fix(ardac2prd): restore Guppy sync and developer visibility

[alan-walsh]

Summary

• pin ardac2prd External Secrets resources to the cluster-supported external-secrets.io/v1beta1 API so Argo CD can sync Guppy
• move the existing ardac-developer-power-role and binding under GitOps management without changing its existing pod exec or pod/job creation rights
• add read-only visibility for common workload, configuration, networking, event, and External Secrets resources
• allow the developer group to inspect Argo CD Applications; the newly added permissions do not grant Kubernetes Secret access or update/delete access to workloads

Validation

• live Argo CD inspection confirmed gen3-ardac2prd was OutOfSync/Degraded because the cluster does not serve external-secrets.io/v1
• rendered current upstream gen3-helm with ardac2prd values: Guppy Deployment, Service, and ConfigMap are present; 17 ExternalSecret resources use v1beta1; zero use v1
• Helm lint passed for the Gen3 and cluster-level-resources charts
• RBAC manifests passed a server-side dry run
• applied RBAC live and verified the developer group can read ConfigMaps, Services, Deployments, Events, and Argo Applications
• verified the developer group still cannot read Secrets or update Deployments; pre-existing create and exec permissions remain unchanged

[Copilot]

Pull request overview

Pins External Secrets manifests to a cluster-supported API version and enables GitOps-managed custom objects to restore Argo CD sync while improving developer read visibility in the cluster.

Changes:

• Set global.externalSecrets.apiVersion: external-secrets.io/v1beta1 for the ardac2prd portal deployment values.
• Add GitOps-managed RBAC Roles/RoleBindings for the ardac-developers group (default + argocd namespaces).
• Enable the custom-objects application via cluster-level-resources values so the new RBAC manifests are applied.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
ardac2prd/portal.ardac.org/values.yaml	Pins External Secrets API version for this environment to avoid using an unsupported served version.
ardac2prd/cluster-values/custom-objects/developer-rbac.yaml	Introduces GitOps-managed RBAC for developer visibility (and “power” access) in default/argocd namespaces.
ardac2prd/cluster-level-resources/cluster-values.yaml	Enables custom-objects so the new RBAC manifests are deployed by Argo CD.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.