lab/iac
1
0
Fork 0
Code Issues 11 Pull requests 3 Projects Releases Packages Wiki Activity Actions

T6: Argo CD AppProject roles (catalog input shape) #22

Merged
ginjiruu merged 1 commit from t6-argo-app-project-roles into master 2026-08-11 19:11:20 +00:00
Conversation 0 Commits 1 Files changed 5 +85 -1
ginjiruu commented 2026-08-11 19:05:59 +00:00
Owner
Copy link

Closes #8

What

New argo/ root: a data-only module (argo/modules/app_roles) that turns
apps/catalog.yaml into the per-app Argo CD AppProject-role input shape per
ADR-0007. No providers, no credentials — pure locals + outputs, so
tofu validate/plan run with zero access keys.

The shape exposes, per app:

  • roles.<capability> — grants as (resource, action, object) triples ready
    for policy lines p, proj:<app>:<role>, <resource>, <action>, <app>/*, allow:
    viewer/contributor applications get + logs get, developer +sync,
    maintainer +sync+update, live-debugging exec create.
  • project_admin_role = "admin" — root binds to Argo's built-in project-admin
    role.

Capabilities with no Argo grant (secret-managers, k8s-secret-viewer) are
intentionally absent. Live RBAC consumption lands in T9 (flux-clusters).

Also adds argo to the Taskfile validate loop so the new root is covered by
task validate.

Verification

  • tofu validate passes in argo/ (and task validate across all five roots)
  • tofu plan -refresh=false renders both pilot apps (privatebin, syncthing)
    with the full ADR-0007 grant set
Closes #8 ## What New `argo/` root: a data-only module (`argo/modules/app_roles`) that turns `apps/catalog.yaml` into the per-app Argo CD AppProject-role input shape per ADR-0007. No providers, no credentials — pure locals + outputs, so `tofu validate`/`plan` run with zero access keys. The shape exposes, per app: - `roles.<capability>` — grants as `(resource, action, object)` triples ready for policy lines `p, proj:<app>:<role>, <resource>, <action>, <app>/*, allow`: viewer/contributor `applications get` + `logs get`, developer `+sync`, maintainer `+sync+update`, live-debugging `exec create`. - `project_admin_role = "admin"` — root binds to Argo's built-in project-admin role. Capabilities with no Argo grant (secret-managers, k8s-secret-viewer) are intentionally absent. Live RBAC consumption lands in T9 (flux-clusters). Also adds `argo` to the Taskfile validate loop so the new root is covered by `task validate`. ## Verification - `tofu validate` passes in `argo/` (and `task validate` across all five roots) - `tofu plan -refresh=false` renders both pilot apps (privatebin, syncthing) with the full ADR-0007 grant set
ginjiruu merged commit 80945fa399 into master 2026-08-11 19:11:20 +00:00
ginjiruu deleted branch t6-argo-app-project-roles 2026-08-11 19:11:22 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
needs-info
Waiting on reporter for more information

  
needs-triage
Maintainer needs to evaluate this issue

  
ready-for-agent
Fully specified, ready for an AFK agent

  
ready-for-human
Requires human implementation

  
wontfix
Will not be actioned

No labels
needs-info
needs-triage
ready-for-agent
ready-for-human
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
lab/iac!22
No description provided.