Open maxtacu opened 4 years ago
Hey guys, any updates on this?
You need ,
between the email and the role
g, maxim.tacu@example.com, role:admin
I know what is missing. The problem is that argocd shouldn't crash when there is an invalid policy. Argocd should switch to some default restricting policy (for example with admin only access)
I'm not entirely opposed to crashing on a default config. For example, if the desired RBAC is more restrictive than the built-in policy, I wouldn't want to fall back to the less-restrictive built-in policy.
But there should be clear docs and maybe a nicer error message.
Checklist:
argocd version
.Describe the bug
ArgoCD is crashing when a broken csv policy is applied. If ArgoCD is configured to track itself from the git, then the fix of the policy will not be applied because
argocd-server
crashed and not receiving any updates. Only manualkubectl apply
will help to recover argocd-server.To Reproduce apply the argocd-rbac-cm ConfigMap with a broken policy.csv For Example:
A comma is missing after the email in the example above!
Expected behavior A policy csv syntax checker would be NICE TO HAVE in argocd before applying it. In case if a broken policy is pushed, the best way would be to discard policies to
none
orreadonly
for everyone until a new fix will be released/pushed to the repo which is tracked by argocd and applied by itself without any manual intervention.Version Currently we just upgraded to the latest one, but all versions are affected.
Logs Argocd-server crash logs: