All 29 RBAC questions
More in RBAC
How does the scopes setting affect group mapping? How do project roles and tokens enable least-privilege automation? How do you audit and troubleshoot effective permissions for a user? How do you implement break-glass emergency access safely? How do you enforce that only signed/approved commits get deployed?
Advertisement
Back to results for “Sync & Health”
ArgoCD › RBAC

How do you separate duties between who can create apps and who can sync them?

Advanced

Answer

Grant create/delete on applications to platform admins and only get/sync to developers, via distinct roles. This separation means developers can deploy approved apps but not create arbitrary ones or remove them, enforcing change control and least privilege.
p, role:dev, applications, sync, '*/*', allow
p, role:platform, applications, create, '*/*', allow
Real-world example Developers sync existing apps while only the platform team can create or delete Application definitions.

Common follow-ups: How does omitting create limit developers? | Why separate these duties?

Applications Sync & Health RBAC
All 29 RBAC questions