SupportConsoleDevelopersStart a trialContact

Chapter 1. Configuring Argo CD RBAC

By default, any type of user, except the kube:admin user, logged into the default Argo CD instance does not have access to any services. However, a user logged into a custom Argo CD instance is a read-only user by default.

Note

In Red Hat OpenShift GitOps v1.9.0 or earlier versions, any type of user, except the kube:admin user, logged into Argo CD using Red Hat SSO (RH SSO) is a read-only user by default.

1.1. Configuring user level access
Copy link

To manage and change the user level access, configure the role-based access control (RBAC) section in the Argo CD custom resource (CR).

Procedure

  1. Edit the argocd CR: 

    $ oc edit argocd <argocd-instance-name> -n <namespace>

    Example Output: 

    metadata
...
...
  rbac:
    policy: 'g, rbacsystem:cluster-admins, role:admin'
    scopes: '[groups]'

  2. Add the policy configuration to the rbac section and add the name and the required role to be applied to the user: 

    metadata
...
...
rbac:
    policy: g, <name>, role:<role>
    scopes: '[groups]'
    Note

    Currently, Red Hat SSO (RH SSO) cannot read the group information of the Red Hat OpenShift GitOps users. Therefore, configure the RBAC at the user level.

Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top