Skip to content

Commit a0e79ad

Browse files
blakepetterssonblakepettersson
authored
fix: allow setting of applicationsets in appproject policies (#626)
* fix: allow setting of `applicationsets` in appproject policies Since argoproj/argo-cd#21829 it's been possible to set `applicationsets` and other resources as a project-role policy, but it turns out that this provider also does its own validation. To fix this, we upgrade Argo CD to 2.14.9 and add the relevant resources to the `validResources` map. Signed-off-by: Blake Pettersson <[email protected]> * chore: please linter Signed-off-by: Blake Pettersson <[email protected]> --------- Signed-off-by: Blake Pettersson <[email protected]>
1 parent 163b756 commit a0e79ad

File tree

4 files changed

+117
-33
lines changed

4 files changed

+117
-33
lines changed

‎argocd/utils.go‎

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,9 @@ import (
77
"strings"
88

99
"github.com/argoproj-labs/terraform-provider-argocd/internal/features"
10-
"github.com/argoproj/argo-cd/v2/server/rbacpolicy"
10+
11+
"github.com/argoproj/argo-cd/v2/util/rbac"
12+
1113
fwdiag "github.com/hashicorp/terraform-plugin-framework/diag"
1214
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
1315
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -88,13 +90,13 @@ func sliceOfString(slice []interface{}) []string {
8890

8991
func isValidPolicyAction(action string) bool {
9092
validActions := map[string]bool{
91-
rbacpolicy.ActionGet: true,
92-
rbacpolicy.ActionCreate: true,
93-
rbacpolicy.ActionUpdate: true,
94-
rbacpolicy.ActionDelete: true,
95-
rbacpolicy.ActionSync: true,
96-
rbacpolicy.ActionOverride: true,
97-
"*": true,
93+
rbac.ActionGet: true,
94+
rbac.ActionCreate: true,
95+
rbac.ActionUpdate: true,
96+
rbac.ActionDelete: true,
97+
rbac.ActionSync: true,
98+
rbac.ActionOverride: true,
99+
"*": true,
98100
}
99101
validActionPatterns := []*regexp.Regexp{
100102
regexp.MustCompile("action/.*"),
@@ -132,11 +134,13 @@ func validatePolicy(project string, role string, policy string) error {
132134
// resource
133135
// https://github.com/argoproj/argo-cd/blob/c99669e088b5f25c8ce8faff6df25797a8beb5ba/pkg/apis/application/v1alpha1/types.go#L1554
134136
validResources := map[string]bool{
135-
rbacpolicy.ResourceApplications: true,
136-
rbacpolicy.ResourceRepositories: true,
137-
rbacpolicy.ResourceClusters: true,
138-
rbacpolicy.ResourceExec: true,
139-
rbacpolicy.ResourceLogs: true,
137+
rbac.ResourceApplications: true,
138+
rbac.ResourceRepositories: true,
139+
rbac.ResourceClusters: true,
140+
rbac.ResourceExec: true,
141+
rbac.ResourceLogs: true,
142+
rbac.ResourceApplicationSets: true,
143+
rbac.ResourceProjects: true,
140144
}
141145

142146
resource := strings.Trim(policyComponents[2], " ")

‎argocd/utils_test.go‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
package argocd
2+
3+
import (
4+
"testing"
5+
)
6+
7+
func TestValidatePolicy(t *testing.T) {
8+
t.Parallel()
9+
10+
project := "myproject"
11+
role := "admin"
12+
13+
tests := []struct {
14+
name string
15+
policy string
16+
expectError bool
17+
}{
18+
{
19+
name: "Valid policy",
20+
policy: "p, proj:myproject:admin, applications, get, myproject/*, allow",
21+
expectError: false,
22+
},
23+
{
24+
name: "Valid applicationsets policy",
25+
policy: "p, proj:myproject:admin, applicationsets, get, myproject/*, allow",
26+
expectError: false,
27+
},
28+
{
29+
name: "Invalid format - not enough components",
30+
policy: "p, proj:myproject:admin, applications, get",
31+
expectError: true,
32+
},
33+
{
34+
name: "Invalid subject",
35+
policy: "p, proj:otherproject:admin, applications, get, myproject/*, allow",
36+
expectError: true,
37+
},
38+
{
39+
name: "Invalid resource",
40+
policy: "p, proj:myproject:admin, invalidResource, get, myproject/*, allow",
41+
expectError: true,
42+
},
43+
{
44+
name: "Invalid action",
45+
policy: "p, proj:myproject:admin, applications, invalid, myproject/*, allow",
46+
expectError: true,
47+
},
48+
{
49+
name: "Invalid object format",
50+
policy: "p, proj:myproject:admin, applications, get, otherproject/*, allow",
51+
expectError: true,
52+
},
53+
{
54+
name: "Invalid effect",
55+
policy: "p, proj:myproject:admin, applications, get, myproject/*, maybe",
56+
expectError: true,
57+
},
58+
{
59+
name: "Object with valid app name",
60+
policy: "p, proj:myproject:admin, applications, get, myproject/app-01, allow",
61+
expectError: false,
62+
},
63+
{
64+
name: "Object with dash and dot in name",
65+
policy: "p, proj:myproject:admin, applications, get, myproject/app-1.2, allow",
66+
expectError: false,
67+
},
68+
}
69+
70+
for _, tc := range tests {
71+
t.Run(tc.name, func(t *testing.T) {
72+
t.Parallel()
73+
74+
err := validatePolicy(project, role, tc.policy)
75+
if (err != nil) != tc.expectError {
76+
t.Errorf("validatePolicy() error = %v, expectError = %v", err, tc.expectError)
77+
}
78+
})
79+
}
80+
}

