All 29 RBAC questions
More in RBAC
How do you bind a user (not a group) to a role? How is an ArgoCD RBAC policy rule structured? How do you scope RBAC to specific projects and applications? How does ArgoCD integrate with SSO for authentication? What actions can be controlled for the applications resource? What resources can ArgoCD RBAC control besides applications? How do you create a read-only role scoped to one project? What is a local account and when would you use one? How do you manage RBAC declaratively under GitOps? How do you restrict which repositories a project can use?
Advertisement
ArgoCD › RBAC

What is the exec resource in RBAC and why is it sensitive?

Intermediate

Answer

The exec resource controls whether a user can open a shell into a running pod via ArgoCD's terminal feature. It's powerful (equivalent to kubectl exec) and can bypass other controls, so it's disabled by default and granted narrowly. Enabling it requires both the feature flag and an explicit RBAC allow.
p, role:admin, exec, create, '*/*', allow
Real-world example Only senior SREs get exec permission for emergency debugging, and it's off by default for everyone else.

Common follow-ups: Why is exec disabled by default? | What does exec permission allow?

RBAC Applications Multi-cluster
All 29 RBAC questions