineer-agent/k3s-cluster:fix-argocd-rbac"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?