From f7400766944e2a64bc054ce41d67ec3904c01898 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Sat, 5 Sep 2026 14:53:59 -0700
Subject: [PATCH] fix: remove namespace from rbac Application destination

- RBAC kustomization contains cluster-scoped (ClusterRoleBinding) and
  namespace-scoped (Role/RoleBinding) resources
- Each resource has explicit metadata.namespace, so Application shouldn't
  force a default namespace
- Fixes: ClusterRoleBinding gets namespace=default, causing sync failure
  with 'unsupported role reference kind: ""'
---
 k8s/argocd/apps/60-applications.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/k8s/argocd/apps/60-applications.yaml b/k8s/argocd/apps/60-applications.yaml
index d5a39c8..a346d0f 100644
--- a/k8s/argocd/apps/60-applications.yaml
+++ b/k8s/argocd/apps/60-applications.yaml
@@ -286,7 +286,8 @@ spec:
     path: k8s/infra/rbac
   destination:
     server: https://kubernetes.default.svc
-    namespace: default
+    # No namespace: cluster-scoped resources (ClusterRoleBinding, etc.)
+    # Namespace is set per-resource in kustomization
   syncPolicy:
     automated:
       prune: true