T9: Argo CD AppProject RBAC (iac, single-repo) #23

Merged

ginjiruu merged 2 commits from t9-argo-appproject-rbac into master

2026-08-11 20:17:26 +00:00

ginjiruu commented

2026-08-11 20:13:33 +00:00

Owner

Closes #10

What

Per-app Argo CD AppProjects managed from this repo (single-repo redesign; companion flux-clusters PR #1523 only trims the rbac-cm):

argo/ gains the argoproj-labs/argocd provider (v7.16, tested against Argo CD 3.4) and an argocd_project resource per catalog app (privatebin, syncthing), consuming the T6 input shape (module.app_roles.app_projects).
Role→group binding lives in each AppProject's roles[].groups: group-<app>-<capability> → proj:<app>:<capability> (Argo generates the g, lines from these — no rbac-cm churn per project). Root binds to the project's built-in admin role via a role named the T6 project_admin_role (admin) with p, proj:<app>:admin, *, *, <app>/*, allow and groups: [<app>-root].
ADR-0007 grants: viewer/contributor get+logs, developer +sync, maintainer +update, live-debugging exec create — all scoped to the app's own project.

Access

kanidm/scripts/kanidm-login.py — generic RFC 8693 machine login (adapted from vault-login.py): exchanges a Kanidm service-account API token for an id_token of the target OIDC client. Verified end-to-end: iac-vault-t5 (argocd_users) API token → id_token (iss/aud argocd, argocd_role: ["user"]) → argocd app list and API /api/v1/session/userinfo 200. Usable as ARGOCD_AUTH_TOKEN for the CLI, or auth_token for the provider.

Owner decisions

Global g, admin, role:admin retained for now (flux PR #1523 keeps it; iac claim_map still emits admin). The "global admin replaced" acceptance criterion stays open until the claim_map change.
g, user, role:readonly removed (deny-by-default).
The applied run needs an Argo CD token with project-write rights (claim admin) — read-only (user) is enough for validation.

Verification

tofu -chdir=argo validate passes (and task validate across roots)
scripts/validate-argocd-rbac.sh → passed: 50, failed: 0 — offline (renders local.projects via tofu console, asserts with argocd admin settings rbac), wired as task validate-argocd-rbac
kanidm-login.py machine flow verified live against the argocd client and API

Closes #10 ## What Per-app Argo CD AppProjects managed **from this repo** (single-repo redesign; companion flux-clusters PR #1523 only trims the rbac-cm): - `argo/` gains the `argoproj-labs/argocd` provider (v7.16, tested against Argo CD 3.4) and an `argocd_project` resource per catalog app (privatebin, syncthing), consuming the T6 input shape (`module.app_roles.app_projects`). - Role→group binding lives in each AppProject's `roles[].groups`: `group-<app>-<capability>` → `proj:<app>:<capability>` (Argo generates the `g,` lines from these — no rbac-cm churn per project). Root binds to the project's built-in admin role via a role named the T6 `project_admin_role` (`admin`) with `p, proj:<app>:admin, *, *, <app>/*, allow` and `groups: [<app>-root]`. - ADR-0007 grants: viewer/contributor get+logs, developer +sync, maintainer +update, live-debugging exec create — all scoped to the app's own project. ## Access - `kanidm/scripts/kanidm-login.py` — generic RFC 8693 machine login (adapted from vault-login.py): exchanges a Kanidm service-account API token for an id_token of the target OIDC client. Verified end-to-end: `iac-vault-t5` (argocd_users) API token → id_token (iss/aud `argocd`, `argocd_role: ["user"]`) → `argocd app list` and API `/api/v1/session/userinfo` 200. Usable as `ARGOCD_AUTH_TOKEN` for the CLI, or `auth_token` for the provider. ## Owner decisions - Global `g, admin, role:admin` retained for now (flux PR #1523 keeps it; iac claim_map still emits `admin`). The "global admin replaced" acceptance criterion stays open until the claim_map change. - `g, user, role:readonly` removed (deny-by-default). - The applied run needs an Argo CD token with project-write rights (claim `admin`) — read-only (`user`) is enough for validation. ## Verification - `tofu -chdir=argo validate` passes (and `task validate` across roots) - `scripts/validate-argocd-rbac.sh` → `passed: 50, failed: 0` — offline (renders `local.projects` via `tofu console`, asserts with `argocd admin settings rbac`), wired as `task validate-argocd-rbac` - `kanidm-login.py` machine flow verified live against the argocd client and API

ginjiruu added 1 commit

2026-08-11 20:13:33 +00:00

T9: per-app Argo CD AppProjects via argoproj-labs/argocd provider (single-repo redesign) b9896cf82a

Live Argo CD RBAC lands here instead of flux-clusters: argocd_project per
catalog app consuming the T6 shape. Roles bind capability groups via
roles[].groups (group-<app>-<capability> -> proj:<app>:<capability>); root
binds to the project's built-in admin role. No rbac-cm churn per project.

Adds kanidm-login.py (generic RFC 8693 machine login adapted from
vault-login.py) so a Kanidm service-account API token yields an id_token for
the argocd client (provider/CLI auth), and scripts/validate-argocd-rbac.sh
asserting the ADR-0007 matrix offline from the terraform-rendered shape
(50 checks, no Argo CD API token needed).

ginjiruu added 1 commit

2026-08-11 20:16:22 +00:00

T9: document argo root and Argo CD access in README 9d0f06d25d

ginjiruu merged commit 756ade5c75 into master

2026-08-11 20:17:26 +00:00

ginjiruu referenced this pull request from a commit

2026-08-11 20:17:27 +00:00

Merge pull request 'T9: Argo CD AppProject RBAC (iac, single-repo)' (#23) from t9-argo-appproject-rbac into master