Uploaded image for project: 'OpenShift GitOps'
  1. OpenShift GitOps
  2. GITOPS-3292

Group permissions are not getting applied if we directly assign it to a group without a role-name via the argocd instance

    XMLWordPrintable

Details

    • False
    • None
    • False

    Description

      Description of problem:

      Group permissions are not getting applied if we directly assign it to the group without a role-name
      Even though the argocd CLI affirms the permission works, it doesn't actually work in Argo CD.

      For example, given this policy file:

      p, <group-name>, applications, *, */*, allow

      Testing the policy indicates it should work:

      $ argocd admin settings rbac can <group-name> sync applications 'default/*' --policy-file policy.csv
      Yes

       
      But, below two methods works as expected, (Giving the group  permissions via a named role works)

      rbac:
      defaultPolicy: ""
      policy: |
      p, <group-name>, applications, * , */*, allow
      g, <group-name>, role:<role-name> <======
      scopes: '[groups]'

       

      rbac:
      defaultPolicy: ""
      policy: |
      p, role:<role-name>, applications, *, */*, allow
      g, <group>, role:<role-name> <=======
      scopes: '[groups]'

      Prerequisites (if any, like setup, operators/versions):

       

      Steps to Reproduce

      • Create an argocd instance
      • Create a test application
      • Create a group and assign below permissions to that group
      • rbac:
        defaultPolicy: ""
        policy: |
        p, <group-name>, applications, * , */*, allow
        scopes: '[groups]'
      • Try to view or do any actions on the application as a group user

      Actual results:

      User unable to view or do any actions on the application

      Expected results:

      User should be able to view or do the specified actions on the application

      Reproducibility (Always/Intermittent/Only Once):

      Always

      Acceptance criteria: 

       

      Definition of Done:

      Build Details:

      Additional info (Such as Logs, Screenshots, etc):

      There is an open  upstream issue here:https://github.com/argoproj/argo-cd/issues/7952 *

      Attachments

        Activity

          People

            Unassigned Unassigned
            rhn-support-gio Ginilekshmi A O
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated: