issue-9: lab/authz-bridge factory entry (CI Application + AppProject) #8

Closed

ginjiruu wants to merge 0 commits from issue-9-authz-bridge-factory into master

ginjiruu commented

2026-09-23 19:50:40 +00:00

Owner

Factory entry for lab/authz-bridge per lab/automation#9 — the second half of the first end-to-end repo-declared CI chain (scaffold: lab/authz-bridge#62, merged).

What's in it

repos/lab-authz-bridge/application.yaml — CI Application: source = authz-bridge repo (master, .ci/), destination = mini / ci, automated prune+selfHeal, allowEmpty: false. No app Application — authz-bridge is a system service deployed by Flux from deployments/kustomization/ (lab/clusters).
projects/lab-authz-bridge.yaml — AppProject scoped to the repo: sourceRepos = authz-bridge, sourceNamespaces: [dev-apps-source], destination mini/ci, destinationServiceAccounts = ci-argocd for mini/ci (matches the automation project convention — no serviceAccount on the Application itself).

RBAC note (spec correction)

The issue referenced an appRBAC field — that field does not exist in Argo CD v3.5.2 (verified against the live CRD, the v3.5.x/v3.6 sources, and a GitHub-wide search). The per-app RBAC mechanism is project roles with app-scoped policy objects:

roles:
  - name: repo-owner
    policies:
      - p, proj:lab-authz-bridge:repo-owner, applications, get, lab-authz-bridge/*, allow
      - p, proj:lab-authz-bridge:repo-owner, applications, sync, lab-authz-bridge/*, allow
      - p, proj:lab-authz-bridge:repo-owner, applications, update, lab-authz-bridge/*, allow
    groups:
      - admin

edit is not a valid action for applications (valid: get/create/update/delete/sync/rollback/action/override) — update is the edit-equivalent
lab-authz-bridge/* matches the any-namespace object form project/ns/app (gobwas/glob * crosses /, verified in the match function)
Bound to the admin group (the repo owner's iac claim_map claim); global RBAC is deny-by-default, so users without the binding cannot see the app
This matches the established model: the argocd values comment (merged t9 work) says per-app role bindings live in AppProject resources

The #9 issue body has been updated to record this correction.

Validation

Server-side dry-run of both objects against portable: pass
Requires the #9 wiring PR (lab/clusters) for the projects/ path to be synced into the argocd namespace — Argo CD v3.5.2 only watches AppProjects in the control-plane namespace

Remaining after merge

Central allowlist PR (lab/automation): remove lab/authz-bridge so only the repo sensor fires
E2E: tag push → repo sensor → go-build-push → Harbor image

Factory entry for lab/authz-bridge per lab/automation#9 — the second half of the first end-to-end repo-declared CI chain (scaffold: lab/authz-bridge#62, merged). ## What's in it - `repos/lab-authz-bridge/application.yaml` — CI Application: source = authz-bridge repo (master, `.ci/`), destination = mini / `ci`, automated prune+selfHeal, `allowEmpty: false`. No app Application — authz-bridge is a system service deployed by Flux from `deployments/kustomization/` (lab/clusters). - `projects/lab-authz-bridge.yaml` — AppProject scoped to the repo: `sourceRepos` = authz-bridge, `sourceNamespaces: [dev-apps-source]`, destination mini/`ci`, `destinationServiceAccounts` = `ci-argocd` for mini/`ci` (matches the `automation` project convention — no `serviceAccount` on the Application itself). ## RBAC note (spec correction) The issue referenced an `appRBAC` field — **that field does not exist in Argo CD v3.5.2** (verified against the live CRD, the v3.5.x/v3.6 sources, and a GitHub-wide search). The per-app RBAC mechanism is **project roles** with app-scoped policy objects: ```yaml roles: - name: repo-owner policies: - p, proj:lab-authz-bridge:repo-owner, applications, get, lab-authz-bridge/*, allow - p, proj:lab-authz-bridge:repo-owner, applications, sync, lab-authz-bridge/*, allow - p, proj:lab-authz-bridge:repo-owner, applications, update, lab-authz-bridge/*, allow groups: - admin ``` - `edit` is not a valid action for `applications` (valid: get/create/update/delete/sync/rollback/action/override) — `update` is the edit-equivalent - `lab-authz-bridge/*` matches the any-namespace object form `project/ns/app` (gobwas/glob `*` crosses `/`, verified in the match function) - Bound to the `admin` group (the repo owner's iac claim_map claim); global RBAC is deny-by-default, so users without the binding cannot see the app - This matches the established model: the argocd values comment (merged t9 work) says per-app role bindings live in AppProject resources The #9 issue body has been updated to record this correction. ## Validation - Server-side dry-run of both objects against portable: pass - Requires the #9 wiring PR (lab/clusters) for the `projects/` path to be synced into the `argocd` namespace — Argo CD v3.5.2 only watches AppProjects in the control-plane namespace ## Remaining after merge - Central allowlist PR (lab/automation): remove `lab/authz-bridge` so only the repo sensor fires - E2E: tag push → repo sensor → go-build-push → Harbor image

ginjiruu added 1 commit

2026-09-23 19:50:40 +00:00

issue-9: add lab/authz-bridge factory entry (CI Application + AppProject) 44de5ac406

- repos/lab-authz-bridge/: CI Application syncing the repo's .ci/
  into mini/ci (destination SA ci-argocd via the project's
  destinationServiceAccounts), automated prune+selfHeal, allowEmpty
  false. No app Application — authz-bridge is a system service
  deployed by Flux from deployments/kustomization/.
- projects/lab-authz-bridge.yaml: AppProject scoped to the repo
  (sourceRepos, sourceNamespaces [dev-apps-source], destination
  mini/ci) with a repo-owner project role granting get/sync/update
  on the project's applications. Argo CD v3.5.2 has no appRBAC
  field — project roles are the per-app RBAC mechanism; 'edit' is
  not a valid action, 'update' is the edit-equivalent.

Validated: server-side dry-run of both objects against portable.

ginjiruu referenced this pull request from lab/automation

2026-09-23 19:51:46 +00:00

ci (Update): remove authz-bridge from central tag-build allowlist #15

ginjiruu referenced this pull request from lab/automation

2026-09-23 19:51:52 +00:00

authz-bridge: first end-to-end (hand-written scaffold + factory entry) #9

ginjiruu closed this pull request

2026-09-23 20:09:12 +00:00