Enabling log RBAC, aka server.rbac.log.enforce.enable

[arve0]

Hi! I'm looking for a method to enable log rbac in ArgoCD managed by argocd-operator.

Documentation in ArgoCD suggests to set server.rbac.log.enforce.enable in ConfigMap/argocd-cm, but the configmap is managed by argocd-operator.

I've looked around in kubectl explain argocd.spec.rbac and the CRD:

❯ kubectl get crd argocds.argoproj.io -o yaml | grep -C 2 enforce
                  scopes:
                    description: 'Scopes controls which OIDC scopes to examine during
                      rbac enforcement (in addition to `sub` scope). If omitted, defaults
                      to: ''[groups]''.'
                    type: string

...but it´s not immediate clear that argocd.spec.rbac.scopes controls server.rbac.log.enforce.enable.

I've also searched for an option similar to argocd.spec.additionalOptions, but not found anything.

Any ideas? Not possible to enable log RBAC-enforcement with operator?

[arve0]

One can use argocd.spec.extraConfig for additional parameters you want to set in argocd-cm. For example:

spec:
  extraConfig:
    server.rbac.log.enforce.enable: "true"