argoproj / argoproj/argo-workflows
Fine-grained RBAC for Argo Server
- Dominant language
- Go
- Stars
- 17k
- Forks
- 3.7k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 138
Description
# Summary
The current model of RBAC leans heavily on Kubernetes RBAC, so is easy to make secure, but may not scale well.
Consider the situation where you have 1000s teams and 1000s namespace. At the very least you may need a OIDC group for each namespace, and then a service account, role and role binding.
It maybe better to use Casbin (or similar) to provide a more flexible way to configure this.
# Use Cases
When would you use this?
---
**Message from the maintainers**:
Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.
Contributor guide
Research direction
No files, tests, or entry points are named in the issue. Start by reviewing Argo Server's current Kubernetes RBAC model and the unresolved discussion about Casbin or a similar policy system; done requires agreed use cases and a defined fine-grained RBAC design.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- authorization, backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100