All 29 RBAC questions
More in RBAC
What resources can ArgoCD RBAC control besides applications? How do you create a read-only role scoped to one project? What is a local account and when would you use one? How do you manage RBAC declaratively under GitOps? How do you prevent a team from deploying to namespaces they don't own? What permissions are needed to manage ApplicationSets? How do AppProjects and RBAC work together for multi-tenancy? How do you grant fine-grained permissions like sync but not delete? How do you manage RBAC for API/automation accounts (project roles and tokens)? How do you troubleshoot 'permission denied' errors in ArgoCD?
Advertisement
ArgoCD › RBAC

How do you restrict which repositories a project can use?

Intermediate

Answer

Set sourceRepos on the AppProject to an allow-list (with wildcards) of permitted repo URLs. Apps in that project can only pull from those repos, preventing teams from deploying arbitrary or untrusted sources.
spec:
  sourceRepos: [ 'https://github.com/org/team-a-*' ]
Real-world example Team A's project only permits its own repos, so it can't deploy manifests from an unapproved source.

Common follow-ups: Where is the repo allow-list set? | Why restrict source repos?

Applications Multi-cluster RBAC
All 29 RBAC questions