From b6e1e0c59174f7be0aadb1055f3d31d3be2a5b37 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Mon, 26 Oct 2026 23:24:55 -0700
Subject: [PATCH] fix(iam): give the IAM support manifests an ArgoCD app again

Retiring Authentik deleted the iam-jobs Application, so k8s/infra/iam stopped
being synced. The new smtp-gotify relay would have sat in git and never been
created.

Add an iam-support Application for that path, and drop the stale
rbac-dashboard-rolebinding reference from its kustomization: the file went away
with Authentik, and a missing resource fails the whole app.
---
 k8s/argocd/apps/30-security.yaml | 25 +++++++++++++++++++++++++
 k8s/infra/iam/kustomization.yaml |  4 +++-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/k8s/argocd/apps/30-security.yaml b/k8s/argocd/apps/30-security.yaml
index 04e3a7a..511d5d5 100644
--- a/k8s/argocd/apps/30-security.yaml
+++ b/k8s/argocd/apps/30-security.yaml
@@ -79,6 +79,31 @@ spec:
     syncOptions:
       - CreateNamespace=true
 ---
+# Raw IAM support manifests: the SMTP -> Gotify notification relay that ZITADEL
+# points at, so verification and password-reset codes reach the phone. Wave 3
+# alongside ZITADEL itself; the Secret it reads is created by sops-secrets at
+# wave 0.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: iam-support
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+spec:
+  project: homelab
+  source:
+    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    targetRevision: main
+    path: k8s/infra/iam
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: iam
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+---
 # Forgejo itself. Was a bootstrap Helm release (phase 3) until it was brought
 # under Argo, because values changes there were inert — a proxy-body-size fix
 # sat committed while the live Ingress kept nginx's 1m default and rejected
diff --git a/k8s/infra/iam/kustomization.yaml b/k8s/infra/iam/kustomization.yaml
index d134eb6..6231b67 100644
--- a/k8s/infra/iam/kustomization.yaml
+++ b/k8s/infra/iam/kustomization.yaml
@@ -2,7 +2,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - rbac-dashboard-rolebinding.yaml
+  # Removed: rbac-dashboard-rolebinding.yaml (authentik-provisioner SA and
+  # RoleBinding). Authentik is retired, so the file is gone; keep this list in
+  # step with the directory or kustomize fails the whole app.
   - smtp-gotify.yaml
 
 # IAM provisioning is manual-only (security-sensitive).