Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(argocd): add permission support for argocd #1855

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

karthikjeeyar
Copy link
Contributor

Fixes:

https://issues.redhat.com/browse/RHIDP-1796

Description:

This PR adds support for RBAC permission in argocd plugin. argocd.view.read Permission allows the user view the argocd plugin components in overview and CD tabs.

Screenshots:

Without argocd.view.read Permission:

argocd_permission

overview_page

With argocd.view.read Permission

argocd_with_permission

argocd_with_permission_overview


How to test:

  1. Configure the Argocd plugin and add Github integration.
  2. Create a policy file rbac.csv for the permission policies
    g, user:default/<YOUR_USERNAME>, role:default/argocd-viewer
    
    p, role:default/argocd-viewer, argocd.view.read, read, allow
  

    p, role:default/argocd-viewer, catalog-entity.read, read, allow
    p, role:default/argocd-viewer, catalog-entity.create, create, allow


  1. Configure the RBAC Backend plugin to include the argocd permission.
  enabled: true
  rbac:
    policies-csv-file: ../<PATH>/<TO>/<CSV>/rbac-policy.csv
    policyFileReload: true
  1. Annotate the catalog component to include argocd application selector
    'argocd/app-selector': rht-gitops.com/janus-argocd=quarkus-app-bootstrap
  1. Register the component and view the CD tab to see the argo applications working.
  2. Now deny the argocd.view.read permission from the rbac.csv file and wait for the application to auto-reload. you should see the Permission required alert.

Unit tests:

 PASS  src/components/DeploymentSummary/__tests__/DeploymentSummary.test.tsx (6.254 s)
  DeploymentSummary
    ✓ should not render deployment summary table when the user does not have view permission (3 ms)
 PASS  src/components/DeploymentLifeCycle/__tests__/DeploymentLifecycle.test.tsx
  DeploymentLifecycle
    ✓ should render Permission alert if the user does not have view permission (91 ms)

cc: @kim-tsao @rohitkrai03 @nickboldt @invincibleJai

Copy link

openshift-ci bot commented Jun 28, 2024

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign invinciblejai for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@karthikjeeyar karthikjeeyar force-pushed the add-argocd-rbac branch 2 times, most recently from 36b949b to 0265215 Compare June 28, 2024 14:43
@karthikjeeyar
Copy link
Contributor Author

@AndrienkoAleksandr @PatAKnight I see a semantic-relase-bot bumped the rbac-common plugin from 1.6.0 to 1.6.1
@janus-idp/backstage-plugin-rbac-common 1.6.1 here - 9bb8c47 but rbac plugin still references 1.6.0 here so there is a mismatch in yarn.lock file causing the above checks to fail ^^ . Let me know if I should bump the version in rbac plugin manually ?

@AndrienkoAleksandr
Copy link
Collaborator

+1 to bump manually

@karthikjeeyar karthikjeeyar requested a review from a team as a code owner June 28, 2024 15:39
@karthikjeeyar karthikjeeyar force-pushed the add-argocd-rbac branch 2 times, most recently from df96d7b to b5a068f Compare July 1, 2024 08:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants