argocd-rbac-cm.yaml 예시

argocd-rbac-cm.yaml 예시 (argocd-rbac-cm.yaml example)

argocd-rbac-cm ConfigMap은 Argo CD의 RBAC 리소스 접근 제어를 설정하는 곳이에요. 정책 파일은 CSV 형식이지만 주석을 지원하므로 RBAC 규칙을 명확하게 관리할 수 있답니다.

출처: 문서

본문

참고: 정책 파일이 CSV 파일이지만, ArgoCD는 파일을 파싱할 때 #로 시작하는 줄을 무시하므로 #로 시작하는 줄 주석을 사용할 수 있어요.

argocd-rbac-cm.yaml 파일의 예시:

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
  labels:
    app.kubernetes.io/name: argocd-rbac-cm
    app.kubernetes.io/part-of: argocd
data:
  # policy.csv is an file containing user-defined RBAC policies and role definitions (optional).
  # Policy rules are in the form:
  #   p, subject, resource, action, object, effect
  # Role definitions and bindings are in the form:
  #   g, subject, inherited-subject
  # See https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/rbac.md for additional information.
  policy.csv: |
    # Grant all members of the group 'my-org:team-alpha; the ability to sync apps in 'my-project'
    p, my-org:team-alpha, applications, sync, my-project/*, allow
    # Grant all members of 'my-org:team-beta' admins
    g, my-org:team-beta, role:admin

  # it is possible to provide additional entries in this configmap to compose the final policy csv.
  # In this case the key must follow the pattern 'policy.<any string>.csv'. Argo CD will concatenate
  # all additional policies it finds with this pattern below the main one ('policy.csv'). This is useful
  # to allow composing policies in config management tools like Kustomize, Helm, etc.
  policy.overlay.csv: |
    p, role:tester, applications, *, */*, allow
    p, role:tester, projects, *, *, allow
    g, my-org:team-qa, role:tester

  # policy.default is the name of the default role which Argo CD will falls back to, when
  # authorizing API requests (optional). If omitted or empty, users may be still be able to login,
  # but will see no apps, projects, etc...
  policy.default: role:readonly

  # scopes controls which OIDC scopes to examine during rbac enforcement (in addition to `sub` scope).
  # If omitted, defaults to: '[groups]'. The scope value can be a string, or a list of strings.
  scopes: '[cognito:groups, email]'

  # matchMode configures the matchers function for casbin.
  # There are two options for this, 'glob' for glob matcher or 'regex' for regex matcher. If omitted or mis-configured,
  # will be set to 'glob' as default.
  policy.matchMode: 'glob'

더 알아보기 (Learn more)