Skip to content

Commit 7ecbb51

Browse files
diegoitaliaitdiegoitaliait
authored
feat: PAYMCLOUD-464 argocd rbac setup (#160)
* minimi privilegi * minor fix * added roles for project * updated argocd provider * updated argocd provider * project with rbac * minor fix * test reader project * enhance terraform script with new features and improved error handling * pre
1 parent 96c4977 commit 7ecbb51

File tree

10 files changed

+315
-327
lines changed

10 files changed

+315
-327
lines changed

‎src/aks-platform/10_argocd.tf‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,16 @@ resource "helm_release" "argocd" {
2727

2828
values = [
2929
templatefile("${path.module}/argocd/argocd_helm_setup_values.yaml", {
30-
ARGOCD_APPLICATION_NAMESPACES = var.argocd_application_namespaces
31-
TENANT_ID = data.azurerm_subscription.current.tenant_id
32-
APP_CLIENT_ID = data.azurerm_key_vault_secret.argocd_entra_app_client_id.value
33-
ENTRA_ADMIN_GROUP_OBJECT_ID = data.azuread_group.adgroup_admin.object_id
34-
ARGOCD_INTERNAL_URL = local.argocd_internal_url
35-
ARGOCD_INGRESS_TLS_SECRET_NAME = replace(local.argocd_internal_url, ".", "-", )
36-
FORCE_REINSTALL = var.argocd_force_reinstall_version
30+
ARGOCD_APPLICATION_NAMESPACES = var.argocd_application_namespaces
31+
TENANT_ID = data.azurerm_subscription.current.tenant_id
32+
APP_CLIENT_ID = data.azurerm_key_vault_secret.argocd_entra_app_client_id.value
33+
ENTRA_ADMIN_GROUP_OBJECT_IDS = []
34+
ENTRA_DEVELOPER_GROUP_OBJECT_IDS = []
35+
ENTRA_READER_GROUP_OBJECT_IDS = []
36+
ENTRA_GUEST_GROUP_OBJECT_IDS = []
37+
ARGOCD_INTERNAL_URL = local.argocd_internal_url
38+
ARGOCD_INGRESS_TLS_SECRET_NAME = replace(local.argocd_internal_url, ".", "-", )
39+
FORCE_REINSTALL = var.argocd_force_reinstall_version
3740
})
3841
]
3942

‎src/aks-platform/argocd/argocd_helm_setup_values.yaml‎

Lines changed: 39 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -49,40 +49,64 @@ configs:
4949
server.rbac.disableApplicationFineGrainedRBACInheritance: "false"
5050
rbac:
5151
policy.default: role:guest
52+
scopes: "[preferred_username, email, groups]"
5253
policy.csv: |
53-
# --- Admin role
54+
# ------------------------------------------------------------------------
55+
# Macro‑roles hierarchy
56+
# admin – full access to everything
57+
# developer – manage applications only (CRUD + sync)
58+
# reader – read‑only on applications
59+
# guest – can log‑in, sees nothing
60+
# ------------------------------------------------------------------------
61+
# --- Admin role ---------------------------------------------------------
5462
p, role:admin, *, *, */*, allow
5563
p, role:admin, logs, get, */*, allow
5664
57-
# --- Developer role
65+
# --- Developer role -----------------------------------------------------
5866
p, role:developer, applications, get, */*, allow
5967
p, role:developer, applications, create, */*, allow
6068
p, role:developer, applications, update, */*, allow
69+
p, role:developer, applications, delete, */*, allow
6170
p, role:developer, applications, sync, */*, allow
6271
p, role:developer, applications, override, */*, allow
63-
p, role:developer, projects, get, *, allow
64-
p, role:developer, clusters, get, *, allow
65-
p, role:developer, repositories, get, *, allow
66-
p, role:developer, accounts, get, *, allow
6772
p, role:developer, logs, get, */*, allow
73+
# Note: NO access to projects, clusters, repositories, accounts
6874
69-
# --- Reader role
75+
# --- Reader role --------------------------------------------------------
7076
p, role:reader, applications, get, */*, allow
7177
p, role:reader, applications, logs, */*, allow
72-
p, role:reader, projects, get, *, allow
7378
p, role:reader, applications, get, */secrets, deny
79+
# Note: NO access to projects, clusters, repositories, accounts
7480
75-
# --- Guest role
81+
# --- Guest role ---------------------------------------------------------
7682
p, role:guest, applications, get, */*, deny
77-
p, role:guest, projects, get, *, deny
78-
p, role:guest, repositories, get, *, deny
79-
p, role:guest, clusters, get, *, deny
8083
p, role:guest, accounts, get, *, deny
8184
82-
# Assign users to roles
83-
g, ${ENTRA_ADMIN_GROUP_OBJECT_ID}, role:admin
85+
# ------------------------------------------------------------------------
86+
# Group bindings (Azure Entra ID object IDs)
87+
# ------------------------------------------------------------------------
88+
%{ if ENTRA_ADMIN_GROUP_OBJECT_IDS != null && length(ENTRA_ADMIN_GROUP_OBJECT_IDS) > 0 ~}
89+
%{ for group_id in ENTRA_ADMIN_GROUP_OBJECT_IDS ~}
90+
g, ${group_id}, role:admin
91+
%{ endfor ~}
92+
%{ endif ~}
93+
%{ if ENTRA_DEVELOPER_GROUP_OBJECT_IDS != null && length(ENTRA_DEVELOPER_GROUP_OBJECT_IDS) > 0 ~}
94+
%{ for group_id in ENTRA_DEVELOPER_GROUP_OBJECT_IDS ~}
95+
g, ${group_id}, role:developer
96+
%{ endfor ~}
97+
%{ endif ~}
98+
%{ if ENTRA_READER_GROUP_OBJECT_IDS != null && length(ENTRA_READER_GROUP_OBJECT_IDS) > 0 ~}
99+
%{ for group_id in ENTRA_READER_GROUP_OBJECT_IDS ~}
100+
g, ${group_id}, role:reader
101+
%{ endfor ~}
102+
%{ endif ~}
103+
%{ if ENTRA_GUEST_GROUP_OBJECT_IDS != null && length(ENTRA_GUEST_GROUP_OBJECT_IDS) > 0 ~}
104+
%{ for group_id in ENTRA_GUEST_GROUP_OBJECT_IDS ~}
105+
g, ${group_id}, role:guest
106+
%{ endfor ~}
107+
%{ endif ~}
108+
84109

85-
scopes: "[preferred_username, email, groups]"
86110

87111
#
88112
# Server configuration

‎src/aks-platform/env/itn-dev/terraform.tfvars‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,4 +131,4 @@ reloader_helm = {
131131
# https://github.com/argoproj/argo-helm/releases
132132
argocd_helm_release_version = "8.2.4" #3.0.5+
133133
argocd_application_namespaces = ["argocd", "testit", "diego", "keda"]
134-
argocd_force_reinstall_version = "v20250805_1"
134+
argocd_force_reinstall_version = "v20250806_1"

‎src/domains/diego-app/.terraform.lock.hcl‎

Lines changed: 39 additions & 46 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

src/domains/diego-app/05_argocd.tf renamed to src/domains/diego-app/10_argocd.tf

Lines changed: 56 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,42 @@
1+
locals {
2+
project_name = "${var.domain}-project"
3+
}
4+
15
#
26
# Terraform argocd project
37
#
4-
resource "argocd_project" "project" {
8+
resource "argocd_project" "argocd_project_diego" {
59
metadata {
6-
name = "${var.domain}-project"
10+
name = local.project_name # e.g. "diego-project"
711
namespace = "argocd"
12+
813
labels = {
914
acceptance = "true"
1015
}
1116
}
1217

1318
spec {
14-
description = "${var.domain}-project"
19+
description = local.project_name
1520

16-
source_namespaces = ["argocd", var.domain]
21+
# Restrict manifest sources to this domain's repos
22+
source_namespaces = [var.domain]
1723
source_repos = ["*"]
1824

1925
destination {
2026
server = "https://kubernetes.default.svc"
2127
namespace = var.domain
2228
}
23-
destination {
24-
server = "https://kubernetes.default.svc"
25-
namespace = "argocd"
26-
}
2729

28-
# cluster_resource_blacklist {
29-
# group = "*"
30-
# kind = "*"
31-
# }
30+
# ───────────────── Security Guards ─────────────────
31+
cluster_resource_blacklist {
32+
group = ""
33+
kind = "Namespace"
34+
}
3235

3336
cluster_resource_whitelist {
3437
group = "*"
3538
kind = "*"
3639
}
37-
3840
namespace_resource_whitelist {
3941
group = "*"
4042
kind = "*"
@@ -44,14 +46,49 @@ resource "argocd_project" "project" {
4446
warn = true
4547
}
4648

47-
# role {
48-
# name = "project-admin"
49-
# policies = [
50-
# ]
51-
# }
49+
# ──────────────────── ROLES ───────────────────────
50+
# Admin → pieno controllo + modifica AppProject
51+
role {
52+
name = "admin"
53+
groups = []
54+
policies = [
55+
"p, proj:${local.project_name}:admin, applications, *, ${local.project_name}/*, allow",
56+
"p, proj:${local.project_name}:admin, applicationsets, *, ${local.project_name}/*, allow",
57+
"p, proj:${local.project_name}:admin, logs, get, ${local.project_name}/*, allow",
58+
"p, proj:${local.project_name}:admin, exec, create, ${local.project_name}/*, allow",
59+
]
60+
}
61+
62+
# Developer → sola lettura sul Project, pieno controllo sulle app
63+
role {
64+
name = "developer"
65+
groups = []
66+
policies = [
67+
"p, proj:${local.project_name}:developer, applications, get, ${local.project_name}/*, allow",
68+
"p, proj:${local.project_name}:developer, applications, create, ${local.project_name}/*, allow",
69+
"p, proj:${local.project_name}:developer, applications, update, ${local.project_name}/*, allow",
70+
"p, proj:${local.project_name}:developer, applications, delete, ${local.project_name}/*, allow",
71+
"p, proj:${local.project_name}:developer, applications, sync, ${local.project_name}/*, allow",
72+
"p, proj:${local.project_name}:developer, applicationsets, *, ${local.project_name}/*, allow",
73+
"p, proj:${local.project_name}:developer, logs, get, ${local.project_name}/*, allow",
74+
]
75+
}
76+
77+
# Reader → read‑only su app + project; può visualizzare ConfigMaps tramite tree
78+
role {
79+
name = "reader"
80+
groups = [data.azuread_group.adgroup_admin.object_id]
81+
policies = [
82+
"p, proj:${local.project_name}:reader, applications, get, ${local.project_name}/*, allow",
83+
"p, proj:${local.project_name}:reader, logs, get, ${local.project_name}/*, allow",
84+
]
85+
}
5286
}
5387
}
5488

89+
90+
91+
5592
locals {
5693
argocd_applications = {
5794
"top" = {
@@ -98,7 +135,7 @@ resource "argocd_application" "diego_applications" {
98135
}
99136

100137
spec {
101-
project = argocd_project.project.metadata[0].name
138+
project = argocd_project.argocd_project_diego.metadata[0].name
102139

103140
destination {
104141
server = "https://kubernetes.default.svc"

‎src/domains/diego-app/10_web_tests.tf‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

0 commit comments

Comments
 (0)