All 29 RBAC questions
More in RBAC
What is the policy.default setting? How do you give a group admin access via RBAC? What is the difference between ArgoCD RBAC and Kubernetes RBAC? How do you bind a user (not a group) to a role? How do you scope RBAC to specific projects and applications? How does ArgoCD integrate with SSO for authentication? What is the exec resource in RBAC and why is it sensitive? What actions can be controlled for the applications resource? What resources can ArgoCD RBAC control besides applications? How do you create a read-only role scoped to one project?
Advertisement
Back to results for “Applications”
ArgoCD › RBAC

How is an ArgoCD RBAC policy rule structured?

Intermediate

Answer

Policy lines use a CSV-like format: `p, <subject>, <resource>, <action>, <object>, <effect>`. Resources include applications, clusters, repositories, projects, logs, exec. Actions include get, create, update, delete, sync, override. Objects scope by project/app (e.g., proj/app) and support wildcards. `g` lines map users/groups to roles.
p, role:dev, applications, sync, team-a/*, allow
p, role:dev, applications, get, team-a/*, allow
g, team-a-group, role:dev
Real-world example The dev role can get and sync any application in the team-a project, and the SSO group team-a-group is bound to it.

Common follow-ups: What does a 'p' line define? | How do 'g' lines work?

Applications Multi-cluster RBAC
All 29 RBAC questions