Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support defining custom cluster roles for cluster scoped instances #1275

Closed
gnunn1 opened this issue Mar 3, 2024 · 2 comments · Fixed by #1276 or #1357
Closed

Support defining custom cluster roles for cluster scoped instances #1275

gnunn1 opened this issue Mar 3, 2024 · 2 comments · Fixed by #1276 or #1357

Comments

@gnunn1
Copy link
Contributor

gnunn1 commented Mar 3, 2024

Is your feature request related to a problem? Please describe.

When using a cluster scoped instance of Argo CD the operator will create a separate and hard coded set of clusterroles and clusterrolebindings. Users that want to lock down the permissions of their instances need the ability to use an alternate set of clusterroles.

As an example, the new feature in Argo CD 2.10 to auto-respect RBAC (https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#auto-respect-rbac-for-controller) enables users to remove the cluster-wide view all permissions required by a cluster scoped instance and provide a much more tailored set of permissions. However the Argo CD Operator hard codes this cluster role to define view all permissions.

Describe the solution you'd like
Enable users to specify their own roles using the environment variables CONTROLLER_CLUSTER_SCOPE_ROLE and SERVER_CLUSTER_SCOPE_ROLE

Describe alternatives you've considered
Updates to the cluster role created by the operator get overridden by the operator so it's not a suitable approach.

@gnunn1
Copy link
Contributor Author

gnunn1 commented Mar 3, 2024

PR is in progress for this.

@jparsai
Copy link
Collaborator

jparsai commented May 16, 2024

Reopening since PR was reverted and there is a new PR raised to address this.

@jparsai jparsai reopened this May 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants