All 29 RBAC questions
More in RBAC
How do project roles and tokens enable least-privilege automation? How do you audit and troubleshoot effective permissions for a user? How do you implement break-glass emergency access safely? How do you separate duties between who can create apps and who can sync them?
Advertisement
ArgoCD › RBAC

How do you enforce that only signed/approved commits get deployed?

Advanced

Answer

Combine Git signature verification (ArgoCD can require signed commits via configured GPG keys on the Project) with branch protection requiring reviews. Only commits signed by trusted keys and merged through review are deployed, adding supply-chain integrity to RBAC and process controls.
spec:
  signatureKeys:
    - keyID: ABCDEF1234567890
Real-world example The project only syncs commits signed by approved GPG keys, blocking unsigned or tampered changes.

Common follow-ups: How does ArgoCD verify commit signatures? | How does this complement RBAC?

GitOps Principles Applications RBAC
All 29 RBAC questions