Chapter 2. Customizing permissions by creating user-defined cluster roles for cluster-scoped instances

Procedure

1. In the Argo CD CR, set the value of the .spec.defaultClusterScopedRoleDisabled field to true:

   Example Argo CD CR

   apiVersion: argoproj.io/v1beta1
   kind: ArgoCD
   metadata:
     name: example 1
     namespace: spring-petclinic 2
   # ...
   spec:
     defaultClusterScopedRoleDisabled: true 3
   # ...

   1

   The name of the cluster-scoped instance.

   2

   The namespace where you want to run the cluster-scoped instance.

   3

   The flag value that disables the creation of the default cluster roles for the cluster-scoped instance. If you want the Operator to recreate the default cluster roles and cluster role bindings for the cluster-scoped instance, set the field value to false.

   Sample output

   argocd.argoproj.io/example configured

2. Verify that the Red Hat OpenShift GitOps Operator has deleted the default cluster roles and cluster role bindings for the GitOps control plane components by running the following commands:

   $ oc get ClusterRoles/<argocd_name>-<argocd_namespace>-<control_plane_component>

   $ oc get ClusterRoleBindings/<argocd_name>-<argocd_namespace>-<control_plane_component>

   Sample output

   No resources found

   The default cluster roles and cluster role bindings for the cluster-scoped instance are not created. As a cluster administrator, you can now create and customize permissions for cluster-scoped instances by creating new cluster roles and cluster role bindings for the GitOps control plane components.

Procedure

1. Open the Administrator perspective of the web console and go to User Management Roles Create Role.

2. Use the following ClusterRole YAML template to add rules to specify the additional permissions.

   Example cluster role YAML template

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: example-spring-petclinic-argocd-application-controller 1
   rules:
     - verbs:
         - get
         - list
         - watch
       apiGroups:
         - '*'
       resources:
         - '*'
     - verbs:
         - '*'
       apiGroups:
         - ''
       resources: 2
         - namespaces
         - persistentvolumes

   1

   The name of the cluster role according to the <argocd_name>-<argocd_namespace>-<control_plane_component> naming convention.

   2

   The resources to which you want to grant permissions at the cluster level.

3. Click Create to add the cluster role.

4. Find the service account used by the control plane component you are customizing permissions for, by performing the following steps:

   1. Go to Workloads Pods.
   2. From the Project list, select the project where the user-defined cluster-scoped instance is installed.
   3. Click the pod of the control plane component and go to the YAML tab.
   4. Find the spec.ServiceAccount field and note the service account.
5. Go to User Management RoleBindings Create binding.
6. Click Create binding.
7. Select Binding type as Cluster-wide role binding (ClusterRoleBinding).
8. Enter a unique value for RoleBinding name by following the <argocd_name>-<argocd_namespace>-<control_plane_component> naming convention.
9. Select the newly created cluster role from the drop-down list for Role name.

10. Select the Subject as ServiceAccount and the provide the Subject namespace and name.

    1. Subject namespace: spring-petclinic

    2. Subject name: example-argocd-application-controller

       Note

       For Subject name, ensure that the value you configure is the same as the value of the spec.ServiceAccount field of the control plane component you are customizing permissions for.

11. Click Create.

    You have created the required permissions for the control plane component’s service account and namespace. The YAML file for the ClusterRoleBinding object looks similar to the following example:

    Example YAML file for a cluster role binding

    kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: example-spring-petclinic-argocd-application-controller
    subjects:
      - kind: ServiceAccount
        name: example-argocd-application-controller
        namespace: spring-petclinic
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: example-spring-petclinic-argocd-application-controller