Let's introduce an RBAC CRD-based API to manage RBAC-Config about argo-cd HOT 5 CLOSED

Administrators usually receive permission to edit the entire argocd-rbac-cm object, where fine granular edits can not be distinguished by the Kubernetes ConfigMap API.

We have an alternative solution (maybe a viable for this use-case) to address rbac granular edits called Policy CSV Composition and is documented here. This way admins can provide independent patches. Was this approach considered? If it was, what were the problems identified with it?

from argo-cd.

Administrators usually receive permission to edit the entire argocd-rbac-cm object, where fine granular edits can not be distinguished by the Kubernetes ConfigMap API.

We have an alternative solution (maybe a viable for this use-case) to address rbac granular edits called Policy CSV Composition and is documented here. This way admins can provide independent patches. Was this approach considered? If it was, what were the problems identified with it?

We have considered that approach. We currently use ArgoCD with Crossplane, so the CRD would offer a way to automate the config, which is not given using the Policy CSV Composition. Moreover the suggested CRD would offer an easier, more stable way to config the RBAC with built-in validation before runtime. It would also reduce the risk of people misapplying and misunderstanding the config (e.g. "local user" RBAC), since it would be built similar to k8s' RBAC.

from argo-cd.

@ggkhrmv Thank you for confirming. We discussed about this proposal in the Argo Contributor's meeting today. While we are not opposed to having a dedicated CRD/Controller to manage Argo CD RBAC, we agree that this can be implemented in an independent project. We can create a dedicated repository for this controller under the argoproj-labs github org if this is something that you would be willing to implement.

from argo-cd.

@leoluz You're welcome! I'd be happy to implement a dedicated CRD/Controller for RBAC-Management

from argo-cd.

@ggkhrmv Great! I am closing this issue for now and please ping me directly on CNCF Slack if you want to have a dedicated repo in argoproj-labs to host controller's code.
Thank you!

from argo-cd.