RBAC configuration

DeployNow does not have its own user management system and has only one built-in user, admin. The RBAC feature enables restricted access to DeployNow resources. The admin user is a superuser with unrestricted access to the system. RBAC requires either of the following things:
SSO configured
﻿one or more local users setup. 
Once SSO or local users are configured, additional RBAC roles can be defined, and SSO groups or local users can then be mapped to roles.
RBAC configuration can be defined in policy.csv file that can be accessed and updated via admin-console.
Login to admin-console. Click on the DeployNow card on the homepage.
﻿
Select the DeployNow instance for which the RBAC should be configured. Click on the Config tab and navigate to the Config section. Edit the Configuration.yaml file. The policy.yaml block can be found inside the configuration.yaml file.
﻿
﻿
﻿
﻿
Basic Built-in Roles
Argo CD has two pre-defined roles but RBAC configuration allows defining roles and groups (see below).
role:readonly - read-only access to all resources
﻿
role:admin - unrestricted access to all resources
﻿
These default built-in role definitions can be seen in builtin-policy.csv﻿
Default Policy for Authenticated Users
When a user is authenticated in Argo CD, it will be granted the role specified in policy.default.
!!! warning "Restricting Default Permissions"
**All authenticated users get _at least_ the permissions granted by the default policies. This access cannot be blocked
by a `deny` rule.** It is recommended to create a new `role:authenticated` with the minimum set of permissions possible,
then grant permissions to individual roles as needed.
Anonymous Access
Enabling anonymous access to the Argo CD instance allows users to assume the default role permissions specified by policy.defaultwithout being authenticated.
The anonymous access to Argo CD can be enabled using the users.anonymous.enabledfield in argocd-cm(see argocd-cm.yaml).
!!! warning
When enabling anonymous access, consider creating a new default role and assigning it to the default policies
with `policy.default: role:unauthenticated`.
RBAC Model Structure
The model syntax is based on Casbin. There are two different types of syntax: one for assigning policies, and another one for assigning users to internal roles.
Group: Allows to assign authenticated users/groups to internal roles.
Syntax: g, <user/group>, <role>
<user/group>
<role>
: The internal role to which the entity will be assigned.
Policy: Allows to assign permissions to an entity.
Syntax: p, <role/user/group>, <resource>, <action>, <object>, <effect>
<role/user/group>
: The entity to whom the policy will be assigned
<resource>
: The type of resource on which the action is performed.
<action>
: The operation that is being performed on the resource.
<object>
: The object identifier representing the resource on which the action is performed. Depending on the resource, the object's format will vary.
<effect>
Below is a table that summarizes all possible resources and which actions are valid for each of them.
Resource\Action
get
create
update
delete
sync
action
override
invoke
applications
✅
✅
✅
✅
✅
✅
✅
❌
applicationsets
✅
✅
✅
✅
❌
❌
❌
❌
clusters
✅
✅
✅
✅
❌
❌
❌
❌
projects
✅
✅
✅
✅
❌
❌
❌
❌
repositories
✅
✅
✅
✅
❌
❌
❌
❌
accounts
✅
❌
✅
❌
❌
❌
❌
❌
certificates
✅
✅
❌
✅
❌
❌
❌
❌
gpgkeys
✅
✅
❌
✅
❌
❌
❌
❌
logs
✅
❌
❌
❌
❌
❌
❌
❌
exec
❌
✅
❌
❌
❌
❌
❌
❌
extensions
❌
❌
❌
❌
❌
❌
❌
✅
Application-Specific Policy
Some policy only have meaning within an application. It is the case with the following resources:
applications
applicationsets
logs
exec
While they can be set in the global configuration, they can also be configured in AppProject's roles. The expected <object>value in the policy structure is replaced by <app-project>/<app-name>.
For instance, these policies would grant example-useraccess to get any applications, but only be able to see logs in my-appapplication part of the example-projectproject.
p, example-user, applications, get, *, allow
p, example-user, logs, get, example-project/my-app, allow
When application in any namespace is enabled, the expected <object>value in the policy structure is replaced by <app-project>/<app-ns>/<app-name>. Since multiple applications could have the same name in the same project, the policy below makes sure to restrict access only to app-namespace.
p, example-user, applications, get, */app-namespace/*, allow
p, example-user, logs, get, example-project/app-namespace/my-app, allow
The applicationsresource
The applicationsresource is an Application-Specific Policy.
The updateand deleteactions, when granted on an application, will allow the user to perform the operation on the application itself and all of its resources. It can be desirable to only allow updateor deleteon specific resources within an application.
To do so, when the action if performed on an application's resource, the <action>will have the <action>/<group>/<kind>/<ns>/<name>format.
