From e28e22daaff04d1aa6cb1bca7874aae2cb266fdd Mon Sep 17 00:00:00 2001 From: Mukul Sharma Date: Wed, 2 Sep 2026 01:29:39 +0530 Subject: [PATCH] Add jenkins-ci scoped ArgoCD account and RBAC to argocd custom-values Adds accounts.jenkins-ci (apiKey) and a repo-scoped RBAC policy (sync/get on default/demo-go-app only) so devops-lib's syncArgoApp stage can trigger syncs without full admin access. --- .../argocd-admin-prd/custom-values.yaml | 24 +++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-admin-prd/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-admin-prd/custom-values.yaml index 6cafcaa..93da853 100644 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-admin-prd/custom-values.yaml +++ b/helm-overrides/k8s-admin-prd-ase1/argocd-admin-prd/custom-values.yaml @@ -91,10 +91,26 @@ argo-cd: hs.status = "Healthy" hs.message = "Ingress considered healthy on sight — this cluster's Contour has no LoadBalancer status to wait on (hostPort, not MetalLB)." return hs - # No custom RBAC policy: single-user homelab, the initial admin secret - # (kubectl -n argocd get secret argocd-initial-admin-secret) is enough. - # The fleet's role:admins / role:backend / GitHub-team policy.csv and - # real teammate emails from the source cluster are dropped here. + # Scoped account for Jenkins to trigger a sync as the last step of the + # CI/CD pipeline — devops-lib's real deployArgoCD.groovy always closes + # its 4-step ceremony with `argocd app sync --hard-refresh`; without + # this, our pipeline stops at the tag-bump commit and a human has to + # remember to click Sync. Uses apiKey auth (token-based), not the + # admin account — same least-privilege pattern as Harbor's robot + # account. Token itself is generated via CLI (not declarative — see + # bootstrap note in devops-lib's syncArgoApp.groovy) and stored in + # Vault like every other credential here. + accounts.jenkins-ci: apiKey + accounts.jenkins-ci.enabled: "true" + # No custom RBAC policy beyond the jenkins-ci account below: single-user + # homelab, the initial admin secret (kubectl -n argocd get secret + # argocd-initial-admin-secret) is enough for you. The fleet's + # role:admins / role:backend / GitHub-team policy.csv and real teammate + # emails from the source cluster are dropped here. + rbac: + policy.csv: | + p, jenkins-ci, applications, sync, default/demo-go-app, allow + p, jenkins-ci, applications, get, default/demo-go-app, allow repositories: devops-infra-helm-charts: url: http://gitea.192.168.1.7.nip.io/mukul/devops-infra-helm-charts.git