hanzoai/deploy
2
0
Fork 0
mirror of https://github.com/hanzoai/deploy.git synced 2026-10-07 08:44:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: Add section on how to lock down/restrict the default project (#21757)

Browse Source 
Signed-off-by: Dag Andersen <[email protected]>
This commit is contained in:
Dag Andersen
2025-03-03 19:55:47 -05:00
committed by GitHub
parent 4d99ad9db1
commit 0ec0ec6d7c
1 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/user-guide/projects.md
+21 -1
View File
@@ -9,7 +9,7 @@ Projects provide a logical grouping of applications, which is useful when Argo C
### The Default Project
Every application belongs to a single project. If unspecified, an application belongs to the `default` project, which is created automatically and by default, permits deployments from any source repo, to any cluster, and all resource Kinds. The default project can be modified, but not deleted. When initially created, it's specification is configured to be the most permissive:
Every application belongs to a single project. If unspecified, an application belongs to the `default` project, which is created automatically and by default, permits deployments from any source repo, to any cluster, and all resource Kinds. When initially created, it's specification is configured to be the most permissive:
```yaml
spec:
@@ -23,6 +23,26 @@ spec:
kind: '*'
```
The `default` project can be modified, but not deleted. The project is useful for initial testing, but it is recommended to create dedicated projects with explicit source, destination, and resource permissions.
To remove all permissions from the `default` project, apply the following manifest to the namespace where Argo CD is installed:
```yaml
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
name: default
spec:
sourceRepos: []
sourceNamespaces: []
destinations: []
namespaceResourceBlacklist:
- group: '*'
kind: '*'
```
After you modify the `default` project, any application that attempts to use it will be denied until you explicitly move the application to a more permissive project.
### Creating Projects
Additional projects can be created to give separate teams different levels of access to namespaces. The following command creates a new project `myproject` which can deploy applications to namespace `mynamespace` of cluster `https://kubernetes.default.svc`. The permitted Git source repository is set to `https://github.com/argoproj/argocd-example-apps.git` repository.