fix: follow what Argo CD does and set the rolebinding namespace to argocd for both principal and agent

Signed-off-by: Mike Ng <[email protected]>

Author: mikeshng

docs/getting-started/openshift/index.md

@@ -206,20 +206,7 @@ data:
 #### Troubleshooting
 ___
 
-1. If pod fails to come up with error
-```
-time="2025-07-30T14:58:33Z" level=warning msg="INSECURE: Not verifying remote TLS certificate"
-time="2025-07-30T14:58:33Z" level=info msg="Loading client TLS certificate from secret argocd/argocd-agent-client-tls"
-[FATAL]: Error creating remote: unable to read TLS client from secret: could not read TLS secret argocd/argocd-agent-client-tls: secrets "argocd-agent-client-tls" is forbidden: User "system:serviceaccount:argocd:argocd-agent-agent" cannot get resource "secrets" in API group "" in the namespace "argocd"
-```
-
-update the ClusterRoleBinding to update the subject namespace to workload-namespace.
-
-```
-kubectl patch clusterrolebinding argocd-agent-agent --type='json' -p='[{"op": "replace", "path": "/subjects/0/namespace", "value": "<workload-namespace>"}]'
-```
-
-2. If facing error with appProject
+1. If facing error with appProject
 
 ```
 Unable to create application: app is not allowed in project "default", or the project does not exist

install/kubernetes/agent/agent-clusterrolebinding.yaml

@@ -13,4 +13,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: argocd-agent-agent
-  namespace: default
+  namespace: argocd

install/kubernetes/agent/agent-rolebinding.yaml

@@ -13,4 +13,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: argocd-agent-agent
-  namespace: default
+  namespace: argocd

install/kubernetes/principal/principal-clusterrolebinding.yaml

@@ -13,4 +13,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: argocd-agent-principal
-  namespace: default
+  namespace: argocd

install/kubernetes/principal/principal-rolebinding.yaml

@@ -13,4 +13,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: argocd-agent-principal
-  namespace: default
+  namespace: argocd