argoproj / argoproj/argo-cd

Readonly user error: Unable to delete resource: permission denied: applications, delete, ...

Open
#4,191 2 comments 2 reactions 0 assignees View on GitHub
component:ui enhancement
Dominant language
Go
Stars
24.2k
Forks
7.9k
Avg merge
1d 6h
Merged PRs (30d)
239

Description

Checklist:

* [x] I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
* [x] I've included steps to reproduce the bug.
* [x] I've pasted the output of `argocd version`.

**Describe the bug**

ArgoCD supports a `readonly` role:
https://github.com/argoproj/argo-cd/blob/be718e2b6186294e2a84d7cd4789f096e44fc545/assets/builtin-policy.csv#L1

Users with this role shouldn't be encouraged to try to delete objects.

**To Reproduce**

1. Add a `g, user, role:readonly`
1. Log in as that user
1. Browse to a resource
1. Click delete or ⋮, delete
1. Confirm

**Expected behavior**

To the extent possible, if argocd knows a user can't delete resources, the option to delete the resources should be either not shown or not be enabled.

**Screenshots**

![image](https://user-images.githubusercontent.com/2119212/91503958-d4706f00-e899-11ea-8cde-cd34978c19dc.png)

**Version**

v1.6.1+159674e

**Logs**

Contributor guide

Open the contributing guide

Research direction

Start with the referenced assets/builtin-policy.csv and the resource browser's Delete or ⋮ action described in the reproduction steps. Reproduce the workflow as a user with role:readonly, then trace where the permission-denied response is surfaced. Done means the delete option is hidden or disabled whenever Argo CD knows the user cannot delete the resource.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes
Domain
authorization, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.