All 29 RBAC questions
More in RBAC
How do you manage RBAC declaratively under GitOps? How do you restrict which repositories a project can use? How do you prevent a team from deploying to namespaces they don't own? What permissions are needed to manage ApplicationSets? How do you grant fine-grained permissions like sync but not delete? How do you manage RBAC for API/automation accounts (project roles and tokens)? How do you troubleshoot 'permission denied' errors in ArgoCD? How does the scopes setting affect group mapping? How do project roles and tokens enable least-privilege automation? How do you audit and troubleshoot effective permissions for a user?
Advertisement
ArgoCD › RBAC

How do AppProjects and RBAC work together for multi-tenancy?

Advanced

Answer

AppProjects enforce what can be deployed (allowed repos, destinations, resource kinds) while RBAC enforces who can act on which project's apps. Together they isolate tenants: a team's role is scoped to its project, and the project restricts that team's apps to approved repos, clusters, and namespaces—limiting both authority and blast radius.
# Project restricts destinations; RBAC restricts who can sync them
p, role:team-a, applications, sync, team-a/*, allow
Real-world example Team A can only sync apps in its project, and that project can only deploy to team-a namespaces on approved clusters.

Common follow-ups: What does a Project restrict vs what does RBAC restrict? | How do they combine for isolation?

Applications Multi-cluster RBAC
All 29 RBAC questions