Conversation
SE-6524 Signed-off-by: Gabor Boros <gabor@opencraft.com>
kaustavb12
left a comment
There was a problem hiding this comment.
LGTM 👍
Just added a couple of clarifications.
- I tested this: Tested in a cluster
- I read through the code
- I checked for accessibility issues
- Includes documentation
- Added to the Code Drift project board (for backports)
manifests/argocd-rbac-config.yml
Outdated
| p, role:developer, applicationsets, create, *, allow | ||
| p, role:developer, applicationsets, update, *, allow | ||
| p, role:developer, applicationsets, delete, *, allow | ||
| p, role:developer, applicationsets, action/*, *, allow |
There was a problem hiding this comment.
@gabor-boros I am not very familiar with ApplicationSet, so just wanted to flag this for verification from your end that write access to application set is appropriate for developer role. I say this because this doc mentions:
ApplicationSet controller may also be used to allow developers (without access to the Argo CD namespace) to independently create Applications without cluster-administrator intervention.
This sort of implies to me that application sets are something an admin is meant to create which can then be used by developers to create applications.
manifests/argocd-rbac-config.yml
Outdated
| p, role:developer, projects, create, *, allow | ||
| p, role:developer, projects, update, *, allow |
There was a problem hiding this comment.
@gabor-boros I am not sure we want to give developers write access to projects. I am thinking in the context of the axim cluster, where we plan to create a "superuser" for that project.
Here, the developer role as configured now, seems the most appropriate "superuser" role since I don't want this "superuser" to have access to things like gpg keys, certificates, etc. I am wondering if write access projects is required here at all or should it be reserved for the actual "cluster admin" role.
Description
Remove the Argo Workflows UI and configures RBAC for argoCD only.
Testing
SE-6524