Skip to content

Commit 37b7c19

Browse files
day0heroday0hero
committed
update rbac for pipelines and argo
1 parent 31cbe0b commit 37b7c19

6 files changed

Lines changed: 227 additions & 0 deletions

File tree

‎charts/all/argocd-application-rbac/Chart.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
name: argocd-application-rbac
3+
description: ClusterRole and ClusterRoleBinding for managing Argo CD Application CRs (argoproj.io)
4+
type: application
5+
version: 0.1.0
6+
appVersion: "0.1.0"

‎charts/all/argocd-application-rbac/templates/application-rbac.yaml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
{{- $cfg := .Values.argocdApplicationRbac | default dict }}
2+
{{- $doCreate := true }}
3+
{{- $createFlag := index $cfg "create" }}
4+
{{- if kindIs "bool" $createFlag }}
5+
{{- $doCreate = $createFlag }}
6+
{{- end }}
7+
{{- $includeArgoCD := false }}
8+
{{- $argoCrFlag := index $cfg "includeArgoCdOperatorCr" }}
9+
{{- if kindIs "bool" $argoCrFlag }}
10+
{{- $includeArgoCD = $argoCrFlag }}
11+
{{- end }}
12+
{{- if $doCreate }}
13+
apiVersion: rbac.authorization.k8s.io/v1
14+
kind: ClusterRole
15+
metadata:
16+
name: {{ $cfg.clusterRoleName | default "openshift-gitops-application-manager" }}
17+
rules:
18+
# Argo CD Application, ApplicationSet, AppProject (incl. status/finalizers for sync + deletion)
19+
- apiGroups:
20+
- argoproj.io
21+
resources:
22+
- applications
23+
- applications/status
24+
- applications/finalizers
25+
- applicationsets
26+
- applicationsets/status
27+
- applicationsets/finalizers
28+
- appprojects
29+
- appprojects/status
30+
verbs:
31+
- get
32+
- list
33+
- watch
34+
- create
35+
- update
36+
- patch
37+
- delete
38+
- deletecollection
39+
{{- if $includeArgoCD }}
40+
# Argo CD / OpenShift GitOps operator instance (cluster-scoped); enables changing operator-managed settings via CR.
41+
- apiGroups:
42+
- argoproj.io
43+
resources:
44+
- argocds
45+
verbs:
46+
- get
47+
- list
48+
- watch
49+
- create
50+
- update
51+
- patch
52+
- delete
53+
- deletecollection
54+
{{- end }}
55+
{{- $users := $cfg.users | default list }}
56+
{{- $groups := $cfg.groups | default list }}
57+
{{- if or (gt (len $users) 0) (gt (len $groups) 0) }}
58+
---
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: ClusterRoleBinding
61+
metadata:
62+
name: {{ $cfg.clusterRoleBindingName | default "openshift-gitops-application-manager" }}
63+
roleRef:
64+
apiGroup: rbac.authorization.k8s.io
65+
kind: ClusterRole
66+
name: {{ $cfg.clusterRoleName | default "openshift-gitops-application-manager" }}
67+
subjects:
68+
{{- range $users }}
69+
- apiGroup: rbac.authorization.k8s.io
70+
kind: User
71+
name: {{ . | quote }}
72+
{{- end }}
73+
{{- range $groups }}
74+
- apiGroup: rbac.authorization.k8s.io
75+
kind: Group
76+
name: {{ . | quote }}
77+
{{- end }}
78+
{{- end }}
79+
{{- end }}

‎charts/all/argocd-application-rbac/values.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Kubernetes RBAC on argoproj.io resources used by Argo CD / OpenShift GitOps.
2+
# The Argo CD API server may still require policy in argocd-rbac-cm (policy.csv) for UI
3+
# actions; pair this chart with GitOps RBAC policy for your groups.
4+
argocdApplicationRbac:
5+
create: true
6+
clusterRoleName: openshift-gitops-application-manager
7+
clusterRoleBindingName: openshift-gitops-application-manager
8+
# When true, also allows create/update/delete on the ArgoCD operator CR (cluster-scoped).
9+
includeArgoCdOperatorCr: false
10+
users: []
11+
groups: []

‎charts/all/pipelines-rbac/Chart.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
name: pipelines-rbac
3+
description: ClusterRole and ClusterRoleBinding for Tekton / OpenShift Pipelines developer access
4+
type: application
5+
version: 0.1.0
6+
appVersion: "0.1.0"

