RBAC Role example

[newb1e]

Hi,
I would like to configure separate groups in Okta and connect it via SSO RBAC with Workflows. So far so good.
Each group should have different permissions, each group should see and run only the workflows that they are responsible for.

Can someone share more examples to which Roles I should create. For example, read/write to WF resources by specific namespace/label etc.

Thanks.

[wesleyscholl]

@newb1e

This Argo Workflows Resources and Permissions Table I created for #10404, it should help with RBAC specific permissions to resources.

Argo Workflows Resources and Permissions Table (RBAC)

Resource	API Group	Verbs	Description
Workflow	argoproj.io	get, list, watch, create, delete, update, patch	Manage workflows, including creating, updating, and deleting workflows.
WorkflowTemplate	argoproj.io	get, list, watch, create, delete	Manage reusable workflow templates.
ClusterWorkflowTemplate	argoproj.io	get, list, watch, create, delete	Manage workflow templates at the cluster level.
CronWorkflow	argoproj.io	get, list, watch, create, delete, update	Manage scheduled workflows.
Pod	core	get, list, watch, create, delete	Manage workflow-related pods.
Service	core	get, list, watch, create, delete	Manage Kubernetes services related to workflows.
ConfigMap	core	get, list, watch, create, delete, update	Manage workflow configurations.
Secret	core	get, create, update, delete	Access sensitive information used in workflows.
Event	core	get, list, watch, create, delete	Track workflow events.
PersistentVolumeClaim	core	get, list, watch, create, delete	Manage storage volumes used in workflows.
Role	rbac.authorization.k8s.io	get, create, update, delete, bind	Manage role-based access control.
RoleBinding	rbac.authorization.k8s.io	get, create, update, delete, bind	Bind roles to users or groups.
ClusterRole	rbac.authorization.k8s.io	get, create, update, delete, bind	Manage cluster-wide role-based access control.
ClusterRoleBinding	rbac.authorization.k8s.io	get, create, update, delete, bind	Bind cluster roles to users or groups.
Job	batch	get, list, watch, create, delete, update	Manage batch jobs executed by workflows.
Deployment	apps	get, list, watch, create, delete, update	Manage workflow-related deployments.

Argo Workflows Verbs and Descriptions Table

Verb	Description
get	Retrieve details of a resource.
list	List multiple resources of the same type.
watch	Monitor changes to resources in real-time.
create	Create a new resource.
delete	Delete an existing resource.
update	Modify an existing resource.
patch	Apply partial updates to a resource.
bind	Assign roles to users or groups (specific to RBAC resources).

Resources:

1. Kubernetes RBAC API Documentation
2. Argo Workflows Service Accounts
3. Argo Workflows SSO RBAC
4. Argo Server RBAC Role Example
5. Argo Workflows Workflow RBAC
6. Argo Workflows Security
7. Argo Workflows Workflow Manager Role
8. Argo Workflows Workflow Controller Role
9. Argo Workflows Agent Role