From a6146311af820915f0db722ee788d7bb18ec6b65 Mon Sep 17 00:00:00 2001
From: Nikolay Sivko <n.sivko@gmail.com>
Date: Tue, 2 Jun 2026 17:16:30 -0300
Subject: [PATCH] rbac: grant cluster-agent access to ArgoCD resources

---
 .gitignore                  |  1 +
 config/rbac/role.yaml       | 10 ++++++++++
 controller/cluster_agent.go | 23 +++++------------------
 controller/controller.go    |  1 +
 controller/versions.go      |  9 ++-------
 5 files changed, 19 insertions(+), 25 deletions(-)

diff --git a/.gitignore b/.gitignore
index 15400c0..e15d52f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 bin/*
 .idea
 values.yaml
+/build.sh
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index 6a505ae..54b8ae0 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -50,6 +50,16 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - argoproj.io
+  resources:
+  - applications
+  - applicationsets
+  - appprojects
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - batch
   resources:
diff --git a/controller/cluster_agent.go b/controller/cluster_agent.go
index 5ffd4d7..8909d0e 100644
--- a/controller/cluster_agent.go
+++ b/controller/cluster_agent.go
@@ -77,6 +77,11 @@ func (r *CorootReconciler) clusterAgentClusterRole(cr *corootv1.Coroot) *rbacv1.
 				Resources: []string{"*"},
 				Verbs:     verbs,
 			},
+			{
+				APIGroups: []string{"argoproj.io"},
+				Resources: []string{"applications", "applicationsets", "appprojects"},
+				Verbs:     verbs,
+			},
 		},
 	}
 	return role
@@ -126,8 +131,6 @@ func (r *CorootReconciler) clusterAgentDeployment(cr *corootv1.Coroot) *appsv1.D
 		env = append(env, e)
 	}
 	image := r.getAppImage(cr, AppClusterAgent)
-	ksmImage := r.getAppImage(cr, AppKubeStateMetrics)
-
 	volumeMounts := []corev1.VolumeMount{
 		{Name: "tmp", MountPath: "/tmp"},
 	}
@@ -181,22 +184,6 @@ func (r *CorootReconciler) clusterAgentDeployment(cr *corootv1.Coroot) *appsv1.D
 						VolumeMounts: volumeMounts,
 						Env:          env,
 					},
-					{
-						Image:           ksmImage.Name,
-						ImagePullPolicy: ksmImage.PullPolicy,
-						Name:            "kube-state-metrics",
-						Args: []string{
-							"--host=127.0.0.1",
-							"--port=10302",
-							"--resources=namespaces,nodes,daemonsets,deployments,cronjobs,jobs,persistentvolumeclaims,persistentvolumes,pods,replicasets,services,endpoints,statefulsets,storageclasses,volumeattachments",
-							"--metric-labels-allowlist=pods=[*]",
-							"--metric-annotations-allowlist=*=[coroot.com/application-category,coroot.com/custom-application-name]",
-						},
-						Resources: corev1.ResourceRequirements{
-							Requests: cr.Spec.ClusterAgent.Resources.Requests,
-							Limits:   cr.Spec.ClusterAgent.Resources.Limits,
-						},
-					},
 				},
 				Volumes: volumes,
 			},
diff --git a/controller/controller.go b/controller/controller.go
index 0dd4fd0..2a1a751 100644
--- a/controller/controller.go
+++ b/controller/controller.go
@@ -133,6 +133,7 @@ func detectIngressAPIVersion(mgr ctrl.Manager) string {
 // +kubebuilder:rbac:groups=security.openshift.io,resources=securitycontextconstraints,verbs=use
 // +kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get;list;watch
 // +kubebuilder:rbac:groups=source.toolkit.fluxcd.io;kustomize.toolkit.fluxcd.io;helm.toolkit.fluxcd.io;notification.toolkit.fluxcd.io;image.toolkit.fluxcd.io;fluxcd.controlplane.io,resources=*,verbs=get;list;watch
+// +kubebuilder:rbac:groups=argoproj.io,resources=applications;applicationsets;appprojects,verbs=get;list;watch
 
 func (r *CorootReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	logger := ctrl.Log.WithValues("namespace", req.Namespace, "name", req.Name)
diff --git a/controller/versions.go b/controller/versions.go
index eb86f41..4fc36cc 100644
--- a/controller/versions.go
+++ b/controller/versions.go
@@ -15,9 +15,8 @@ import (
 )
 
 const (
-	ClickhouseImage       = "clickhouse:25.11.2-ubi9-0"
-	PrometheusImage       = "prometheus:2.55.1-ubi9-0"
-	KubeStateMetricsImage = "kube-state-metrics:2.15.0-ubi9-0"
+	ClickhouseImage = "clickhouse:25.11.2-ubi9-0"
+	PrometheusImage = "prometheus:2.55.1-ubi9-0"
 )
 
 type App string
@@ -30,7 +29,6 @@ const (
 	AppClickhouse       App = "clickhouse"
 	AppClickhouseKeeper App = "clickhouse-keeper"
 	AppPrometheus       App = "prometheus"
-	AppKubeStateMetrics App = "kube-state-metrics"
 )
 
 func (r *CorootReconciler) getAppImage(cr *corootv1.Coroot, app App) corootv1.ImageSpec {
@@ -44,8 +42,6 @@ func (r *CorootReconciler) getAppImage(cr *corootv1.Coroot, app App) corootv1.Im
 		image = cr.Spec.NodeAgent.Image
 	case AppClusterAgent:
 		image = cr.Spec.ClusterAgent.Image
-	case AppKubeStateMetrics:
-		image = cr.Spec.ClusterAgent.KubeStateMetrics.Image
 	case AppClickhouse:
 		image = cr.Spec.Clickhouse.Image
 	case AppClickhouseKeeper:
@@ -89,7 +85,6 @@ func (r *CorootReconciler) fetchAppVersions() {
 	r.versions[AppClickhouse] = r.RegistryConfig.Image(ClickhouseImage)
 	r.versions[AppClickhouseKeeper] = r.RegistryConfig.Image(ClickhouseImage)
 	r.versions[AppPrometheus] = r.RegistryConfig.Image(PrometheusImage)
-	r.versions[AppKubeStateMetrics] = r.RegistryConfig.Image(KubeStateMetricsImage)
 }
 
 func (r *CorootReconciler) fetchAppVersion(app App) (string, error) {