forked from roger/k3s-cluster
30 lines
1021 B
YAML
30 lines
1021 B
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: argocd-rbac-cm
|
|
namespace: argocd
|
|
labels:
|
|
app.kubernetes.io/name: argocd-rbac-cm
|
|
app.kubernetes.io/part-of: argocd
|
|
data:
|
|
policy.csv: |
|
|
# Grant platform-engineer read-only access to applications
|
|
g, platform-engineer, role:readonly
|
|
|
|
# Custom policy for platform-engineer with application read permissions
|
|
p, role:platform-engineer, applications, get, *, allow
|
|
p, role:platform-engineer, applications, list, *, allow
|
|
p, role:platform-engineer, clusters, get, *, allow
|
|
p, role:platform-engineer, clusters, list, *, allow
|
|
p, role:platform-engineer, repositories, get, *, allow
|
|
p, role:platform-engineer, repositories, list, *, allow
|
|
p, role:platform-engineer, projects, get, *, allow
|
|
p, role:platform-engineer, projects, list, *, allow
|
|
g, platform-engineer, role:platform-engineer
|
|
|
|
# Default policy - deny by default (ArgoCD default)
|
|
policy.default: role:readonly
|
|
|
|
# Enable RBAC
|
|
rbac.enabled: "true"
|