feat: Fine grained update delete RBAC w/ v3 gate #2
+495
−4
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
fffinkel
changed the title
fffinkel
force-pushed
the
fine-grained-update-delete-rbac
branch
from
36daf0c
to
59b597b
Compare
fffinkel
changed the title
fffinkel
force-pushed
the
fine-grained-update-delete-rbac
branch
2 times, most recently
from
4e2f20d
to
53ff180
Compare
sudovinh
reviewed
Nov 5, 2024
fffinkel
force-pushed
the
fine-grained-update-delete-rbac
branch
from
53ff180
to
7adc146
Compare
…oj#19988) Change applications resource RBAC to use fine-grained update/delete enforcement by default. This allows us to enforce RBAC on the application itself, separately from the sub-resources related to it. (see also argoproj#18124, argoproj#20600) Signed-off-by: Matt Finkel <[email protected]>
A breaking change was introduced in a previous commit that is planned to be a part of the next major version of Argo CD (v3) where it's okay to introduce breaking changes. We want this feature before we hit v3, so we add a config setting that allows us to explicitly turn this new v3 behavior on in v2. The current v2 behavior is the default, so this change will not affect folks who do not explicitly opt in. This commit to add the gating code is added separately so it will be easy to either cherry pick that pervious commit or revert this one. (see also argoproj#18124, argoproj#19988) Signed-off-by: Matt Finkel <[email protected]>
Signed-off-by: Matt Finkel <[email protected]>
fffinkel
force-pushed
the
fine-grained-update-delete-rbac
branch
from
7adc146
to
f258ae5
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We would like to allow our engineers to use the rollback functionality while having auto-sync enabled, without granting them the ability to edit an application's sub-resource manifests. For compliance purposes, we can only deploy using a known set of manifests from a protected source, which is the git repo holding our manifests that engineers do not have access to.
Using the rollback functionality when auto-sync is enabled requires the user to disable auto-sync, which in turn requires update permissions on the application itself. We can allow this by doing the following:
However, this will also allow engineers to edit application manifests. It follows that we would like to add a deny for the application's sub-resources, but as the RBAC documentation states, this deny is ignored.
This PR changes application resource RBAC to allow users to set separate update/delete permissions for the application itself, but still deny sub-resources. We can then do something like this:
It introduces a breaking change to RBAC (see argoproj#19988), so it will have to wait until V3. To allow this functionality in V2, a config value (
server.rbac.enablev3inargocd-cm) was added that allows the user to opt in to this new behavior.RBAC docs: https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#fine-grained-permissions-for-updatedelete-action
Also of note: I did my best to implement argoproj#19988 in the first comment, and then to add the config value gating in a following commit, so that the first commit can be cherry-picked or the second commit reverted when the V3 release is cut.
Closes argoproj#20600
Checklist: