feat: RBAC support for external argo/flux apps by vivekanandan-devtron · Pull Request #7014 · devtron-labs/devtron

vivekanandan-devtron · 2026-08-25T16:50:29Z

Description

Fixes #7007

Checklist:

The title of the PR states what changed and the related issues number (used for the release note).
Does this PR requires documentation updates?
I've updated documentation as required by this PR.
I have performed a self-review of my own code.
I have commented my code, particularly in hard-to-understand areas.
I have tested it for all user roles.
I have added all the required unit/api test cases.

Does this PR introduce a user-facing change?

- add migration files - append flags in the /orchestrator/user/check/roles API to show/hide argo/flux tabs

- earlier filter was only applied with the cluster ID - add changes to filter based on cluster ID's and namespaces

github-actions · 2026-08-25T16:50:50Z

Some linked issues are invalid. Please update the issue links:\nIssue # in is not found or invalid (HTTP }404).\n

bito-code-review · 2026-08-25T16:50:55Z

Bito Automatic Review Skipped - Draft PR

Bito didn't auto-review because this pull request is in draft status.
No action is needed if you didn't intend for the agent to review it. Otherwise, to manually trigger a review, type /review in a comment and save.
You can change draft PR review settings here, or contact your Bito workspace admin at shivam@devtron.ai.

Shivam-nagar23 · 2026-09-01T04:27:41Z

+			continue
+		}
+
+		if resourceActionFragment[0] == "argo-app" && (resourceActionFragment[1] == "admin" || resourceActionFragment[1] == "view") {


use const, this logic should be abstracted out

Abstracted the logic using a map

Used the existing consts available

Shivam-nagar23 · 2026-09-01T04:31:34Z

 	} else if resourceRequestBean.ExternalArgoApplicationName != "" {
 		// RBAC enforcer applying For external Argo app
-		if ok := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionUpdate, "*"); !ok {
+		if request.ExternalArgoAppIdentifier == nil {


resourceRequestBean susing this right?

Previously the ExternalArgoAppIdentifier was only available in the request, now the field is populated in the resourceRequestBean and code has been changed to refer resourceRequestBean

Shivam-nagar23 · 2026-09-01T08:17:42Z

@@ -0,0 +1,2 @@
+DELETE FROM "public"."rbac_policy_data" WHERE entity='apps' AND access_type IN ('argo-app','flux-app');
+DELETE FROM "public"."rbac_role_data"   WHERE entity='apps' AND access_type IN ('argo-app','flux-app');


update migration number with latest

The previous number in the OSS is 36204600, The current migration number is 36304600. I think this is the latest, can you please confirm this once?

Changed the migration number to maintain sync with enterprise

Shivam-nagar23 · 2026-09-01T08:26:46Z

+			"clusterName", clusterName, "namespace", namespace, "appName", appName)
+		return ""
+	}
+	return fmt.Sprintf("%s__%s/%s", clusterName, namespace, appName)


why double underscore?

Even for external helm apps, the environment combination is clusterName__namespace. The same has been followed to maintain consistency

Shivam-nagar23 · 2026-09-01T08:37:03Z

+		//where the scope is environment(cluster__namespace) + app
+		query := "SELECT role.* FROM roles role WHERE coalesce(role.team,'') = ? AND role.entity_name=? AND role.environment=? AND role.action=?"
+		queryParams = append(queryParams, EMPTY_PLACEHOLDER_FOR_QUERY, app, env, act)
+		if oldValues {


old values handling should be removed here as these are new roles

Shivam-nagar23 · 2026-09-01T08:38:21Z

+		var queryParams []interface{}
+		//this is applicable for entities that have no project, e.g. external argo/flux apps,
+		//where the scope is environment(cluster__namespace) + app
+		query := "SELECT role.* FROM roles role WHERE coalesce(role.team,'') = ? AND role.entity_name=? AND role.environment=? AND role.action=?"


we should have specific queries for ago and flux entity type , should not be clubbed with other entity, as they are defined and specific

Shivam-nagar23 · 2026-09-01T08:41:12Z

+func (impl *FluxApplicationServiceImpl) GetFluxApplicationList(ctx context.Context, clusterIds []int) ([]bean.FluxApplication, error) {
 	appStream, err := impl.listApplications(ctx, clusterIds)
 	if err != nil {


why this logical change

This flux app list is used in both user permission dropdown and also flux app listing, In the former you would need to list all the apps and the later only apps the user has access to.

The previous method combined too many logics like listing, RBAC, streaming/no-streaming etc. I have split the function into two to be used in two different places

Shivam-nagar23 · 2026-09-01T08:42:17Z

 			if _, ok := fluxInstalledApps[key][deployedApp.Name]; ok {
 				continue
 			}
+			if fluxAuth != nil && !fluxAuth(token, deployedApp.EnvironmentDetail.ClusterName,


Resp Transformers should be independent of auth check, auth check are different part after transformers

This same pattern in being for external helm app listing, used the same to maintain consistency

