Fixed the default ArgoCD role for default instance openshift-gitops #586
Conversation
|
/test v4.14-kuttl-sequential-periodic |
|
/test v4.13-e2e |
|
/test v4.14-kuttl-parallel |
|
@anandf could this be a breaking change for users that haven't specifically defined their argocd rbac because the default policy was already letting them do what they needed ? Not that that is a reason not to make this change |
I agree that this change can cause surprise in behaviour especially if customers were leveraging this default read only role. Would it be sufficient to mention this change in behaviour in the release notes ? Please not that this change being applicable only for the default gitops instance and other customer managed |
anandf
force-pushed
the
fix_default_argocd_role
branch
from
83bf99c to
9ed3a17
Compare
|
/retest-required |
anandf
force-pushed
the
fix_default_argocd_role
branch
from
c4a96f0 to
e2df544
Compare
anandf
force-pushed
the
fix_default_argocd_role
branch
from
e2df544 to
33c503c
Compare
Signed-off-by: Anand Francis Joseph <[email protected]>
…cenarios Signed-off-by: Anand Francis Joseph <[email protected]>
Signed-off-by: Anand Francis Joseph <[email protected]>
Signed-off-by: Anand Francis Joseph <[email protected]>
anandf
force-pushed
the
fix_default_argocd_role
branch
from
116fe16 to
f1c616d
Compare
|
/test v4.13-kuttl-parallel |
1 similar comment
|
/test v4.13-kuttl-parallel |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: iam-veeramalla The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
…edhat-developer#586) * Fixed the default ArgoCD role for default instance openshift-gitops Signed-off-by: Anand Francis Joseph <[email protected]> * Added E2E tests to validate the default argocd policy for different scenarios Signed-off-by: Anand Francis Joseph <[email protected]> * Documented the behaviour of default argocd role from v1.10 onwards Signed-off-by: Anand Francis Joseph <[email protected]> * Changed the custom namespace used for the test argocd instance creation Signed-off-by: Anand Francis Joseph <[email protected]> --------- Signed-off-by: Anand Francis Joseph <[email protected]>
What type of PR is this?
What does this PR do / why we need it:
This PR is to make the default ArgoCD instance with name
openshift-gitopsin namespaceopenshift-gitopsto have restricted default permissions. With defaultreadonlypermission, any non-admin user will be able to view the Application and other manifest resource managed by ArgoCD which can contain sensitive information. By setting the default permission to''this read only access can be avoided.Have you updated the necessary documentation?
Which issue(s) this PR fixes:
Fixes #?
Test acceptance criteria:
How to test changes / Special notes to the reviewer: