From e2964000534bfb7c7c763daf49d093d67c699fde Mon Sep 17 00:00:00 2001
From: Scooby Husky <garrettstone499@gmail.com>
Date: Tue, 10 Mar 2026 17:51:04 -0500
Subject: [PATCH] Add argocd-hook-sa ServiceAccount to app namespaces

PreSync/PostSync hook Jobs reference argocd-hook-sa but it only existed
in the argocd namespace. Jobs running in app namespaces (crowdsec,
authentik, netbird, vault, istio-system) need the SA in their own
namespace.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .../authentik/manifests/hook-sa.yaml           | 18 ++++++++++++++++++
 infrastructure/crowdsec/manifests/hook-sa.yaml | 18 ++++++++++++++++++
 .../istio/manifests/mesh/hook-sa.yaml          | 18 ++++++++++++++++++
 infrastructure/netbird/manifests/hook-sa.yaml  | 18 ++++++++++++++++++
 infrastructure/vault/manifests/hook-sa.yaml    | 18 ++++++++++++++++++
 5 files changed, 90 insertions(+)
 create mode 100644 infrastructure/authentik/manifests/hook-sa.yaml
 create mode 100644 infrastructure/crowdsec/manifests/hook-sa.yaml
 create mode 100644 infrastructure/istio/manifests/mesh/hook-sa.yaml
 create mode 100644 infrastructure/netbird/manifests/hook-sa.yaml
 create mode 100644 infrastructure/vault/manifests/hook-sa.yaml

diff --git a/infrastructure/authentik/manifests/hook-sa.yaml b/infrastructure/authentik/manifests/hook-sa.yaml
new file mode 100644
index 0000000..05c448b
--- /dev/null
+++ b/infrastructure/authentik/manifests/hook-sa.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argocd-hook-sa
+  namespace: authentik
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: argocd-hook-sa-authentik
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: argocd-hook-sa
+    namespace: authentik
diff --git a/infrastructure/crowdsec/manifests/hook-sa.yaml b/infrastructure/crowdsec/manifests/hook-sa.yaml
new file mode 100644
index 0000000..7b68f81
--- /dev/null
+++ b/infrastructure/crowdsec/manifests/hook-sa.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argocd-hook-sa
+  namespace: crowdsec
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: argocd-hook-sa-crowdsec
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: argocd-hook-sa
+    namespace: crowdsec
diff --git a/infrastructure/istio/manifests/mesh/hook-sa.yaml b/infrastructure/istio/manifests/mesh/hook-sa.yaml
new file mode 100644
index 0000000..16665e8
--- /dev/null
+++ b/infrastructure/istio/manifests/mesh/hook-sa.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argocd-hook-sa
+  namespace: istio-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: argocd-hook-sa-istio-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: argocd-hook-sa
+    namespace: istio-system
diff --git a/infrastructure/netbird/manifests/hook-sa.yaml b/infrastructure/netbird/manifests/hook-sa.yaml
new file mode 100644
index 0000000..6a6503d
--- /dev/null
+++ b/infrastructure/netbird/manifests/hook-sa.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argocd-hook-sa
+  namespace: netbird
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: argocd-hook-sa-netbird
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: argocd-hook-sa
+    namespace: netbird
diff --git a/infrastructure/vault/manifests/hook-sa.yaml b/infrastructure/vault/manifests/hook-sa.yaml
new file mode 100644
index 0000000..fc688ac
--- /dev/null
+++ b/infrastructure/vault/manifests/hook-sa.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argocd-hook-sa
+  namespace: vault
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: argocd-hook-sa-vault
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: argocd-hook-sa
+    namespace: vault