Why does argocd-repo-server need admin permission

[ytizhang]

We are using argo-cd chart version 5.43.4, and noticed the service account used by argocd-repo-server has admin permission. Based on my understanding, argocd-repo-server is responsible for holding the application manifests and generating kubernetes manifests. Why does it need admin permission?

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: argo-cd-argocd-repo-server
rules:
  - verbs:
      - '*'
    apiGroups:
      - '*'
    resources:
      - '*'
  - verbs:
      - '*'
    nonResourceURLs:
      - '*'

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: argo-cd-argocd-repo-server
subjects:
  - kind: ServiceAccount
    name: argo-cd-argocd-repo-server
    namespace: argocd
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: argo-cd-argocd-repo-server

[yu-croco]

Hi @ytizhang ,

Why does it need admin permission?

I hope the comments on #919 will help you to investigate the reason.

[ytizhang]

The change in #919 provided an option to enable admin permission for repo-server, but it's disabled by default. However the change in #1597 made it enabled by default. Based on the discussion between the author and tyrken. It needs to be improved / fixed.

[yu-croco]

Thank you for the explanation.
I see, the PR broke the default value. 🤔
https://github.com/argoproj/argo-helm/pull/1597/files#diff-9eb59d56febda5e405748483497dfdc0c2dfbe9b4f386a12f0180c98d99051e0L2034-L2038

[pdrastil]

Resolved via #2498 and role is now disabled by default