Enable fine-grained update/delete RBAC enforcement by default #19988

agaudreault · 2024-09-18T20:02:34Z

Summary

In 2.12 we introduced new RBAC for fine-grained update/delete in #18124. To keep backward compatibility, the applications, update and applications, delete rbac implicitly grant permissions to update/delete application's resources.

Motivation

Streamline behavior that was not possible without breaking changes.

Proposal

With the new fine-grained RBAC, applications, update and applications, delete give permission to manually edit/delete the Application, while applications, update/* and applications, delete/* are used for applications sub-resources.

The built-in policy should be updated to add applications, update/* and applications, delete/* for role:admin to preserve current privilege.

The text was updated successfully, but these errors were encountered:

A breaking change was introduced in a previous commit that is planned to be a part of the next major version of Argo CD (v3) where it's okay to introduce breaking changes. We want this feature before we hit v3, so we add a config setting that allows us to explicitly turn this new v3 behavior on in v2. The current v2 behavior is the default, so this change will not affect folks who do not explicitly opt in. GitHub argoproj#19988, argoproj#20600

…oj#19988) Change applications resource RBAC to use fine-grained update/delete enforcement by default. This allows us to enforce RBAC on the application itself, separately from the sub-resources related to it. (see also argoproj#18124, argoproj#20600)

A breaking change was introduced in a previous commit that is planned to be a part of the next major version of Argo CD (v3) where it's okay to introduce breaking changes. We want this feature before we hit v3, so we add a config setting that allows us to explicitly turn this new v3 behavior on in v2. The current v2 behavior is the default, so this change will not affect folks who do not explicitly opt in. This commit to add the gating code is added separately so it will be easy to either cherry pick that pervious commit or revert this one. (see also argoproj#18124, argoproj#20600)

…oj#19988) Change applications resource RBAC to use fine-grained update/delete enforcement by default. This allows us to enforce RBAC on the application itself, separately from the sub-resources related to it. (see also argoproj#18124, argoproj#20600) Signed-off-by: Matt Finkel <finkel.matt@gmail.com>

A breaking change was introduced in a previous commit that is planned to be a part of the next major version of Argo CD (v3) where it's okay to introduce breaking changes. We want this feature before we hit v3, so we add a config setting that allows us to explicitly turn this new v3 behavior on in v2. The current v2 behavior is the default, so this change will not affect folks who do not explicitly opt in. This commit to add the gating code is added separately so it will be easy to either cherry pick that pervious commit or revert this one. (see also argoproj#18124, argoproj#20600) Signed-off-by: Matt Finkel <finkel.matt@gmail.com>

…oj#19988) Change applications resource RBAC to use fine-grained update/delete enforcement by default. This allows us to enforce RBAC on the application itself, separately from the sub-resources related to it. (see also argoproj#18124, argoproj#20600) Signed-off-by: Matt Finkel <finkel.matt@gmail.com>

A breaking change was introduced in a previous commit that is planned to be a part of the next major version of Argo CD (v3) where it's okay to introduce breaking changes. We want this feature before we hit v3, so we add a config setting that allows us to explicitly turn this new v3 behavior on in v2. The current v2 behavior is the default, so this change will not affect folks who do not explicitly opt in. This commit to add the gating code is added separately so it will be easy to either cherry pick that pervious commit or revert this one. (see also argoproj#18124, argoproj#19988) Signed-off-by: Matt Finkel <finkel.matt@gmail.com>

…oj#19988) Change applications resource RBAC to use fine-grained update/delete enforcement by default. This allows us to enforce RBAC on the application itself, separately from the sub-resources related to it. (see also argoproj#18124, argoproj#20600) Signed-off-by: Matt Finkel <finkel.matt@gmail.com>

A breaking change was introduced in a previous commit that is planned to be a part of the next major version of Argo CD (v3) where it's okay to introduce breaking changes. We want this feature before we hit v3, so we add a config setting that allows us to explicitly turn this new v3 behavior on in v2. The current v2 behavior is the default, so this change will not affect folks who do not explicitly opt in. This commit to add the gating code is added separately so it will be easy to either cherry pick that pervious commit or revert this one. (see also argoproj#18124, argoproj#19988) Signed-off-by: Matt Finkel <finkel.matt@gmail.com>

andrii-korotkov-verkada · 2024-11-09T02:42:39Z

I think instead of introducing a breaking change we should create a new mechanism for setting permissions for applications themselves only.

Maybe we introduce the new permission terms like update_self or delete_self.

fffinkel · 2024-12-05T14:09:53Z

We're very happy to do that instead. I'll bring it up at the meeting today.

…j#20600) We don't know if this will go out with v3, and furthermore, the name is not very descriptive. (see also argoproj#18124, argoproj#19988) Signed-off-by: Matt Finkel <finkel.matt@gmail.com>

…oj#19988) Change applications resource RBAC to use fine-grained update/delete enforcement by default. This allows us to enforce RBAC on the application itself, separately from the sub-resources related to it. (see also argoproj#18124, argoproj#20600) Signed-off-by: Matt Finkel <finkel.matt@gmail.com>

A breaking change was introduced in a previous commit that is planned to be a part of the next major version of Argo CD (v3) where it's okay to introduce breaking changes. We want this feature before we hit v3, so we add a config setting that allows us to explicitly turn this new v3 behavior on in v2. The current v2 behavior is the default, so this change will not affect folks who do not explicitly opt in. This commit to add the gating code is added separately so it will be easy to either cherry pick that pervious commit or revert this one. (see also argoproj#18124, argoproj#19988) Signed-off-by: Matt Finkel <finkel.matt@gmail.com>

