Skip to content

Commit

Permalink
chore(backport release-1.1): docs: Kargo role matrix (#3137)
Browse files Browse the repository at this point in the history 
Co-authored-by: Justin Marquis <[email protected]>
Co-authored-by: Kent Rancourt <[email protected]>
  • Loading branch information
@akuitybot @34fathombelow @krancour
3 people authored Dec 14, 2024
1 parent d79abd5 commit ed2d1a6
Showing 1 changed file with 15 additions and 0 deletions.
15 changes: 15 additions & 0 deletions docs/docs/30-how-to-guides/30-managing-user-permissions.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -273,6 +273,21 @@ kargo delete role developer --project kargo-demo
role.rbac.kargo.akuity.io/developer deleted
```

## Kargo Role Matrix

The table below outlines the maximum rules required based on the `kargo-admin` ClusterRole. When specifying verbs, it's recommended to apply the principle of least privilege, ensuring access is limited to what is necessary for the specific role.

| **API Groups** | **Resources** | **Verbs** |
|-----------------------------|------------------------------------------------|-----------------------------------------------------|
| `""` | `events`, `namespaces`, `serviceaccounts` | `get`, `list`, `watch` |
| `rbac.authorization.k8s.io` | `rolebindings`, `roles` | `get`, `list`, `watch` |
| `kargo.akuity.io` | `freights`, `projects`, `stages`, `warehouses` | `*` |
| `kargo.akuity.io` | `stages` | `promote` |
| `kargo.akuity.io` | `promotions` | `create`, `delete`, `get`, `list`, `patch`, `watch` |
| `kargo.akuity.io` | `freights/status` | `patch` |
| `argoproj.io` | `analysisruns` | `delete`, `get`, `list`, `watch` |
| `argoproj.io` | `analysistemplates` | `*` |

## Global Mappings

In cases where certain, broad sets of permissions may be required by a large
Expand Down

0 comments on commit ed2d1a6

Please sign in to comment.