Skip to content

docs: Added information about scopes (#2782) #14354

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
crenshaw-dev merged 3 commits into from
Jul 6, 2023
Merged

docs: Added information about scopes (#2782) #14354

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9500ad8
Added information about scopes in the docs
christianh814 Jul 5, 2023
eb3ceb8
Apply suggestions from code review
christianh814 Jul 6, 2023
12e0124
Merge branch 'master' into scopes-doc-information
christianh814 Jul 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions docs/operator-manual/rbac.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,6 +171,33 @@ g, db-admins, role:staging-db-admins

This example defines a *role* called `staging-db-admins` with *nine permissions* that allow that role to perform the *actions* (`create`/`delete`/`get`/`override`/`sync`/`update` applications, `get` logs, `create` exec and `get` appprojects) against `*` (all) objects in the `staging-db-admins` Argo CD AppProject.

!!! note
The `scopes` field controls which OIDC scopes to examine during rbac
enforcement (in addition to `sub` scope). If omitted, defaults to:
`'[groups]'`. The scope value can be a string, or a list of strings.

Following example shows targeting `email` as well as `groups` from your OIDC provider.

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: argocd-rbac-cm
namespace: argocd
labels:
app.kubernetes.io/name: argocd-rbac-cm
app.kubernetes.io/part-of: argocd
data:
policy.csv: |
p, my-org:team-alpha, applications, sync, my-project/*, allow
g, my-org:team-beta, role:admin
g, user@example.org, role:admin
policy.default: role:readonly
scopes: '[groups, email]'
```

For more information on `scopes` please review the [User Management Documentation](user-management/index.md).

## Policy CSV Composition

It is possible to provide additional entries in the `argocd-rbac-cm`
Expand Down