RBAC Permission to view Parameters

[niklastanner]

What are the required RBAC permissions to view the content of the parameters blade of an application?

We have an application within a project. The Project RBAC configuration looks like the following:

spec:
  roles:
    - name: app-manager
      description: Managing privileges on application level
      policies:
        - p, proj:test-project:app-manager, applications, *, test-project/*, allow
        - p, proj:test-project:app-manager, applicationsets, *, test-project/*, allow
        - p, proj:test-project:app-manager, logs, *, test-project/*, allow
        - p, proj:test-project:app-manager, exec, *, test-project/*, allow
      groups:
        - REDACTED

The permissions itself are working, as the user is able to do anything within the application, like reading logs, exec into a pod etc.
But on the Argo CD application itself on the "Parameters" blade he does not see anything.

Assigning "readonly" to the group which allows to read everything on cluster level does allow him to read the parameters within the parameters blade.

What RBAC permission is required to view the parameters, as we do not want to grant readonly to the group. Or is this not possible from the project rbac definitions and has to be done on the Argo CD RBAC CSV?

[iflan7744]

@niklastanner to allow access to the parameters without granting broader readonly access at the cluster level, you should ensure that the RBAC policy specifically allows get and list actions on the applications resource at a minimum. This would typically be defined in the Argo CD RBAC settings rather than the project-level RBAC.

p, proj:test-project:app-manager, applications, get, test-project/*, allow
p, proj:test-project:app-manager, applications, list, test-project/*, allow

This policy explicitly allows the app-manager role to perform get and list operations on applications within test-project, which should include the ability to view application parameters in the UI.

[niklastanner]

Granting the permissions you listed above does not solve the problem. The "Parameters" blade doesn't contain the actual parameters (see attached screenshot showing the empty blade).
This does not change when the RBAC-settings are set within the argocd rbac settings instead on the project scope rbac.

According to the Argo CD RBAC Documentation the action "list" does not exist.

[utsav-simplismart]

Hi, did you get a solution for this issue?

[andrii-korotkov-verkada]

Is the app itself managed by app of apps? Maybe having a limitation of permissions to specific project is the issue that's preventing seeing the params.