Multiple rbac configmap support

[v1ctorrhs]

Summary

Adding support for multiple argocd-rbac-cm-* configmaps to enable dynamic configuration of rbac permissions.

Motivation

With the introduction of the Web Terminal in UI we would really like to utilise it so our engineers can support escalations faster/easier. Kubectl is not an option, argocd web terminal is a perfect use case for this. With large organisations it's pretty common to use SSO and of course control rbac based on the user groups.

We install argocd using kustomize.yaml and we have a patchesStrategicMerge over the argocd-rbac-cm config map as the install.yaml manifest includes an empty argocd-rbac-cm config map.

So even with the patch the argocd-rbac-cm cm is pretty static. In order to add a new rbac role and group dynamically we have to play around with bash scripts and git commit inside the pipelines.

The following policy is an example of how this could be used. However that doesn't scale for tens/hundreds of applications.
Adding a new configmap on the other hand is pretty easy with helm/kustomize/terraform/...

  policy.csv: |
    p, role:escalation, applications, get, */*, allow
    p, role:escalation, clusters, get, *, allow
    p, role:escalation, repositories, get, *, allow
    p, role:escalation, logs, get, */*, allow
    p, role:escalation, exec, create, applications/environment1, allow
    
    g, admin, role:admin
    g, escalation_group, role:escalation

Proposal

Adding support for multiple csv policy files. This will enable us to create multiple policies using configmaps and mount them in the same directory.

Example

   admin_policy.csv: |    
    g, admin, role:admin

   foo_policy.csv: |    
    p, role:foo, applications, get, */*, allow
    p, role:foo, clusters, get, *, allow
    p, role:foo, repositories, get, *, allow
    p, role:foo, logs, get, */*, allow
    p, role:foo, exec, create, applications/foo, allow
    
    g, foo, role:foo

   bar_policy.csv: |    
    p, role:bar, applications, get, */*, allow
    p, role:bar, clusters, get, *, allow
    p, role:bar, repositories, get, *, allow
    p, role:bar, logs, get, */*, allow
    p, role:bar, exec, create, applications/bar, allow
    
    g, bar, role:bar

[notfromstatefarm]

@v1ctorrhs do you want to be able to specify extra ConfigMaps, or just specify extra CSVs within the existing configmap? The latter would be significantly easier.

[notfromstatefarm]

That actually wasn't as hard as I thought! Implemented in #9976

[crenshaw-dev]

Closing as a duplicate of #8324