For instance, to grant access to example-userto only delete Pods in the prod-appApplication, the policy could be:
p, example-user, applications, delete/*/Pod/*, default/prod-app, allow
If we want to grant access to the user to update all resources of an application, but not the application itself:
p, example-user, applications, update/*, default/prod-app, allow
If we want to explicitly deny delete of the application, but allow the user to delete Pods:
p, example-user, applications, delete, default/prod-app, deny
p, example-user, applications, delete/*/Pod/*, default/prod-app, allow
!!! note
It is not possible to deny fine-grained permissions for a sub-resource if the action was **explicitly allowed on the application**.
For instance, the following policies will **allow** a user to delete the Pod and any other resources in the application:

```csv
p, example-user, applications, delete, default/prod-app, allow
p, example-user, applications, delete/*/Pod/*, default/prod-app, deny
```
The actionaction corresponds to either built-in resource customizations defined in the Argo CD repository, or to custom resource actions defined by you.
The <action>has the action/<group>/<kind>/<action-name>format.
For example, a resource customization path resource_customizations/extensions/DaemonSet/actions/restart/action.luacorresponds to the actionpath action/extensions/DaemonSet/restart. If the resource is not under a group (for example, Pods or ConfigMaps), then the path will be action//Pod/action-name.
The following policies allows the user to perform any action on the DaemonSet resources, as well as the maintenance-offaction on a Pod:
p, example-user, applications, action//Pod/maintenance-off, default/*, allow
p, example-user, applications, action/extensions/DaemonSet/*, default/*, allow
To allow the user to perform any actions:
p, example-user, applications, action/*, default/*, allow
When granted along with the syncaction, the override action will allow a user to synchronize local manifests to the Application. These manifests will be used instead of the configured source, until the next sync is performed.
The applicationsetsresource
The applicationsetsresource is an Application-Specific policy.
﻿ApplicationSets provide a declarative way to automatically create/update/delete Applications.
Allowing the createaction on the resource effectively grants the ability to create Applications. While it doesn't allow the user to create Applications directly, they can create Applications via an ApplicationSet.
!!! note
In v2.5, it is not possible to create an ApplicationSet with a templated Project field (e.g. `project: {{path.basename}}`)
via the API (or, by extension, the CLI). Disallowing templated projects makes project restrictions via RBAC safe:
With the resource being application-specific, the <object>of the applicationsets policy will have the format <app-project>/<app-name>. However, since an ApplicationSet does belong to any project, the <app-project>value represents the projects in which the ApplicationSet will be able to create Applications.
With the following policy, a dev-groupuser will be unable to create an ApplicationSet capable of creating Applications outside the dev-projectproject.
p, dev-group, applicationsets, *, dev-project/*, allow
The logsresource
The logsresource is an Application-Specific Policy.
When granted with the getaction, this policy allows a user to see Pod's logs of an application via the Argo CD UI. The functionality is similar to kubectl logs.
The execresource
The execresource is an Application-Specific Policy.
When granted with the createaction, this policy allows a user to execinto Pods of an application via the Argo CD UI. The functionality is similar to kubectl exec.
See Web-based Terminal for more info.
The extensionsresource
With the extensionsresource, it is possible to configure permissions to invoke proxy extensions. The extensionsRBAC validation works in conjunction with the applicationsresource. A user needs to have read permission on the application where the request is originated from.
Consider the example below, it will allow the example-userto invoke the httpbinextensions in all applications under the defaultproject.
p, example-user, applications, get, default/*, allow
p, example-user, extensions, invoke, httpbin, allow
The denyeffect
When denyis used as an effect in a policy, it will be effective if the policy matches. Even if more specific policies with the alloweffect match as well, the denywill have priority.
The order in which the policies appears in the policy file configuration has no impact, and the result is deterministic.
Policies Evaluation and Matching
The evaluation of access is done in two parts: validating against the default policy configuration, then validating against the policies for the current user.
If an action is allowed or denied by the default policies, then this effect will be effective without further evaluation. When the effect is undefined, the evaluation will continue with subject-specific policies.
The access will be evaluated for the user, then for each configured group that the user is part of.
The matching engine, configured in policy.matchMode, can use two different match modes to compare the values of tokens:
glob
regex
When all tokens match during the evaluation, the effect will be returned. The evaluation will continue until all matching policies are evaluated, or until a policy with the denyeffect matches. After all policies are evaluated, if there was at least one alloweffect and no deny, access will be granted.
Glob matching
When globis used, the policy tokens are treated as single terms, without separators.
Consider the following policy:
p, example-user, applications, action/extensions/*, default/*, allow
When the example-userexecutes the extensions/DaemonSet/testaction, the following globmatches will happen:
The current user
The value
The value
The value
Using SSO Users/Groups
The scopesfield controls which OIDC scopes to examine during RBAC enforcement (in addition to subscope). If omitted, it defaults to '[groups]'. The scope value can be a string, or a list of strings.
For more information on scopesplease review the User Management Documentation.
The following example shows targeting emailas well as groupsfrom your OIDC provider.
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
  labels:
    app.kubernetes.io/name: argocd-rbac-cm
    app.kubernetes.io/part-of: argocd
data:
  policy.csv: |
    p, my-org:team-alpha, applications, sync, my-project/*, allow
    g, my-org:team-beta, role:admin
    g, [email protected], role:admin
  policy.default: role:readonly
  scopes: '[groups, email]'
This can be useful to associate users' emails and groups directly in AppProject.
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: team-beta-project
  namespace: argocd
spec:
  roles:
    - name: admin
      description: Admin privileges to team-beta
      policies:
        - p, proj:team-beta-project:admin, applications, *, *, allow
      groups:
        - [email protected] # Value from the email scope
        - my-org:team-beta # Value from the groups scope
Local Users/Accounts
﻿Local users are assigned access by either grouping them with a role or by assigning policies directly to them.
The example below shows how to assign a policy directly to a local user.
p, my-local-user, applications, sync, my-project/*, allow
This example shows how to assign a role to a local user.
g, my-local-user, role:admin
!!! warning "Ambiguous Group Assignments"
If you have [enabled SSO](user-management/index.md#sso), any SSO user with a scope that matches a local user will be
added to the same roles as the local user. For example, if local user `sally` is assigned to `role:admin`, and if an
SSO user has a scope which happens to be named `sally`, that SSO user will also be assigned to `role:admin`.

An example of where this may be a problem is if your SSO provider is an SCM, and org members are automatically
granted scopes named after the orgs. If a user can create or add themselves to an org in the SCM, they can gain the
permissions of the local user with the same name.

To avoid ambiguity, if you are using local users and SSO, it is recommended to assign policies directly to local
users, and not to assign roles to local users. In other words, instead of using `g, my-local-user, role:admin`, you
should explicitly assign policies to `my-local-user`:

```yaml
p, my-local-user, *, *, *, allow
```
Policy CSV Composition
It is possible to provide additional entries in the argocd-rbac-cmconfigmap to compose the final policy csv. In this case, the key must follow the pattern policy.<any string>.csv. Argo CD will concatenate all additional policies it finds with this pattern below the main one ('policy.csv'). The order of additional provided policies are determined by the key string.
Example: if two additional policies are provided with keys policy.A.csvand policy.B.csv, it will first concatenate policy.A.csvand then policy.B.csv.
This is useful to allow composing policies in config management tools like Kustomize, Helm, etc.
The example below shows how a Kustomize patch can be provided in an overlay to add additional configuration to an existing RBAC ConfigMap.
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.tester-overlay.csv: |
    p, role:tester, applications, *, */*, allow
    p, role:tester, projects, *, *, allow
    g, my-org:team-qa, role:tester
Validating and testing your RBAC policies
If you want to ensure that your RBAC policies are working as expected, you can use the argocd admin settings rbaccommand to validate them. This tool allows you to test whether a certain role or subject can perform the requested action with a policy that's not live yet in the system, i.e. from a local file or config map. Additionally, it can be used against the live RBAC configuration in the cluster your Argo CD is running in.
Validating a policy
To check whether your new policy configuration is valid and understood by Argo CD's RBAC implementation, you can use the argocd admin settings rbac validatecommand.
Testing a policy
To test whether a role or subject (group or local user) has sufficient permissions to execute certain actions on certain resources, you can use the argocd admin settings rbac cancommand.
Resource\Action	get	create	update	delete	sync	action	override	invoke
applications	✅	✅	✅	✅	✅	✅	✅	❌
applicationsets	✅	✅	✅	✅	❌	❌	❌	❌
clusters	✅	✅	✅	✅	❌	❌	❌	❌
projects	✅	✅	✅	✅	❌	❌	❌	❌
repositories	✅	✅	✅	✅	❌	❌	❌	❌
accounts	✅	❌	✅	❌	❌	❌	❌	❌
certificates	✅	✅	❌	✅	❌	❌	❌	❌
gpgkeys	✅	✅	❌	✅	❌	❌	❌	❌
logs	✅	❌	❌	❌	❌	❌	❌	❌
exec	❌	✅	❌	❌	❌	❌	❌	❌
extensions	❌	❌	❌	❌	❌	❌	❌	✅
Did this page help you?
SSO with Microsoft Azure Entra ID (Azure AD)
Blue Green Deployments