argocd-config: add clusterResourceWhitelist #169
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* linting: bump setup-python version * linting: bump python version to v3.13
tarrow
requested changes
Oct 18, 2024
There was a problem hiding this comment.
This is going to leave us one PR away from shipping the platform api with argo locally.
We need to add these extra allowances for the resources for the ClusterRole / ClusterRoleBinding
We also need to add the right to deploy into the monitoring namespace.
We discussed this and decided that we would maybe rather explicitly add things to the ResourceWhitelist rather than blindly adding everything
tarrow
approved these changes
Oct 18, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This fixes the permission problem described here https://phabricator.wikimedia.org/T374217#10176648
This allow list is probably overpermissive, but I think it's still better than using the default project, since this makes it explicit. In the futureTM we can decide to investigate how to scope this down in the sense of the principle of least privilege.