From 924a1d90dce42b0c1336b4384bbffe964609a5ed Mon Sep 17 00:00:00 2001
From: Martyn Ranyard <martyn.ranyard@wikimedia.de>
Date: Mon, 5 Oct 2026 17:04:33 +0200
Subject: [PATCH 1/2] Add the trivy-system namespace to the allowlist

IMO we aren't using namespaces to the most sensible pattern, and having
an allowlist is excessive for our needs.

Added the namespace via gitops as an added extra.

bug: T439515
---
 charts/argocd-config/templates/namespaces.yaml | 8 ++++++++
 charts/argocd-config/templates/projects.yaml   | 3 +++
 2 files changed, 11 insertions(+)
 create mode 100644 charts/argocd-config/templates/namespaces.yaml

diff --git a/charts/argocd-config/templates/namespaces.yaml b/charts/argocd-config/templates/namespaces.yaml
new file mode 100644
index 0000000..11efd3a
--- /dev/null
+++ b/charts/argocd-config/templates/namespaces.yaml
@@ -0,0 +1,8 @@
+# Remember to add the namespace to the projects.yaml too, we have a very restrictive list.
+# It could be argued that this file (or files) belongs in argocd-apps/templates but that would
+# require a lot more version bumps and if we're referencing it in the projects.yaml, it has a
+# more-than-tenuous reason to be here.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: trivy-system
diff --git a/charts/argocd-config/templates/projects.yaml b/charts/argocd-config/templates/projects.yaml
index c5f60e8..0209c31 100644
--- a/charts/argocd-config/templates/projects.yaml
+++ b/charts/argocd-config/templates/projects.yaml
@@ -14,6 +14,9 @@ spec:
   - name: in-cluster-argocd
     namespace: argocd
     server: https://kubernetes.default.svc
+  - name: in-cluster-trivy-system
+    namespace: trivy-system
+    server: https://kubernetes.default.svc
   sourceRepos:
   - {{ .Values.repoUrls.deploy }}
   - {{ .Values.repoUrls.wbstack }}

From 70a3e43db7c8b32adb8fdca4233e5221a7c50c69 Mon Sep 17 00:00:00 2001
From: Martyn Ranyard <martyn.ranyard@wikimedia.de>
Date: Mon, 5 Oct 2026 17:08:40 +0200
Subject: [PATCH 2/2] Bump the chart version

---
 charts/argocd-config/Chart.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/argocd-config/Chart.yaml b/charts/argocd-config/Chart.yaml
index 926325c..7b5e28e 100644
--- a/charts/argocd-config/Chart.yaml
+++ b/charts/argocd-config/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: argocd-config
 description: Chart to deploy ArgoCD configuration (including the argocd-apps chart)
 type: application
-version: 2.1.4
+version: 2.1.5
 appVersion: "1.0"
 maintainers:
   - name: WBstack