Shivam-nagar23 · 2026-09-01T08:44:04Z

 	getUserResourceKindWithEntityAccessKey(bean.ClusterApiResources, bean.Alpha1Version, bean2.CLUSTER_ENTITIY, bean2.EmptyAccessType):  (*UserResourceServiceImpl).enforceRbacForClusterApiResource,
 	getUserResourceKindWithEntityAccessKey(bean.ClusterNamespaces, bean.Alpha1Version, bean2.CLUSTER_ENTITIY, bean2.EmptyAccessType):    (*UserResourceServiceImpl).enforceRbacForClusterNamespaces,
 	getUserResourceKindWithEntityAccessKey(bean.ClusterResources, bean.Alpha1Version, bean2.CLUSTER_ENTITIY, bean2.EmptyAccessType):     (*UserResourceServiceImpl).enforceRbacForClusterResourceList,
+	getUserResourceKindWithEntityAccessKey(bean.KindArgoEnvironment, bean.Alpha1Version, bean2.ENTITY_APPS, bean2.APP_ACCESS_TYPE_ARGO): (*UserResourceServiceImpl).enforceRbacForEnvForHelmApp,


helm app enforcement here in case of argo and flux

The function is same for helm, argo and flux. Renamed the function to avoid confusion

Shivam-nagar23 · 2026-09-01T08:44:16Z

 	getUserResourceKindWithEntityAccessKey(bean.KindChartGroup, bean.Alpha1Version, bean2.CHART_GROUP_ENTITY, bean2.EmptyAccessType):    (*UserResourceExtendedServiceImpl).enforceRbacForChartGroup,
 	getUserResourceKindWithEntityAccessKey(bean.KindJobs, bean.Alpha1Version, bean2.EntityJobs, bean2.EmptyAccessType):                  (*UserResourceExtendedServiceImpl).enforceRbacForJobs,
 	getUserResourceKindWithEntityAccessKey(bean.KindWorkflow, bean.Alpha1Version, bean2.EntityJobs, bean2.EmptyAccessType):              (*UserResourceExtendedServiceImpl).enforceRbacForJobsWfs,
+	getUserResourceKindWithEntityAccessKey(bean.KindArgoEnvironment, bean.Alpha1Version, bean2.ENTITY_APPS, bean2.APP_ACCESS_TYPE_ARGO): (*UserResourceExtendedServiceImpl).enforceRbacForEnvForHelmApp,


same, recheck

The function is same for helm, argo and flux. Renamed the function to avoid confusion

Shivam-nagar23 · 2026-09-01T08:46:05Z

+	clusterRepository repository.ClusterRepository) *EnforcerUtilGitOpsImpl {
+	return &EnforcerUtilGitOpsImpl{
+		logger:            logger,
+		clusterRepository: clusterRepository,


cluster read service, not repo dep

Changed to cluster read service

…argo-flux-rbac-7007

sonarqubecloud · 2026-09-07T12:31:45Z

Quality Gate passed

Issues
18 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

vivekanandan-devtron added 8 commits August 14, 2026 17:47

chore: create a makefile to setup and clean resources for development

bc8f92a

feat: add flag for frontend to show argo/flux tabs

0ce58e4

- add migration files - append flags in the /orchestrator/user/check/roles API to show/hide argo/flux tabs

feat: changes for dropdown API in user permissions page

0acc4f7

fix: missing dependencies in constructor method

fb2114f

fix: improper filtering logic

eae78a5

- earlier filter was only applied with the cluster ID - add changes to filter based on cluster ID's and namespaces

fix: prevent connecting to kubelink for failed clusters

950493b

wip: policy enforcements

85100ab

wip: policy enforcements

f7ac9a7

github-actions Bot added the PR:Issue-verification-failed label Aug 25, 2026

github-actions Bot added PR:Ready-to-Review and removed PR:Issue-verification-failed labels Aug 25, 2026

chore: remove test folder

4d210f4

vivekanandan-devtron marked this pull request as ready for review August 31, 2026 05:51

vivekanandan-devtron requested review from prakarsh-dt and vivek-devtron as code owners August 31, 2026 05:51

vivekanandan-devtron requested a review from Shivam-nagar23 August 31, 2026 05:51

Shivam-nagar23 reviewed Sep 1, 2026

View reviewed changes

Shivam-nagar23 requested changes Sep 1, 2026

View reviewed changes

vivekanandan-devtron added 2 commits September 2, 2026 13:09

Merge branch 'main' of github-devtron:devtron-labs/devtron into feat/…

63f95f3

…argo-flux-rbac-7007

fix: code review fixes

9897e34

vivekanandan-devtron requested a review from Shivam-nagar23 September 2, 2026 12:03

vivekanandan-devtron added 7 commits September 2, 2026 18:11

fix: code review fixes

ee628e5

fix: code review fixes

698b9df

chore: rename migration scripts to maintain sync with enterprise

0a6e777

Merge branch 'main' of github-devtron:devtron-labs/devtron into feat/…

1e79e4b

…argo-flux-rbac-7007

chore: change migration script number

992cbf3

fix: roles missing while fetching user roles

386edbd

fix: deleted roles being listed

0c309cd

fix: deleted roles being listed

f7a54e3

		@@ -0,0 +1,2 @@
		DELETE FROM "public"."rbac_policy_data" WHERE entity='apps' AND access_type IN ('argo-app','flux-app');
		DELETE FROM "public"."rbac_role_data" WHERE entity='apps' AND access_type IN ('argo-app','flux-app');

Uh oh!

Conversation

vivekanandan-devtron commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist:

Does this PR introduce a user-facing change?

Uh oh!

github-actions Bot commented Aug 25, 2026

Uh oh!

bito-code-review Bot commented Aug 25, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Sep 7, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vivekanandan-devtron commented Aug 25, 2026 •

edited

Loading