Container Service for Kubernetes:Create and authorize users in ACK One GitOps

Prerequisites

Before you begin, make sure you have:

• The kubeconfig file of the Fleet instance, with kubectl connected to the Fleet instance. Get it from the ACK One console.

• GitOps enabled for your ACK One Fleet instance. See Enable GitOps for the Fleet instance.

• The Argo CD administrator password to log in to the Argo CD CLI. See Access Argo CD using the Argo CD CLI.

Add a local user

1. Edit the argocd-cm ConfigMap.

   kubectl edit cm argocd-cm -n argocd

2. Add the local user under the data field. The following example adds a user named localuser1.

   data:
     accounts.localuser1: login,apiKey    # Grants UI login and API key generation
     accounts.localuser1.enabled: "true"  # Enables the user

   Each account supports two capabilities:

   • login — allows the user to log in to the Argo CD UI and the Argo CD CLI

   • apiKey — allows the user to generate authentication tokens for API access

3. Verify that the user was created.

   argocd account list

   Expected output:

   NAME        ENABLED  CAPABILITIES
   admin       true     login
   localuser1  true     login,apiKey

4. Set a password and generate a token for the user.

   # Set a password
   argocd account update-password \
     --account localuser1 \
     --current-password <admin-password> \
     --new-password <localuser1-password>
   
   # Generate an API key token
   argocd account generate-token --account localuser1
   eyJhb......

Predefined roles

Argo CD includes two built-in roles:

Custom roles with fine-grained permissions are also supported.

Policy syntax

All policies are defined in the .data.policy.csv field of argocd-rbac-cm.

Assign a permission (`p` rule):

p, <role/user/group>, <resource>, <action>, <object>

For resources within a project:

p, <role/user/group>, <resource>, <action>, <appproject>/<object>

Where:

• <role/user/group> — the entity receiving the permission (a role name, local username, or SSO group/UID)

• <resource> — the Argo CD resource type

• <action> — the operation to allow

• <object> — the specific resource instance, or * for all

Map a user or group to a role (`g` rule):

g, <user/group>, <role>

Supported resources and actions

Argo CD supports the following resources: clusters, projects, applications, applicationsets, repositories, certificates, accounts, gpgkeys, logs, exec, and extensions.

The following actions are supported: get, create, update, delete, sync, override, and action/<api-group>/<Kind>/<action-name>.

sync, override, and action/<api-group>/<Kind>/<action-name> are valid only for the applications resource.

Grant permissions to a local user

1. Edit the argocd-rbac-cm ConfigMap.

   kubectl edit cm argocd-rbac-cm -n argocd

2. Add a g rule to map the local user to a role. The following example maps localuser1 to the built-in role:admin.

   • Map localuser1 to role:admin for full access to all Argo CD resources.

   • Map localuser1 to the custom role project-admin (commented out) for access limited to specific projects and applications.

   Important

   Do not modify other existing configurations in the ConfigMap.

   data:
     policy.csv: |
   ##  p, role:project-admin, applications, *, */*, allow
   ##  p, role:project-admin, projects, *, *, allow
   
         g, "14***01", role:admin          # Keep the current setting.
         g, localuser1, role:admin         # Map localuser1 to role:admin.
   ##    g, localuser1, role:project-admin # Alternative: map to a custom role.
       scopes: '[uid]'                     # Keep the current setting.

   This example supports two scenarios:

Grant permissions to RAM users or RAM roles

By default, RAM users who are Fleet instance administrators automatically receive Argo CD admin permissions through SSO. Regular RAM users require explicit permission grants.

For a regular RAM user, grant both:

1. Argo CD RBAC permissions in argocd-rbac-cm

2. Application-level permissions through Argo CD projects

Grant Argo CD application permissions

Each Argo CD application belongs to a project. Use Argo CD projects to assign different application permissions to different RAM users or RAM roles.

Argo CD projects support the following access controls:

• Git repository limit — controls which Git repositories can be used to deploy applications

• Cluster and namespace limit — defines the clusters and namespaces where applications can be deployed

• Object type limit — restricts the Kubernetes resource types that can be deployed (for example, RBAC, Custom Resource Definitions (CRDs), DaemonSets, and NetworkPolicies)

• Application-level RBAC — grants per-application permissions to specific RAM users or RAM roles by binding project roles to OpenID Connect (OIDC) groups and JSON Web Tokens (JWTs)

To grant application permissions to a RAM user:

1. Log in to the RAM console using your Alibaba Cloud account or an administrator account. In the left navigation pane, click Users or Roles. On the details page of the target user or role, copy the UID or Role ID.

2. Log in to the ACK One console. In the left navigation pane, choose Fleet > Multi-cluster GitOps, then click GitOps Console to open the Argo CD UI.

3. In the left navigation pane of the Argo CD console, go to Settings > Projects. Click + NEW PROJECT to create a project, or open an existing project.

4. Click + ADD ROLE, fill in the following fields, and click CREATE.

   • GENERAL — configure the basic role information

   • POLICY RULES — configure the application permissions

   • GROUPS — enter the UID or Role ID copied in step 1, then click ADD GROUP

The following example shows a role named roletest that grants RAM user 27***02 read-only (get) access to all applications in the test project. After the role is created, the RAM user can click LOG IN VIA ALIYUN SSO in the ACK One console to log in to the Argo CD UI and verify that the permissions are in effect.