Fix degraded ArgoCD applications

- frigate: Remove duplicate PVCs (Helm manages them), update config size to 15Gi
- gitlab: Fix sync-admin-job secretKeyRef schema error, fetch password via kubectl
- nextcloud: Remove duplicate PVC, remove invalid pod-level securityContext
- rook-ceph: Update cephfs-smb-pvc to 50Gi, remove unsupported dashboard.config
- nessus: Add privileged PSS label for NET_ADMIN/NET_RAW capabilities
- scylla-manager: Add privileged PSS label for SYS_NICE capability
- n8n: Create missing n8n-main-persistence PVC
- projects: Add authentik namespace to applications project destinations

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/frigate/manifests/pvc.yaml

@@ -1,29 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: frigate-config
-  namespace: frigate
-  labels:
-    app.kubernetes.io/name: frigate
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: rook-ceph-block
-  resources:
-    requests:
-      storage: 500Mi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: frigate-media
-  namespace: frigate
-  labels:
-    app.kubernetes.io/name: frigate
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: rook-ceph-block
-  resources:
-    requests:
-      storage: 500Gi

apps/frigate/values.yaml

@@ -138,7 +138,7 @@ persistence:
     enabled: true
     storageClass: rook-ceph-block
     accessMode: ReadWriteOnce
-    size: 500Mi
+    size: 15Gi
   media:
     enabled: true
     storageClass: rook-ceph-block

apps/gitlab/manifests/sync-admin-job.yaml

@@ -26,7 +26,10 @@ spec:
 
           apk add --no-cache postgresql-client curl
 
-          echo "🔄 Syncing GitLab admin permissions from Authentik..."
+          echo "Syncing GitLab admin permissions from Authentik..."
+
+          # Fetch Authentik DB password from secret in authentik namespace
+          AUTHENTIK_DB_PASSWORD=$(kubectl get secret pg-authentik-app -n authentik -o jsonpath='{.data.password}' | base64 -d)
 
           # Get list of users in "authentik Admins" group
           ADMIN_USERS=$(PGPASSWORD="$AUTHENTIK_DB_PASSWORD" psql -h pg-authentik-rw.authentik.svc.cluster.local -U app -d app -t -c "
@@ -38,16 +41,16 @@ spec:
           " | xargs)
 
           if [ -z "$ADMIN_USERS" ]; then
-            echo "⚠️  No users found in 'authentik Admins' group"
+            echo "No users found in 'authentik Admins' group"
             exit 0
           fi
 
-          echo "✓ Found admin users: $ADMIN_USERS"
+          echo "Found admin users: $ADMIN_USERS"
           echo ""
 
           # For each admin user, grant admin access in GitLab
           for email in $ADMIN_USERS; do
-            echo "🔐 Checking user: $email"
+            echo "Checking user: $email"
 
             # Use GitLab Rails runner to promote user
             kubectl exec -n gitlab deployment/gitlab-toolbox -- \
@@ -55,26 +58,19 @@ spec:
                 user = User.find_by(email: '$email')
                 if user
                   if user.admin?
-                    puts '  ✓ Already admin'
+                    puts '  Already admin'
                   else
                     user.update(admin: true)
-                    puts '  ✅ Promoted to admin'
+                    puts '  Promoted to admin'
                   end
                 else
-                  puts '  ⚠️  User not found (needs to login via SSO first)'
+                  puts '  User not found (needs to login via SSO first)'
                 end
-              " || echo "  ❌ Failed to update user"
+              " || echo "  Failed to update user"
           done
 
           echo ""
-          echo "✅ Admin sync complete"
+          echo "Admin sync complete"
-        env:
-        - name: AUTHENTIK_DB_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: pg-authentik-app
-              namespace: authentik
-              key: password
       serviceAccountName: gitlab-sync-admin
 ---
 # ServiceAccount for the sync job
@@ -112,3 +108,30 @@ roleRef:
   kind: Role
   name: gitlab-sync-admin
   apiGroup: rbac.authorization.k8s.io
+---
+# Role to read Authentik DB secret
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: gitlab-sync-admin-reader
+  namespace: authentik
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get"]
+  resourceNames: ["pg-authentik-app"]
+---
+# RoleBinding for Authentik secret access
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: gitlab-sync-admin-reader
+  namespace: authentik
+subjects:
+- kind: ServiceAccount
+  name: gitlab-sync-admin
+  namespace: gitlab
+roleRef:
+  kind: Role
+  name: gitlab-sync-admin-reader
+  apiGroup: rbac.authorization.k8s.io

apps/n8n/manifests/pvc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: n8n-main-persistence
+  namespace: n8n
+  labels:
+    app.kubernetes.io/name: n8n
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: rook-ceph-block
+  resources:
+    requests:
+      storage: 10Gi

apps/nextcloud/manifests/pvc.yaml

@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: nextcloud-nextcloud
-  namespace: nextcloud
-  labels:
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: nextcloud
-    app.kubernetes.io/instance: nextcloud
-  annotations:
-    meta.helm.sh/release-name: nextcloud
-    meta.helm.sh/release-namespace: nextcloud
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: rook-ceph-block      # Rook-Ceph block storage
-  resources:
-    requests:
-      storage: 50Gi                 # whatever size you want

apps/nextcloud/values.yaml

@@ -90,12 +90,6 @@ persistence:
    accessMode: ReadWriteOnce
    size: 50Gi
 
-securityContext:
-   allowPrivilegeEscalation: false
-   capabilities:
-     drop:
-       - ALL
-
 resources:
    requests:
      cpu: 50m

argocd-apps/apps/nessus.yaml

@@ -20,6 +20,9 @@ spec:
     automated:
       prune: true
       selfHeal: true
+    managedNamespaceMetadata:
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true

argocd-apps/infrastructure/scylla-manager.yaml

@@ -26,6 +26,9 @@ spec:
     automated:
       prune: true
       selfHeal: true
+    managedNamespaceMetadata:
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true

argocd-apps/projects.yaml

@@ -51,6 +51,8 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: nessus
       server: https://kubernetes.default.svc
+    - namespace: authentik
+      server: https://kubernetes.default.svc
   clusterResourceWhitelist:
     - group: '*'
       kind: '*'

infrastructure/rook-ceph/cluster-values.yaml

@@ -64,13 +64,6 @@ cephClusterSpec:
     enabled: true
     ssl: false  # TLS handled by ingress
     port: 7000
-    # Authentication: OAuth2-Proxy via ingress annotations
-    # See: infrastructure/rook-ceph/ingress.yaml
-    # Blueprint: infrastructure/authentik/ceph-dashboard-blueprint.yaml
-    config:
-      mgr/dashboard/standby_behaviour: "error"
-      mgr/dashboard/remote_user_header: "X-Forwarded-User"
-      mgr/dashboard/remote_user_trust_proxy: "true"
 
   # Network configuration
   network:

infrastructure/rook-ceph/manifests/smb-gateway.yaml

@@ -11,7 +11,7 @@ spec:
   storageClassName: rook-cephfs
   resources:
     requests:
-      storage: 1Gi
+      storage: 50Gi
 ---
 apiVersion: apps/v1
 kind: Deployment