lab/iac
1
0
Fork 0
Code Issues 11 Pull requests 3 Projects Releases Packages Wiki Activity Actions

T6: Argo CD AppProject roles (catalog input shape) #8

New issue
Closed
opened 2026-08-11 15:20:44 +00:00 by ginjiruu · 0 comments
ginjiruu commented 2026-08-11 15:20:44 +00:00
Owner
Copy link

Parent

Spec: catalog-driven app bootstrapping and capability groups (#2)

What to build

The catalog drives a per-app Argo AppProject-role input shape (get/sync/update/project-admin per ADR-0007) as a stub in the iac repo — the shape T9 (flux-clusters live RBAC) consumes. So the iac repo declares how each capability maps to Argo roles, even though the live AppProject RBAC lands in flux-clusters.

Acceptance criteria

  • catalog → AppProject-role mapping declared per ADR-0007 (viewer get+logs; contributor get+logs; developer get+sync; maintainer get+sync+update; root project admin)
  • module/root exposes the mapping as an input shape for T9
  • tofu validate passes

Blocked by

  • T1: Fix provider resolution + catalog schema (prefactor) (#3)
## Parent Spec: catalog-driven app bootstrapping and capability groups (#2) ## What to build The catalog drives a per-app Argo AppProject-role input shape (get/sync/update/project-admin per ADR-0007) as a stub in the iac repo — the shape T9 (flux-clusters live RBAC) consumes. So the iac repo declares how each capability maps to Argo roles, even though the live AppProject RBAC lands in flux-clusters. ## Acceptance criteria - [ ] catalog → AppProject-role mapping declared per ADR-0007 (viewer get+logs; contributor get+logs; developer get+sync; maintainer get+sync+update; root project admin) - [ ] module/root exposes the mapping as an input shape for T9 - [ ] `tofu validate` passes ## Blocked by - T1: Fix provider resolution + catalog schema (prefactor) (#3)
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
renovate/configure
t15-multicluster-catalog
t14-vault-k8s-auth
No results found.
Labels
Clear labels   
needs-info
Waiting on reporter for more information

  
needs-triage
Maintainer needs to evaluate this issue

  
ready-for-agent
Fully specified, ready for an AFK agent

  
ready-for-human
Requires human implementation

  
wontfix
Will not be actioned

No labels
needs-info
needs-triage
ready-for-agent
ready-for-human
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
lab/iac#8
No description provided.