All 29 RBAC questions
More in RBAC
How does ArgoCD integrate with SSO for authentication? What is the exec resource in RBAC and why is it sensitive? What actions can be controlled for the applications resource? What resources can ArgoCD RBAC control besides applications? What is a local account and when would you use one? How do you manage RBAC declaratively under GitOps? How do you restrict which repositories a project can use? How do you prevent a team from deploying to namespaces they don't own? What permissions are needed to manage ApplicationSets? How do AppProjects and RBAC work together for multi-tenancy?
Advertisement
Back to results for “Applications”
ArgoCD › RBAC

How do you create a read-only role scoped to one project?

Intermediate

Answer

Define policy lines granting only get on that project's apps: `p, role:viewer-a, applications, get, team-a/*, allow`, then bind users/groups with a g line. They can view team-a apps but not sync or modify them, and nothing outside the project.
p, role:viewer-a, applications, get, team-a/*, allow
g, team-a-viewers, role:viewer-a
Real-world example Auditors get read-only visibility into team A's apps without any change rights.

Common follow-ups: What action gives view-only? | How do you scope to one project?

Applications Multi-cluster RBAC
All 29 RBAC questions