…j#20600) We don't know if this will go out with v3, and furthermore, the name is not very descriptive. (see also argoproj#18124, argoproj#19988) Signed-off-by: Matt Finkel <finkel.matt@gmail.com>

A breaking change was introduced in a previous commit that is planned to be a part of the next major version of Argo CD (v3) where it's okay to introduce breaking changes. We want this feature before we hit v3, so we add a config setting that allows us to explicitly turn this new v3 behavior on in v2. The current v2 behavior is the default, so this change will not affect folks who do not explicitly opt in. This commit to add the gating code is added separately so it will be easy to either cherry pick that pervious commit or revert this one. (see also argoproj#18124, argoproj#19988) Signed-off-by: Matt Finkel <finkel.matt@gmail.com>

…oj#19988) Change applications resource RBAC to use fine-grained update/delete enforcement by default. This allows us to enforce RBAC on the application itself, separately from the sub-resources related to it. (see also argoproj#18124, argoproj#20600) Signed-off-by: Matt Finkel <finkel.matt@gmail.com>

A breaking change was introduced in a previous commit that is planned to be a part of the next major version of Argo CD (v3) where it's okay to introduce breaking changes. We want this feature before we hit v3, so we add a config setting that allows us to explicitly turn this new v3 behavior on in v2. The current v2 behavior is the default, so this change will not affect folks who do not explicitly opt in. This commit to add the gating code is added separately so it will be easy to either cherry pick that pervious commit or revert this one. (see also argoproj#18124, argoproj#19988) Signed-off-by: Matt Finkel <finkel.matt@gmail.com>

…0671) --------- Signed-off-by: Matt Finkel <finkel.matt@gmail.com> Signed-off-by: Alexandre Gaudreault <alexandre_gaudreault@intuit.com> Co-authored-by: Alexandre Gaudreault <alexandre_gaudreault@intuit.com>

…) (argoproj#20671) --------- Signed-off-by: Matt Finkel <finkel.matt@gmail.com> Signed-off-by: Alexandre Gaudreault <alexandre_gaudreault@intuit.com> Co-authored-by: Alexandre Gaudreault <alexandre_gaudreault@intuit.com> Signed-off-by: Alexandre Gaudreault <alexandre_gaudreault@intuit.com>

) (argoproj#20671) --------- Signed-off-by: Matt Finkel <finkel.matt@gmail.com> Signed-off-by: Alexandre Gaudreault <alexandre_gaudreault@intuit.com> Co-authored-by: Alexandre Gaudreault <alexandre_gaudreault@intuit.com> Signed-off-by: Brett C. Dudo <brett@dudo.io>

) (argoproj#20671) --------- Signed-off-by: Matt Finkel <finkel.matt@gmail.com> Signed-off-by: Alexandre Gaudreault <alexandre_gaudreault@intuit.com> Co-authored-by: Alexandre Gaudreault <alexandre_gaudreault@intuit.com>

) (argoproj#20671) --------- Signed-off-by: Matt Finkel <finkel.matt@gmail.com> Signed-off-by: Alexandre Gaudreault <alexandre_gaudreault@intuit.com> Co-authored-by: Alexandre Gaudreault <alexandre_gaudreault@intuit.com> Signed-off-by: flbla <flbla@users.noreply.github.com>

) (argoproj#20671) --------- Signed-off-by: Matt Finkel <finkel.matt@gmail.com> Signed-off-by: Alexandre Gaudreault <alexandre_gaudreault@intuit.com> Co-authored-by: Alexandre Gaudreault <alexandre_gaudreault@intuit.com>

agaudreault added the enhancement New feature or request label Sep 18, 2024

agaudreault added this to the v3.0 milestone Sep 18, 2024

todaywasawesome added the component:rbac Issues related to Openshift and Racher label Sep 19, 2024

agaudreault mentioned this issue Oct 31, 2024

Allow rollbacks when auto-sync is enabled and user does not have "applications update" permission #20600

Open

fffinkel mentioned this issue Nov 5, 2024

feat: Fine grained update delete RBAC w/ v3 gate fffinkel/argo-cd#2

Open

14 tasks

fffinkel mentioned this issue Nov 5, 2024

feat(rbac)!: disable fine-grained inheritance by default (#19988) #20671

Merged

14 tasks

crenshaw-dev added this to Argo CD 3.0 Jan 14, 2025

crenshaw-dev moved this to Todo in Argo CD 3.0 Jan 14, 2025

agaudreault closed this as completed in #20671 Jan 17, 2025

github-project-automation bot moved this from Todo to Done in Argo CD 3.0 Jan 17, 2025

agaudreault self-assigned this Jan 17, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable fine-grained update/delete RBAC enforcement by default #19988

Enable fine-grained update/delete RBAC enforcement by default #19988

agaudreault commented Sep 18, 2024 •

edited

Loading

andrii-korotkov-verkada commented Nov 9, 2024

fffinkel commented Dec 5, 2024

Enable fine-grained update/delete RBAC enforcement by default #19988

Enable fine-grained update/delete RBAC enforcement by default #19988

Comments

agaudreault commented Sep 18, 2024 • edited Loading

Summary

Motivation

Proposal

andrii-korotkov-verkada commented Nov 9, 2024

fffinkel commented Dec 5, 2024

agaudreault commented Sep 18, 2024 •

edited

Loading