feat: forbid role:admin to delete resources

mikutas · Oct 9, 2024 · b5d85f6 · b5d85f6
1 parent 80d7e69
commit b5d85f6
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/apps/argo-cd/values.yaml b/apps/argo-cd/values.yaml
@@ -32,6 +32,8 @@ argo-cd:
       "applicationsetcontroller.policy": create-update
       "server.insecure": true
     rbac:
+      policy.csv: |
+        p, role:admin, applications, delete, argo-cd/*, deny
       # https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#default-policy-for-authenticated-users
       policy.default: role:admin
     styles: |