---
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
data:
  # policy.csv holds the CSV file policy file which contains additional policy and role definitions.
  # ArgoCD defines two built-in roles:
  # * role:readonly - readonly access to all objects
  # * role:admin - admin access to all objects
  # The built-in policy can be seen under util/rbac/builtin-policy.csv
  #policy.csv: ""

  # There are two policy formats:
  # 1. Applications (which belong to a project):
  # p, <user/group>, <resource>, <action>, <project>/<object>
  # 2. All other resources:
  # p, <user/group>, <resource>, <action>, <object>

  # For example, the following rule gives all members of 'my-org:team1' the ability to sync
  # applications in the project named: my-project
  # p, my-org:team1, applications, sync, my-project/*

  # policy.default holds the default policy which will ArgoCD will fall back to, when authorizing
  # a user for API requests
  policy.default: role:readonly
