From 3542bcc8fb64a37e573c3289e97f8cb8d81f97b4 Mon Sep 17 00:00:00 2001
From: Platform Engineer <platform-engineer@rogi.casa>
Date: Mon, 6 Jul 2026 00:39:54 +0000
Subject: [PATCH 1/2] fix(argocd): add RBAC ConfigMap granting
 platform-engineer account read+sync access

The platform-engineer ArgoCD account was created (argocd-cm.yaml) with
apiKey capability, but no argocd-rbac-cm ConfigMap existed, so the account
had default (empty) RBAC and every API call returned 403.

This adds the RBAC policy granting the platform-engineer role:
- get applications (all projects/namespaces)
- sync applications (all projects/namespaces)
- get projects

Needed for the platform-engineer cron jobs to read app health and trigger
syncs via the ArgoCD API.
---
 argocd/argocd-rbac-cm.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 argocd/argocd-rbac-cm.yaml

diff --git a/argocd/argocd-rbac-cm.yaml b/argocd/argocd-rbac-cm.yaml
new file mode 100644
index 0000000..9528733
--- /dev/null
+++ b/argocd/argocd-rbac-cm.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-rbac-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  policy.default: ""
+  policy.csv: |
+    p, role:platform-engineer, applications, get, */*, allow
+    p, role:platform-engineer, applications, sync, */*, allow
+    p, role:platform-engineer, projects, get, *, allow
+    g, platform-engineer, role:platform-engineer
-- 
2.49.1


From ef17dc6c32203c615e93e568af3de7cecc95d335 Mon Sep 17 00:00:00 2001
From: Platform Engineer <platform-engineer@rogi.casa>
Date: Mon, 6 Jul 2026 03:41:25 +0000
Subject: [PATCH 2/2] fix(myorg-assistant): fix CronJob image references to use
 Gitea registry image

CronJobs were referencing 'myorg-assistant:latest' (a local image that
doesn't exist in the cluster), causing ImagePullBackOff on all 4 active
CronJob pods. Updated all 5 CronJob manifests to use the same image as
the Deployment (git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf)
and added imagePullSecrets: gitea-registry for authentication.
---
 myorg-assistant/cronjobs/deadline-checker.yaml | 4 +++-
 myorg-assistant/cronjobs/evening-summary.yaml  | 4 +++-
 myorg-assistant/cronjobs/git-sync.yaml         | 4 +++-
 myorg-assistant/cronjobs/morning-briefing.yaml | 4 +++-
 myorg-assistant/cronjobs/waiting-followup.yaml | 4 +++-
 5 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/myorg-assistant/cronjobs/deadline-checker.yaml b/myorg-assistant/cronjobs/deadline-checker.yaml
index d6e0c2a..6370968 100644
--- a/myorg-assistant/cronjobs/deadline-checker.yaml
+++ b/myorg-assistant/cronjobs/deadline-checker.yaml
@@ -22,9 +22,11 @@ spec:
             job: deadline-checker
         spec:
           restartPolicy: OnFailure
+          imagePullSecrets:
+          - name: gitea-registry
           containers:
           - name: deadline-checker
-            image: myorg-assistant:latest
+            image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
             imagePullPolicy: IfNotPresent
             command:
             - python
diff --git a/myorg-assistant/cronjobs/evening-summary.yaml b/myorg-assistant/cronjobs/evening-summary.yaml
index f4e35d5..75a23e7 100644
--- a/myorg-assistant/cronjobs/evening-summary.yaml
+++ b/myorg-assistant/cronjobs/evening-summary.yaml
@@ -22,9 +22,11 @@ spec:
             job: evening-summary
         spec:
           restartPolicy: OnFailure
+          imagePullSecrets:
+          - name: gitea-registry
           containers:
           - name: evening-summary
-            image: myorg-assistant:latest
+            image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
             imagePullPolicy: IfNotPresent
             command:
             - python
diff --git a/myorg-assistant/cronjobs/git-sync.yaml b/myorg-assistant/cronjobs/git-sync.yaml
index 45d42ea..dd9b07b 100644
--- a/myorg-assistant/cronjobs/git-sync.yaml
+++ b/myorg-assistant/cronjobs/git-sync.yaml
@@ -22,9 +22,11 @@ spec:
             job: git-sync
         spec:
           restartPolicy: OnFailure
+          imagePullSecrets:
+          - name: gitea-registry
           containers:
           - name: git-sync
-            image: myorg-assistant:latest
+            image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
             imagePullPolicy: IfNotPresent
             command:
             - python
diff --git a/myorg-assistant/cronjobs/morning-briefing.yaml b/myorg-assistant/cronjobs/morning-briefing.yaml
index b73bb9a..2b5aa38 100644
--- a/myorg-assistant/cronjobs/morning-briefing.yaml
+++ b/myorg-assistant/cronjobs/morning-briefing.yaml
@@ -22,9 +22,11 @@ spec:
             job: morning-briefing
         spec:
           restartPolicy: OnFailure
+          imagePullSecrets:
+          - name: gitea-registry
           containers:
           - name: morning-briefing
-            image: myorg-assistant:latest
+            image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
             imagePullPolicy: IfNotPresent
             command:
             - python
diff --git a/myorg-assistant/cronjobs/waiting-followup.yaml b/myorg-assistant/cronjobs/waiting-followup.yaml
index 33d70c0..9f44c72 100644
--- a/myorg-assistant/cronjobs/waiting-followup.yaml
+++ b/myorg-assistant/cronjobs/waiting-followup.yaml
@@ -22,9 +22,11 @@ spec:
             job: waiting-followup
         spec:
           restartPolicy: OnFailure
+          imagePullSecrets:
+          - name: gitea-registry
           containers:
           - name: waiting-followup
-            image: myorg-assistant:latest
+            image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
             imagePullPolicy: IfNotPresent
             command:
             - python
-- 
2.49.1