‎go.mod‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@ go 1.24
55
require (
66
github.com/Masterminds/semver/v3 v3.3.1
77
github.com/ProtonMail/gopenpgp/v3 v3.1.3
8-
github.com/argoproj/argo-cd/v2 v2.14.5
8+
github.com/argoproj/argo-cd/v2 v2.14.9
99
// make sure this matches with version used in Argo CD's go.mod
10-
github.com/argoproj/gitops-engine v0.7.1-0.20250304190342-43fce7ce19f1
10+
github.com/argoproj/gitops-engine v0.7.1-0.20250328191959-6d3cf122b03f
1111
github.com/argoproj/pkg v0.13.7-0.20230626144333-d56162821bd1
1212
github.com/cristalhq/jwt/v5 v5.4.0
1313
github.com/elliotchance/pie/v2 v2.9.1
@@ -95,8 +95,8 @@ require (
9595
github.com/go-errors/errors v1.4.2 // indirect
9696
github.com/go-fed/httpsig v1.1.0 // indirect
9797
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
98-
github.com/go-git/go-billy/v5 v5.6.1 // indirect
99-
github.com/go-git/go-git/v5 v5.13.1 // indirect
98+
github.com/go-git/go-billy/v5 v5.6.2 // indirect
99+
github.com/go-git/go-git/v5 v5.13.2 // indirect
100100
github.com/go-jose/go-jose/v3 v3.0.4 // indirect
101101
github.com/go-jose/go-jose/v4 v4.0.2 // indirect
102102
github.com/go-logr/logr v1.4.2 // indirect
@@ -117,7 +117,7 @@ require (
117117
github.com/gobwas/glob v0.2.3 // indirect
118118
github.com/gogits/go-gogs-client v0.0.0-20200905025246-8bb8a50cb355 // indirect
119119
github.com/gogo/protobuf v1.3.2 // indirect
120-
github.com/golang-jwt/jwt/v4 v4.5.1 // indirect
120+
github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
121121
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
122122
github.com/golang/protobuf v1.5.4 // indirect
123123
github.com/google/btree v1.1.3 // indirect
@@ -200,7 +200,7 @@ require (
200200
github.com/opsgenie/opsgenie-go-sdk-v2 v1.0.5 // indirect
201201
github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
202202
github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
203-
github.com/pjbgf/sha1cd v0.3.0 // indirect
203+
github.com/pjbgf/sha1cd v0.3.2 // indirect
204204
github.com/pkg/errors v0.9.1 // indirect
205205
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
206206
github.com/prometheus/client_golang v1.20.5 // indirect

‎go.sum‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -63,10 +63,10 @@ github.com/apparentlymart/go-textseg/v12 v12.0.0/go.mod h1:S/4uRK2UtaQttw1GenVJE
6363
github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
6464
github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
6565
github.com/appscode/go v0.0.0-20191119085241-0887d8ec2ecc/go.mod h1:OawnOmAL4ZX3YaPdN+8HTNwBveT1jMsqP74moa9XUbE=
66-
github.com/argoproj/argo-cd/v2 v2.14.5 h1:ukSLv5oS6Yw6OfACMHLfvHQWx0c/rX9Nt9JK9DDyMDI=
67-
github.com/argoproj/argo-cd/v2 v2.14.5/go.mod h1:TgBU+mQLezr6FHknnTIpUgyLlbw+ZdnRl71JQjECacE=
68-
github.com/argoproj/gitops-engine v0.7.1-0.20250304190342-43fce7ce19f1 h1:3qG1uQNtjCIunZ5b3qmO1JS8OBLCssll41VwBYYlKio=
69-
github.com/argoproj/gitops-engine v0.7.1-0.20250304190342-43fce7ce19f1/go.mod h1:WsnykM8idYRUnneeT31cM/Fq/ZsjkefCbjiD8ioCJkU=
66+
github.com/argoproj/argo-cd/v2 v2.14.9 h1:a6olDRG9HGvkF1gWJ3plvfdrX/tk7cu3ZbkVS0y/rMU=
67+
github.com/argoproj/argo-cd/v2 v2.14.9/go.mod h1:50mfVqU+TKu2qIUwELpJ3+lmDKEuwEVj/0caQhYqDz8=
68+
github.com/argoproj/gitops-engine v0.7.1-0.20250328191959-6d3cf122b03f h1:T18BJdtZF/HWdkyCqcNI6kQ3SbIomn6g+AZtZtvQUjE=
69+
github.com/argoproj/gitops-engine v0.7.1-0.20250328191959-6d3cf122b03f/go.mod h1:WsnykM8idYRUnneeT31cM/Fq/ZsjkefCbjiD8ioCJkU=
7070
github.com/argoproj/notifications-engine v0.4.1-0.20241007194503-2fef5c9049fd h1:lOVVoK89j9Nd4+JYJiKAaMNYC1402C0jICROOfUPWn0=
7171
github.com/argoproj/notifications-engine v0.4.1-0.20241007194503-2fef5c9049fd/go.mod h1:N0A4sEws2soZjEpY4hgZpQS8mRIEw6otzwfkgc3g9uQ=
7272
github.com/argoproj/pkg v0.13.7-0.20230626144333-d56162821bd1 h1:qsHwwOJ21K2Ao0xPju1sNuqphyMnMYkyB3ZLoLtxWpo=
@@ -212,8 +212,8 @@ github.com/eapache/go-resiliency v1.1.0/go.mod h1:kFI+JgMyC7bLPUVY133qvEBtVayf5m
212212
github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21/go.mod h1:+020luEh2TKB4/GOp8oxxtq0Daoen/Cii55CzbTV6DU=
213213
github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
214214
github.com/edsrzf/mmap-go v1.0.0/go.mod h1:YO35OhQPt3KJa3ryjFM5Bs14WD66h8eGKpfaBNrHW5M=
215-
github.com/elazarl/goproxy v1.2.3 h1:xwIyKHbaP5yfT6O9KIeYJR5549MXRQkoQMRXGztz8YQ=
216-
github.com/elazarl/goproxy v1.2.3/go.mod h1:YfEbZtqP4AetfO6d40vWchF3znWX7C7Vd6ZMfdL8z64=
215+
github.com/elazarl/goproxy v1.4.0 h1:4GyuSbFa+s26+3rmYNSuUVsx+HgPrV1bk1jXI0l9wjM=
216+
github.com/elazarl/goproxy v1.4.0/go.mod h1:X/5W/t+gzDyLfHW4DrMdpjqYjpXsURlBt9lpBDxZZZQ=
217217
github.com/elliotchance/pie/v2 v2.9.1 h1:v7TdC6ZdNZJ1HACofpLXvGKHUk307AjY/bttwDPWKEQ=
218218
github.com/elliotchance/pie/v2 v2.9.1/go.mod h1:18t0dgGFH006g4eVdDtWfgFZPQEgl10IoEO8YWEq3Og=
219219
github.com/emicklei/go-restful/v3 v3.8.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
@@ -271,12 +271,12 @@ github.com/go-fed/httpsig v1.1.0 h1:9M+hb0jkEICD8/cAiNqEB66R87tTINszBRTjwjQzWcI=
271271
github.com/go-fed/httpsig v1.1.0/go.mod h1:RCMrTZvN1bJYtofsG4rd5NaO5obxQ5xBkdiS7xsT7bM=
272272
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
273273
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
274-
github.com/go-git/go-billy/v5 v5.6.1 h1:u+dcrgaguSSkbjzHwelEjc0Yj300NUevrrPphk/SoRA=
275-
github.com/go-git/go-billy/v5 v5.6.1/go.mod h1:0AsLr1z2+Uksi4NlElmMblP5rPcDZNRCD8ujZCRR2BE=
274+
github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
275+
github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
276276
github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
277277
github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
278-
github.com/go-git/go-git/v5 v5.13.1 h1:DAQ9APonnlvSWpvolXWIuV6Q6zXy2wHbN4cVlNR5Q+M=
279-
github.com/go-git/go-git/v5 v5.13.1/go.mod h1:qryJB4cSBoq3FRoBRf5A77joojuBcmPJ0qu3XXXVixc=
278+
github.com/go-git/go-git/v5 v5.13.2 h1:7O7xvsK7K+rZPKW6AQR1YyNhfywkv7B8/FsP3ki6Zv0=
279+
github.com/go-git/go-git/v5 v5.13.2/go.mod h1:hWdW5P4YZRjmpGHwRH2v3zkWcNl6HeXaXQEMGb3NJ9A=
280280
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
281281
github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
282282
github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
@@ -368,8 +368,8 @@ github.com/gogo/protobuf v1.2.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7a
368368
github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
369369
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
370370
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
371-
github.com/golang-jwt/jwt/v4 v4.5.1 h1:JdqV9zKUdtaa9gdPlywC3aeoEsR681PlKC+4F5gQgeo=
372-
github.com/golang-jwt/jwt/v4 v4.5.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
371+
github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
372+
github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
373373
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
374374
github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
375375
github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -817,8 +817,8 @@ github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+v
817817
github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
818818
github.com/pierrec/lz4 v1.0.2-0.20190131084431-473cd7ce01a1/go.mod h1:3/3N9NVKO0jef7pBehbT1qWhCMrIgbYNnFAZCqQ5LRc=
819819
github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
820-
github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
821-
github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
820+
github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
821+
github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
822822
github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
823823
github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
824824
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=

0 commit comments

Comments
 (0)