‎charts/all/pipelines-rbac/templates/tekton-rbac.yaml‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
{{- $cfg := .Values.pipelinesRbac | default dict }}
2+
{{- $podAccess := true }}
3+
{{- $podFlag := index $cfg "includePodLogAccess" }}
4+
{{- if kindIs "bool" $podFlag }}
5+
{{- $podAccess = $podFlag }}
6+
{{- end }}
7+
{{- $doCreate := true }}
8+
{{- $createFlag := index $cfg "create" }}
9+
{{- if kindIs "bool" $createFlag }}
10+
{{- $doCreate = $createFlag }}
11+
{{- end }}
12+
{{- if $doCreate }}
13+
apiVersion: rbac.authorization.k8s.io/v1
14+
kind: ClusterRole
15+
metadata:
16+
name: {{ $cfg.clusterRoleName | default "openshift-pipelines-tekton-admin" }}
17+
rules:
18+
# Core Tekton Pipelines (namespaced)
19+
- apiGroups:
20+
- tekton.dev
21+
resources:
22+
- pipelines
23+
- pipelineruns
24+
- tasks
25+
- taskruns
26+
- runs
27+
- customruns
28+
- pipelineresources
29+
- verificationpolicies
30+
verbs:
31+
- get
32+
- list
33+
- watch
34+
- create
35+
- update
36+
- patch
37+
- delete
38+
- deletecollection
39+
# Cluster-scoped task catalog (read-only; cluster-wide Task definitions stay platform-owned)
40+
- apiGroups:
41+
- tekton.dev
42+
resources:
43+
- clustertasks
44+
verbs:
45+
- get
46+
- list
47+
- watch
48+
# Tekton Triggers (namespaced)
49+
- apiGroups:
50+
- triggers.tekton.dev
51+
resources:
52+
- eventlisteners
53+
- triggers
54+
- triggerbindings
55+
- triggertemplates
56+
- interceptors
57+
verbs:
58+
- get
59+
- list
60+
- watch
61+
- create
62+
- update
63+
- patch
64+
- delete
65+
- deletecollection
66+
# Triggers cluster catalog
67+
- apiGroups:
68+
- triggers.tekton.dev
69+
resources:
70+
- clustertriggerbindings
71+
- clusterinterceptors
72+
verbs:
73+
- get
74+
- list
75+
- watch
76+
{{- if $podAccess }}
77+
# Pod logs for PipelineRun / TaskRun debugging (console and kubectl/oc)
78+
- apiGroups:
79+
- ""
80+
resources:
81+
- pods
82+
- pods/log
83+
verbs:
84+
- get
85+
- list
86+
- watch
87+
{{- end }}
88+
{{- $users := $cfg.users | default list }}
89+
{{- $groups := $cfg.groups | default list }}
90+
{{- if or (gt (len $users) 0) (gt (len $groups) 0) }}
91+
---
92+
apiVersion: rbac.authorization.k8s.io/v1
93+
kind: ClusterRoleBinding
94+
metadata:
95+
name: {{ $cfg.clusterRoleBindingName | default "openshift-pipelines-tekton-admin" }}
96+
roleRef:
97+
apiGroup: rbac.authorization.k8s.io
98+
kind: ClusterRole
99+
name: {{ $cfg.clusterRoleName | default "openshift-pipelines-tekton-admin" }}
100+
subjects:
101+
{{- range $users }}
102+
- apiGroup: rbac.authorization.k8s.io
103+
kind: User
104+
name: {{ . | quote }}
105+
{{- end }}
106+
{{- range $groups }}
107+
- apiGroup: rbac.authorization.k8s.io
108+
kind: Group
109+
name: {{ . | quote }}
110+
{{- end }}
111+
{{- end }}
112+
{{- end }}

‎charts/all/pipelines-rbac/values.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# ClusterRole + ClusterRoleBinding granting full lifecycle (get/list/watch/create/update/patch/delete)
2+
# on core Tekton Pipelines CRDs and Triggers CRDs in any namespace, plus read-only use of
3+
# cluster-scoped catalog objects (ClusterTask, cluster-scoped triggers) and pod log access
4+
# for pipeline debugging.
5+
pipelinesRbac:
6+
create: true
7+
clusterRoleName: openshift-pipelines-tekton-admin
8+
clusterRoleBindingName: openshift-pipelines-tekton-admin
9+
# If false, omits cluster-wide Pod rules (tighter; you may grant namespace Role view/edit separately for logs).
10+
includePodLogAccess: true
11+
# OpenShift Users and Groups (e.g. GitHub Group Sync → group name "my-org-my-team")
12+
users: []
13+
groups: []

0 commit comments

Comments
 (0)