-
Notifications
You must be signed in to change notification settings - Fork 5.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support User Impersonation #3376
Comments
What about using Kubernetes authentication? The way kubeapps does (watchers can still be cluster-wide, but read-only). |
ApplicationSet will solve these problems. |
@zoetrope taking a look at |
@mlbiam No, it does not mean that If anyone else wants this feature, I can reopen this issue. |
@zoetrope can you explain how it solved it? |
Summary
Application-controller impersonates a user when synchronizing applications.
By impersonating a user, we can restrict resource operations using Kubernetes RBAC.
https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation
Motivation
ArgoCD already has a feature to restrict resource operations such as ClusterResourceWhitelist, NamespacedResourceBlacklist.
However, most of Kubernetes users already have Kubernetes RBAC configurations.
Therefore, we need to manage similar information doubly.
With support for user impersonation, a restriction will be based on a single source of truth.
Proposal
Add the following fields
impersonateUser
andimpersonateGroups
to AppProject resource.Application-controller impersonates user and group using the above settings to deploy applications.
See PR in detail.
The text was updated successfully, but these errors were encountered: