CNF-16428: gitops: Reduce ArgoCD ClusterRole with minimal privilege by leo8a · Pull Request #111 · openshift-kni/telco-reference

leo8a · 2025-02-19T08:50:01Z

The current cluster-admin ClusterRole assigned to ArgoCD in Hub clusters grants excessive permissions that are not necessary for its intended functionality. By adopting a minimal privilege ClusterRole, we align with the Principle of Least Privilege, reducing the attack surface and limiting access to only the required resources. This minimizes the potential for accidental misuse, privilege escalation, or unauthorized access in the event of a compromise.

/cc @imiller0 @yuvalk @sabbir-47

openshift-ci-robot · 2025-02-19T08:50:06Z

@leo8a: This pull request references CNF-16428 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set.

Details

In response to this:

The current cluster-admin ClusterRole assigned to ArgoCD in Hub clusters grants excessive permissions that are not necessary for its intended functionality. By adopting a minimal privilege ClusterRole, we align with the Principle of Least Privilege, reducing the attack surface and limiting access to only the required resources. This minimizes the potential for accidental misuse, privilege escalation, or unauthorized access in the event of a compromise.

/cc @imiller0 @yuvalk @sabbir-47

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

leo8a · 2025-02-25T00:14:12Z

/hold

doing some more testing

leo8a · 2025-02-25T16:53:57Z

/unhold

Ready for review

imiller0 · 2025-04-18T21:59:00Z

These get copied over from the telco-ran reference. We should update them there at the same time so that a future sync between the two doesn't overwrite these.
cc: @jgato

irinamihai · 2025-07-02T23:31:46Z

...configuration/reference-crs/required/gitops/ztp-installation/gitops-cluster-clusterrole.yaml

+  labels:
+    rbac.authorization.k8s.io/aggregate-to-ocm-cluster-manager-admin: "true"
+rules:
+- apiGroups:


Shouldn't we also grant permission to Secrets and ConfigMaps at least?
Also, I'm wondering why list, get, watch were not included for the ClusterInstance. 🤔

@leo8a , tagging just for attention.

hey Irina, thanks for your ping

Shouldn't we also grant permission to Secrets and ConfigMaps at least?

IIRC those resources are accessed using the openshift-gitops-openshift-gitops-argocd-application-controller ClusterRole (installed by default as part of the ArgoCD operator)

Also, I'm wondering why list, get, watch were not included for the ClusterInstance. 🤔

I'll add those verbs also to the list

/hold

In any case, I'm holding this PR for now, I want to run a couple of new tests, given that it has been a while since I validated this.

Coming back to your questions:

Shouldn't we also grant permission to Secrets and ConfigMaps at least?
Also, I'm wondering why list, get, watch were not included for the ClusterInstance. 🤔

The ClusterRole/openshift-gitops-openshift-gitops-argocd-application-controller (installed by default with Argo CD) already grants full ([*]) access to configmaps:

configmaps [] [] [*]

It also includes a wildcard rule:

*.* [] [] [get list watch]

This provides read-only access (get, list, watch) to any resource in any API group—including custom resources like ClusterInstance. So technically, explicit permissions for ClusterInstance aren't required in this case. However, I'm happy to add them explicitly if that helps make the access rules clearer or easier to audit.

On the other hand, access to secrets is not included in the Argo CD ClusterRole above, but it is granted via the ClusterRole/open-cluster-management:cluster-manager-admin (installed by default with ACM):

-> oc describe ClusterRole/open-cluster-management:cluster-manager-admin | grep secrets secrets [] [] [create get list watch update delete deletecollection patch]

@irinamihai please review.

Thanks, @leo8a. I think a comment would also be helpful, to clear things up a bit since the permissions are spread out between multiple ClusterRoles.

done, I've added comments explaining how the permissions are spread out between multiple ClusterRoles... hopefully helpful for folks in the future.

That's great, @leo8a. Given that this is a reference configuration, having as much information as possible is extremely valuable. Thank you!

leo8a · 2025-07-10T18:19:49Z

/unhold

PTAL

.../configuration/reference-crs/required/gitops/ztp-installation/gitops-policy-rolebinding.yaml

telco-ran/configuration/argocd/deployment/gitops-policy-rolebinding.yaml

irinamihai · 2025-07-11T14:09:03Z

Just 2 minor comments.
LGTM otherwise.

irinamihai · 2025-07-14T17:08:18Z

/hold
Let's wait for a review from the gitops folks before merging this.
Thank you.

gnunn1 · 2025-07-14T17:26:34Z

@irinamihai asked me to have a look at this. Argo CD will typically require view all permissions on the cluster but I do not see it being changed here. Any plans to reduce those permissions and couple that change with either resourceExclusion or the auto respect RBAC feature in Argo CD?

leo8a · 2025-07-15T10:13:56Z

Hey @gnunn1, thanks for taking a look.

Argo CD will typically require view all permissions on the cluster but I do not see it being changed here. Any plans to reduce those permissions and couple that change with either resourceExclusion or the auto respect RBAC feature in Argo CD?

Not in the scope of this PR. We are just targeting to reduce the permissions granted during the Initial Phase of the GitOps ZTP workflow for Telco (see cluster and gitops ClusterRoleBindings currently assigned).

