Add ability to skip cluster RBAC setup in CLI #3183
Labels
enhancement
New feature or request
Comments
5 tasks
jannfis
pushed a commit
that referenced
this issue
Mar 4, 2020
) * Add "skip-rbac-setup" flag to "cluster add" command "InstallClusterManagerRBAC" method of the clusterauth package is somewhat opinionated about rolebindings and role definitions for "argocd-manager" SA. Sometimes it is desirable however to manually pre-configure such bindings and/or modify them in order to comply with existing infrastructure requirements. This commit introduces a new option "--skip-rbac-setup" which allows operator to skip the aforementioned "InstallClusterManagerRBAC" method call. * Modified --skip-rbac-setup into --service-account flag * use reference instead of hardoded SA name
|
Implemented via #3184 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Summary
It would be useful to be able to skip setting up cluster manager RBAC for ArgoCD SA when performing
argocd cluster addin environments where predefined roles described byArgoCDManagerNamespacePolicyRulesandArgoCDManagerClusterPolicyRulesdo not comply with specific access and/or legal/policy requirements.Motivation
InstallClusterManagerRBACmethod of the clusterauth package is somewhat opinionated about rolebindings and role definitions for "argocd-manager" SA (read: those definitions are hardcoded). It is called whenever users tries to add a new cluster viaargocd cluster addcommand.Sometimes it is desirable however to manually pre-configure such bindings and/or modify them in order to comply with existing infrastructure requirements. For example, user might choose to create customized definitions for
argocd-manager-role-bindingandargocd-manager-rolebefore adding a cluster or its namespace into ArgoCD.Proposal
A simple CLI flag
--skip-rbac-setupforargocd cluster addcommand should suffice for most use-cases. If flag is present command should skip setting up pre-defined RBAC entities and only get SA token to be passed to the server.The text was updated successfully, but these errors were encountered: