Is there a way to disable the Edit button on the Live Manifest tab?

[mkindalov]

We have a setup where we want to give teams read-only access to the clusters.
Our goal is to ensure that ALL changes are done via GIT only.

However, I was not able to find a way to disable the "EDIT" button on the "Live Manifest" tab of the Resource Details page.

I checked ArgoCD RBAC but its mainly focused on ArgoCD resource types.

[pasha-codefresh]

Hey, you can configure RBAC rule that will prevent your team update manifest from argocd

[mkindalov]

Hi @pasha-codefresh

I spent a lot of time checking the options before asking the question. From the documentation
https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/

The defined RBAC is on the following:
Resources: clusters, projects, applications, repositories, certificates, accounts, gpgkeys
Actions: get, create, update, delete, sync, override, action.

Can you point me to the documentation or some example?

Thanks,
Marjan

[shapirus]

There is no "edit" substring found at https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/. Any update on how this can possibly be done via RBAC?

Additionally, since this can easily be seen as a security matter, there should probably be an easier option of explicitly disabling this edit function (admin user included) via an attribute in the argocd-cm ConfigMap.

If the change proposed in #16063 is implemented, then, combined with disabling the Edit function, the ultimate goal of "You will not change anything without git push permissions" can be achieved.

[crenshaw-dev]

This can all be achieved by proper RBAC configuration.

The Edit button corresponds to the applications, update permission.