define argocd user policies for role:readonly

[tim-tschiersch]

Those Policies have to be defined inside the argocd helm-chart main.tf or we create a new kubectl_manifest for that policies.

Helm Chart Documentation -> https://github.com/argoproj/argo-helm/blob/main/charts/argo-cd/values.yaml
Possible Builtin-Policy -> https://github.com/argoproj/argo-cd/blob/master/assets/builtin-policy.csv
ArgoCD Documentation regarding RBAC Configuration -> https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/

• New policies have been set
• New policies have been tested inside the staging-cluster
• Branch has been merged into main
• pods can be deleted via iam user and not only admin

[tim-tschiersch]

Conclusion

We wont use the override csv for applications, because we don't like the override any application via argocd.
p, role:readonly, applications, override, */*, allow

Sync & Action activated

configs:
  rbac:
    policy.default: "role:readonly"
    policy.csv: |
      p, role:readonly, applications, sync, */*, allow
      p, role:readonly, applications, action/*, */*, allow