All 29 RBAC questions
More in RBAC
What actions can be controlled for the applications resource? What resources can ArgoCD RBAC control besides applications? How do you create a read-only role scoped to one project? What is a local account and when would you use one? How do you restrict which repositories a project can use? How do you prevent a team from deploying to namespaces they don't own? What permissions are needed to manage ApplicationSets? How do AppProjects and RBAC work together for multi-tenancy? How do you grant fine-grained permissions like sync but not delete? How do you manage RBAC for API/automation accounts (project roles and tokens)?
Advertisement
Back to results for “Applications”
ArgoCD › RBAC

How do you manage RBAC declaratively under GitOps?

Intermediate

Answer

Store the argocd-rbac-cm ConfigMap (policy.csv, policy.default, scopes) in Git and let ArgoCD (or the install) apply it, so access-control changes go through pull requests and review. This versions permissions and provides an audit trail of who changed access and when.
Real-world example Granting a new team access is a reviewed PR to the argocd-rbac-cm manifest, not a manual console change.

Common follow-ups: What's the benefit of RBAC in Git? | Do changes need a restart?

GitOps Principles Applications RBAC
All 29 RBAC questions