docs: Add section on how to lock down/restrict the default project #21757
Conversation
✅ Preview Environment deployed on Bunnyshell
See: Environment Details | Pipeline Logs Available commands (reply to this comment):
|
docs/user-guide/projects.md
Outdated
| sourceRepos: [] | ||
| sourceNamespaces: [] | ||
| destinations: [] | ||
| clusterResourceWhitelist: [] |
There was a problem hiding this comment.
clusterResourceWhitelist: [] is the default.
Namespaced resources are all allowed by default. To lock that down, you'd want a ,,* rule for namespaceResourceBlacklist.
There was a problem hiding this comment.
Ah, alright!
I've now added namespaceResourceBlacklist instead 👍🏻
Is clusterResourceWhitelist: [] equivalent to:
clusterResourceWhitelist:
- group: '*'
kind: '*'
?
When running argocd proj list, the first option appears as <none>, while the second one shows as */*. Are they treated the same behind the scenes? :)
There was a problem hiding this comment.
An empty cluster whitelist is equivalent to "don't allow anything," which is the default. So it's not problematic, just redundant.
There was a problem hiding this comment.
Ah, yes! Now I understand — I had flipped it in my mind.
Thanks! 😊
Signed-off-by: Dag Andersen <[email protected]>
dag-andersen
force-pushed
the
docs-restrict-default-project
branch
from
43170ca to
ce48044
Compare
Signed-off-by: Dag Andersen <[email protected]>
Motivation
This section clarifies how to lock down the default project — something that wasn’t immediately clear in the original documentation. By outlining the steps to restrict its default permissions, it helps teams maintain tighter security and safer clusters.
Related to this GitHub Issue: Restrict the default project #11058
Checklist: