harden(argo-setup): tighten Layer 1 RBAC, pin v3.3.9, add CI + kind smoke

[jdaln]

No description provided.

[Copilot]

Pull request overview

This PR hardens the Argo CD “argo-setup” overlay by pinning the upstream HA manifest to a specific Argo CD version, tightening Layer-1 RBAC, and adding automation (CI + scripts) to detect RBAC drift and smoke-test the overlay on kind.

Changes:

• Pin Argo CD HA base to v3.3.9, add PDBs, add/adjust RBAC ConfigMap and tightened ClusterRoles (including emptying the ApplicationSet controller ClusterRole).
• Add CI workflows + scripts: upstream RBAC drift detection via reviewed snapshots, and a kind-based overlay smoke test.
• Extend AppProject resource allow-lists to include Gateway API resources for forward-compat, and add RBAC layering documentation.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
scripts/kind-argo-test.sh	New kind E2E smoke script validating overlay rollout, RBAC/SARs, PDBs, AppProjects, and NetworkPolicy behavior
scripts/check-upstream-argo-clusterroles.sh	New script to diff upstream Argo CD RBAC vs committed reviewed snapshots
projects/templates/federation/values.yaml	Allow Gateway API kinds in federated project template resource list
projects/static/mip-monitoring/mip-monitoring.yaml	Allow Gateway API kinds in monitoring AppProject
projects/static/mip-common/mip-common.yaml	Allow Gateway API kinds (including GatewayClass) in common AppProject
docs/rbac-layers.md	New documentation mapping RBAC/privilege “layers” and operational hardening TODOs
base/argo-projects/argo-projects.yaml	Add namespace for default AppProject to ensure correct apply target
argo-setup/upstream-snapshot/roles.yaml	New reviewed snapshot for upstream namespaced Roles (used by drift check)
argo-setup/upstream-snapshot/clusterroles.yaml	New reviewed snapshot for upstream ClusterRoles (used by drift check)
argo-setup/README.md	Update overlay README: exposure guidance, patch inventory notes, secrets bootstrap note
argo-setup/patches/poddisruptionbudgets.yaml	Add PDBs for HA Argo CD components
argo-setup/patches/patch-argocd-server-clusterrole.yaml	Tighten server ClusterRole (drop cluster-wide secret read; read-only cert-manager; add read-only ECK CRs)
argo-setup/patches/patch-argocd-rbac-cm.yaml	Add global UI/API RBAC configmap patch (argocd-rbac-cm)
argo-setup/patches/patch-argocd-ingress.yaml	Remove old ingress patch
argo-setup/patches/patch-argocd-cm.yaml	Tune Argo CD config (instance label key, reconciliation tuning, resource exclusions)
argo-setup/patches/patch-argocd-applicationset-controller-clusterrole*.yaml	Remove cluster-wide permissions from applicationset-controller via empty ClusterRole + binding patch
argo-setup/patches/patch-argocd-application-controller-clusterrole.yaml	Tighten controller ClusterRole; add Gateway API writes; restrict pods to delete-only; remove webhook write grant
argo-setup/patches/kustomization.yaml	Pin upstream to v3.3.9, switch to patches:, add PDB + ingress resources, add seccomp patches, add binding patches
argo-setup/patches/argocd-server-ingress.yaml	Add Traefik-oriented Ingress manifest for exposing argocd-server
.github/workflows/kind-argo-smoke.yml	New CI workflow running kind overlay smoke test
.github/workflows/argo-clusterroles-drift.yml	New CI workflow to detect upstream RBAC drift vs snapshots
.githooks/pre-commit	Update critical file path reference for moved argo-projects manifest

Comments suppressed due to low confidence (2)

argo-setup/upstream-snapshot/clusterroles.yaml:87

• The committed snapshot ends with a literal ... document marker / placeholder. The drift-check script generates concrete YAML docs and will never produce this placeholder, so diff -u will report drift on every run (and the snapshot is also incomplete after this point). Re-generate this file via bash scripts/check-upstream-argo-clusterroles.sh --update and commit the full output (no placeholders).

    nonResourceURLs: []
---
...

argo-setup/upstream-snapshot/roles.yaml:116

• Same issue as clusterroles.yaml: this snapshot file contains a literal ... placeholder and is truncated. As a result the drift check will always fail and/or miss role changes. Re-generate with bash scripts/check-upstream-argo-clusterroles.sh --update and commit the full output.

    resourceNames: []
    verbs: [create, list]
---
...

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[KFilippopolitis]

LGTM!