DevOps / ArgoCD interview questions
How do you configure ArgoCD RBAC and what are the built-in roles?
ArgoCD's RBAC is configured via the argocd-rbac-cm ConfigMap in the argocd namespace. Policies are written in Casbin CSV format and map subjects (users, groups, SSO claims) to resources and actions.
Built-in Roles
| Role | Permissions |
|---|---|
role:readonly | Read-only access to all resources: applications, clusters, repositories, and logs. Cannot sync, create, update, or delete. |
role:admin | Full access to all resources and actions across all projects. |
Custom Policy Syntax
Policy lines follow: p, <subject>, <resource>, <action>, <object>, allow|deny. Group-to-role bindings use: g, <group>, <role>.
# argocd-rbac-cm data policy.default: role:readonly policy.csv: | p, role:dev-team, applications, sync, staging/*, allow p, role:dev-team, applications, sync, production/*, deny p, role:dev-team, applications, get, */*, allow g, my-org:developers, role:dev-team
Resources include: applications, clusters, repositories, projects, accounts, logs. Actions include get, create, update, delete, sync, override, action.
ArgoCD Projects add a second scoping layer — RBAC controls who can do what, while Projects control what Applications are allowed to target (repos, clusters, namespaces).
What does setting policy.default: role:readonly control in argocd-rbac-cm?
Which line correctly maps an SSO group to a custom ArgoCD role in Casbin policy format?
More Related questions...