That said, I agree that tightening Argo CD’s access (possibly in conjunction with resourceExclusions or auto-reconcile RBAC features) would be a worthwhile improvement. However, it would require a broader effort—including reducing the permissions granted to other components like ACM, which currently uses the ClusterRole/open-cluster-management:cluster-manager-admin (which is even more permissive than Argo CD’s defaults), or any other dependency component of this workflow.

leo8a · 2025-07-15T10:16:05Z

/rebasing due to conflicts merged to main

irinamihai · 2025-07-15T18:06:08Z

/unhold
/lgtm

The current cluster-admin ClusterRole assigned to ArgoCD in Hub clusters grants excessive permissions that are not necessary for its intended functionality. By adopting a minimal privilege ClusterRole, we align with the Principle of Least Privilege, reducing the attack surface and limiting access to only the required resources. This minimizes the potential for accidental misuse, privilege escalation, or unauthorized access in the event of a compromise. Signed-off-by: Leonardo Ochoa-Aday <lochoa@redhat.com>

Since this dir is the canonical source for files in telco-hub ztp-installation, I'm copying the files also here. Signed-off-by: Leonardo Ochoa-Aday <lochoa@redhat.com>

…ct filename - Change "ZTP Role Bindings:" to "ZTP Roles and Bindings:" in SYNC-WAVES.md - Update file reference from gitops-cluster-rolebinding.yaml to gitops-cluster-clusterrole.yaml - Update compare_ignore to match the corrected filename This ensures documentation accurately reflects the actual ClusterRole resource rather than a ClusterRoleBinding. Signed-off-by: Leonardo Ochoa-Aday <lochoa@redhat.com>

openshift-ci · 2025-10-21T10:31:34Z

New changes are detected. LGTM label has been removed.

openshift-ci · 2025-10-21T10:31:39Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: leo8a
Once this PR has been reviewed and has the lgtm label, please ask for approval from irinamihai. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

leo8a · 2025-10-21T10:36:15Z

hey there, so many changes in both (telco-hub and telco-ran) since this was last reviewed, had to rebase to pick up the new changes and adjust the proposed ones.

@irinamihai @sabbir-47 @imiller0 @lack PTAL

openshift-ci bot requested review from imiller0, sabbir-47 and yuvalk February 19, 2025 08:50

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 25, 2025

leo8a force-pushed the gitops-minimal-clusterrole branch from a761dcf to 7b5dffe Compare February 25, 2025 16:52

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 25, 2025

lack mentioned this pull request Jun 24, 2025

telco-hub: add first set of reference templates for the cluster-compare tool #110

Merged

irinamihai reviewed Jul 2, 2025

View reviewed changes

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 3, 2025

leo8a force-pushed the gitops-minimal-clusterrole branch 2 times, most recently from ccd540c to 5b63da2 Compare July 8, 2025 12:54

This was referenced Jul 8, 2025

chore(deps): update konflux references #244

Merged

Update Konflux references #231

Merged

leo8a force-pushed the gitops-minimal-clusterrole branch 2 times, most recently from 14b3e02 to 2b853cb Compare July 10, 2025 08:03

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 10, 2025

leo8a force-pushed the gitops-minimal-clusterrole branch from 2b853cb to 992997c Compare July 11, 2025 08:37

irinamihai reviewed Jul 11, 2025

View reviewed changes

.../configuration/reference-crs/required/gitops/ztp-installation/gitops-policy-rolebinding.yaml Outdated Show resolved Hide resolved

irinamihai reviewed Jul 11, 2025

View reviewed changes

telco-ran/configuration/argocd/deployment/gitops-policy-rolebinding.yaml Outdated Show resolved Hide resolved

leo8a force-pushed the gitops-minimal-clusterrole branch from 992997c to 937854b Compare July 11, 2025 14:48

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 14, 2025

leo8a force-pushed the gitops-minimal-clusterrole branch from 937854b to cead88e Compare July 15, 2025 10:16

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 15, 2025

openshift-ci bot assigned irinamihai Jul 15, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jul 15, 2025

leo8a added 3 commits October 21, 2025 12:06

telco-ran: Reduce ArgoCD ClusterRole with minimal privilege

f5ba183

Since this dir is the canonical source for files in telco-hub ztp-installation, I'm copying the files also here. Signed-off-by: Leonardo Ochoa-Aday <lochoa@redhat.com>

leo8a force-pushed the gitops-minimal-clusterrole branch from cead88e to f1acbae Compare October 21, 2025 10:31

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 21, 2025

Comments

Conversation

leo8a commented Feb 19, 2025

Uh oh!

openshift-ci-robot commented Feb 19, 2025

Uh oh!

leo8a commented Feb 25, 2025

Uh oh!

leo8a commented Feb 25, 2025

Uh oh!

imiller0 commented Apr 18, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

leo8a commented Jul 10, 2025

Uh oh!

Uh oh!

Uh oh!

irinamihai commented Jul 11, 2025

Uh oh!

irinamihai commented Jul 14, 2025

Uh oh!

gnunn1 commented Jul 14, 2025

Uh oh!

leo8a commented Jul 15, 2025

Uh oh!

leo8a commented Jul 15, 2025

Uh oh!

irinamihai commented Jul 15, 2025

Uh oh!

openshift-ci bot commented Oct 21, 2025

Uh oh!

openshift-ci bot commented Oct 21, 2025

Uh oh!

leo8a commented Oct 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants