Project level permission

[creeram]

I didn't find an option to grant a user access only to a specific project, and I would love to have this feature implemented in Kargo.

Current feature

  oidc:
    enabled: true
    issuerURL:
    clientID
    cliClientID:
    additionalScopes:
    - groups
    admins:
      claims: 
        email:
        - [email protected]
        - [email protected]
        groups:
        - kargo-admin
    viewers:
      claims: 
        email:
        - [email protected]
        - [email protected]
        groups:
        - kargo-viewer

**** Requested feature****

    projectadmin: // lets-say demo-project
      projectname : demo-project
        claims: 
          email:
          - [email protected]
          - [email protected]
          groups:
          - kargo-demo-project-admin
    projectreader: 
      projectname : demo-project
        claims: 
          email:
          - [email protected]
          - [email protected]
          groups:
          - kargo-demo-project-viewer

Expected: Current feature + Requested feature.

[krancour]

I'm afraid what you're looking for is not possible and it's not a Kargo limitation. It's a Kubernetes limitation.

Projects are cluster-scoped. If it helps, think of them as namespaces.

It is not possible to give permission to list only certain ones. You can list none or you can list all. As I said -- a Kubernetes limitation.

You pretty much need to grant all authenticated users list on Projects. This can be done at install time. There are options in the chart to specify claims that map to broad read-only access.

[creeram]

Is there an option to enforce a minimum number of approvers from a specified list of claims to ensure that the preprod and prod stages are only promoted after meeting the required approver count?

[krancour]

@creeram there is not. Everything is based on Kubernetes RBAC. If it's not within Kubernetes RBAC's capability, it's not something we have.

In the future, please open a separate issue when asking a question that is not in any way connected to the current thread of conversation.

[krancour]

Tentatively closing this. Please do feel free to re-open if you feel there is more to discuss here.