From 940e919c9786d006a04719eaab925723a9ba4e94 Mon Sep 17 00:00:00 2001 From: puretension Date: Fri, 19 Sep 2025 22:29:30 +0900 Subject: [PATCH 1/2] feat(argo-cd): add custom roleRules support for application-controller Add possibility to customize Role rules for application-controller when running in namespace-scoped environments with security constraints. This follows the same pattern as the existing clusterRoleRules feature: - controller.roleRules.enabled: Enable custom rules (default: false) - controller.roleRules.rules: List of custom RBAC rules Fixes #3414 Signed-off-by: puretension --- .../templates/argocd-application-controller/role.yaml | 4 ++++ charts/argo-cd/values.yaml | 8 ++++++++ 2 files changed, 12 insertions(+) diff --git a/charts/argo-cd/templates/argocd-application-controller/role.yaml b/charts/argo-cd/templates/argocd-application-controller/role.yaml index fa3a791b2..0bdc1216d 100644 --- a/charts/argo-cd/templates/argocd-application-controller/role.yaml +++ b/charts/argo-cd/templates/argocd-application-controller/role.yaml @@ -6,6 +6,9 @@ metadata: labels: {{- include "argo-cd.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }} rules: +{{- if .Values.controller.roleRules.enabled }} + {{- toYaml .Values.controller.roleRules.rules | nindent 2 }} +{{- else }} - apiGroups: - "" resources: @@ -58,3 +61,4 @@ rules: - create - update {{- end }} +{{- end }} diff --git a/charts/argo-cd/values.yaml b/charts/argo-cd/values.yaml index 62ce4011f..59487f1ba 100644 --- a/charts/argo-cd/values.yaml +++ b/charts/argo-cd/values.yaml @@ -1140,6 +1140,14 @@ controller: # -- List of custom rules for the application controller's ClusterRole resource rules: [] + ## Enable this and set the rules: to whatever custom rules you want for the Role resource. + ## Defaults to off + roleRules: + # -- Enable custom rules for the application controller's Role resource + enabled: false + # -- List of custom rules for the application controller's Role resource + rules: [] + # Default application controller's network policy networkPolicy: # -- Default network policy rules used by application controller From 26169efb63bc358e12e3871f24fb0a9cbd505800 Mon Sep 17 00:00:00 2001 From: puretension Date: Fri, 19 Sep 2025 22:34:21 +0900 Subject: [PATCH 2/2] chore(argo-cd): bump chart version and update documentation - Bump chart version from 8.5.0 to 8.6.0 - Update changelog with roleRules feature - Regenerate README.md with helm-docs Signed-off-by: puretension --- charts/argo-cd/Chart.yaml | 6 +++--- charts/argo-cd/README.md | 2 ++ 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/charts/argo-cd/Chart.yaml b/charts/argo-cd/Chart.yaml index 27254b512..561b4edfd 100644 --- a/charts/argo-cd/Chart.yaml +++ b/charts/argo-cd/Chart.yaml @@ -3,7 +3,7 @@ appVersion: v3.1.5 kubeVersion: ">=1.25.0-0" description: A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes. name: argo-cd -version: 8.5.0 +version: 8.6.0 home: https://github.com/argoproj/argo-helm icon: https://argo-cd.readthedocs.io/en/stable/assets/logo.png sources: @@ -26,5 +26,5 @@ annotations: fingerprint: 2B8F22F57260EFA67BE1C5824B11F800CD9D2252 url: https://argoproj.github.io/argo-helm/pgp_keys.asc artifacthub.io/changes: | - - kind: changed - description: Add size limit for emptyDir in statefulset of argocd-application-controller + - kind: added + description: Add custom roleRules support for application-controller Role resource diff --git a/charts/argo-cd/README.md b/charts/argo-cd/README.md index fa15bd337..ed5fb1920 100644 --- a/charts/argo-cd/README.md +++ b/charts/argo-cd/README.md @@ -941,6 +941,8 @@ NAME: my-release | controller.replicas | int | `1` | The number of application controller pods to run. Additional replicas will cause sharding of managed clusters across number of replicas. | | controller.resources | object | `{}` | Resource limits and requests for the application controller pods | | controller.revisionHistoryLimit | int | `5` | Maximum number of controller revisions that will be maintained in StatefulSet history | +| controller.roleRules.enabled | bool | `false` | Enable custom rules for the application controller's Role resource | +| controller.roleRules.rules | list | `[]` | List of custom rules for the application controller's Role resource | | controller.runtimeClassName | string | `""` (defaults to global.runtimeClassName) | Runtime class name for the application controller | | controller.serviceAccount.annotations | object | `{}` | Annotations applied to created service account | | controller.serviceAccount.automountServiceAccountToken | bool | `true` | Automount API credentials for the Service Account |