Support User Impersonation

[zoetrope]

Summary

Application-controller impersonates a user when synchronizing applications.

By impersonating a user, we can restrict resource operations using Kubernetes RBAC.
https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation

Motivation

ArgoCD already has a feature to restrict resource operations such as ClusterResourceWhitelist, NamespacedResourceBlacklist.
However, most of Kubernetes users already have Kubernetes RBAC configurations.
Therefore, we need to manage similar information doubly.

With support for user impersonation, a restriction will be based on a single source of truth.

Proposal

Add the following fields impersonateUser and impersonateGroups to AppProject resource.

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: impersonation-sample
spec:
  impersonateUser: "system:serviceaccount:myns:mysa"
  impersonateGroups:
  - "system:authenticated"

Application-controller impersonates user and group using the above settings to deploy applications.

See PR in detail.

[sathieu]

What about using Kubernetes authentication? The way kubeapps does (watchers can still be cluster-wide, but read-only).

[zoetrope]

ApplicationSet will solve these problems.

[mlbiam]

@zoetrope taking a look at ApplicationSets, is the thinking that the ApplicationSets controller would run as a specific ServiceAccount and would provision with that ServiceAccount?

[zoetrope]

@mlbiam
Sorry for the late reply.

No, it does not mean that ApplicationSet run as a specific ServiceAccount.
However, the problem I was facing was solved by ApplicationSet, which removed my motivation for User Impersonation.

If anyone else wants this feature, I can reopen this issue.

[schollii]

@zoetrope can you explain how it solved it?