T9: Argo CD AppProject RBAC (flux-clusters) #10

New issue

Closed

opened 2026-08-11 15:20:51 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-08-11 15:20:51 +00:00

Owner

Parent

Spec: catalog-driven app bootstrapping and capability groups (#2)

What to build

The live Argo CD RBAC (argocd-rbac-cm / AppProject policies) is wired to the capability groups, scoped per app — replacing the current g, admin, role:admin global policy (which is cluster-wide, exactly what the model eliminates). Lives in flux-clusters, parallel to the iac-repo sequence.

Acceptance criteria

per-app AppProject roles grant get/sync/update per the ADR-0007 matrix (consuming the T6 input shape)
current global g, admin, role:admin policy replaced by scoped per-app roles
root maps to project admin, nothing outside the app
validated with argocd admin settings rbac

Blocked by

T6: Argo CD AppProject roles (catalog input shape) (#8) — consumes its shape

## Parent Spec: catalog-driven app bootstrapping and capability groups (#2) ## What to build The live Argo CD RBAC (argocd-rbac-cm / AppProject policies) is wired to the capability groups, scoped per app — replacing the current `g, admin, role:admin` global policy (which is cluster-wide, exactly what the model eliminates). Lives in flux-clusters, parallel to the iac-repo sequence. ## Acceptance criteria - [ ] per-app AppProject roles grant get/sync/update per the ADR-0007 matrix (consuming the T6 input shape) - [ ] current global `g, admin, role:admin` policy replaced by scoped per-app roles - [ ] root maps to project admin, nothing outside the app - [ ] validated with `argocd admin settings rbac` ## Blocked by - T6: Argo CD AppProject roles (catalog input shape) (#8) — consumes its shape

ginjiruu added the

ready-for-agent

label

2026-08-11 15:21:00 +00:00

ginjiruu referenced this issue from a pull request that will close it,

2026-08-11 20:13:33 +00:00

T9: Argo CD AppProject RBAC (iac, single-repo) #23

ginjiruu closed this issue

2026-08-11 20:17:27 +00:00