From 5d4d3d44e5139fdde5d912ffb6ab4349dffe0946 Mon Sep 17 00:00:00 2001 From: Mukul Sharma Date: Thu, 3 Sep 2026 06:36:04 +0530 Subject: [PATCH] Scope jenkins-ci RBAC to the whole webapp project, not one app MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Was hardcoded to webapp/demo-go-app — any future app added to this project needed its own policy line. Wildcarding to webapp/* means any app onboarded into that project (project: webapp in its Application manifest) is automatically covered, no RBAC change needed per app. Platform-level apps on the default project are unaffected. --- .../argocd-admin-prd/custom-values.yaml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/helm-overrides/k8s-admin-prd-ase1/argocd-admin-prd/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/argocd-admin-prd/custom-values.yaml index 019afc9..c9c1c70 100644 --- a/helm-overrides/k8s-admin-prd-ase1/argocd-admin-prd/custom-values.yaml +++ b/helm-overrides/k8s-admin-prd-ase1/argocd-admin-prd/custom-values.yaml @@ -108,9 +108,17 @@ argo-cd: # role:admins / role:backend / GitHub-team policy.csv and real teammate # emails from the source cluster are dropped here. rbac: + # Scoped to the whole webapp project, not one app name — this is + # exactly what that AppProject exists for (projects/webapp.yaml in + # devops-argo-config). Any future app onboarded into it (project: + # webapp in its Application manifest) is automatically covered by + # jenkins-ci's sync/get access with zero RBAC changes needed here. + # Platform-level apps (argocd, gitea, vault, contour, + # external-secrets, jenkins, harbor) stay on the default project, + # untouched by this policy. policy.csv: | - p, jenkins-ci, applications, sync, webapp/demo-go-app, allow - p, jenkins-ci, applications, get, webapp/demo-go-app, allow + p, jenkins-ci, applications, sync, webapp/*, allow + p, jenkins-ci, applications, get, webapp/*, allow repositories: devops-infra-helm-charts: url: http://gitea.192.168.1.7.nip.io/mukul/devops-infra-helm-charts.git