Argo CDargocd admin proj generate-allow-list命令详解从 ClusterRole 自动生成 AppProject 资源白名单【免费下载链接】argo-cdDeclarative Continuous Deployment for Kubernetes项目地址: https://gitcode.com/GitHub_Trending/ar/argo-cd本文聚焦 Argo CD CLI 中argocd admin proj generate-allow-list这条管理命令它接收一个 Kubernetes ClusterRole 文件和项目名通过集群 API 发现API Discovery把 ClusterRole 中允许创建create动词的命名空间级资源自动转换为AppProject的spec.namespaceResourceWhitelist白名单并以 YAML 输出。读完后你将掌握该命令的完整参数用法、输出格式以及从源码层面理解白名单如何生成、又如何被项目校验逻辑消费的完整链路。命令概览该命令属于argocd admin projManage projects configuration子命令组其声明位置见 NewProjectAllowListGenCommandargocd admin proj generate-allow-list CLUSTERROLE_PATH PROJ_NAME [flags]CLUSTERROLE_PATH本地 ClusterRole 清单文件路径必须是 YAML 格式的单个 ClusterRole 对象PROJ_NAME要生成白名单的 Argo CD 项目名将写入输出 YAML 的metadata.name。命令要求恰好 2 个位置参数否则打印帮助并退出见 参数校验。官方示例# Generates project allow list from the specified clusterRole file argocd admin proj generate-allow-list /path/to/clusterrole.yaml my-project完整 Options 列表该命令通过cli.AddKubectlFlagsToCmd注册了一组与 kubectl 兼容的 kubeconfig 连接参数见 flags 注册再叠加自身的--out输出参数--as string Username to impersonate for the operation --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server -h, --help help for generate-allow-list --insecure-skip-tls-verify If true, the servers certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to a kube config. Only required if out-of-cluster -n, --namespace string If present, the namespace scope for this CLI request -o, --out string Output to the specified file instead of stdout (default -) --password string Password for basic authentication to the API server --proxy-url string If provided, this URL will be used to connect via proxy --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means dont timeout requests. (default 0) --server string The address and port of the Kubernetes API server --tls-server-name string If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used. --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use --username string Username for basic authentication to the API server其中与日常使用最相关的是--kubeconfig/--context/--server指定要对哪个集群做资源发现和-o, --out默认-表示输出到 stdout否则创建指定文件写入。继承自父命令的 Options--argocd-context string The name of the Argo-CD server context to use --auth-token string Authentication token; set this or the ARGOCD_AUTH_TOKEN environment variable --client-crt string Client certificate file --client-crt-key string Client certificate key file --config string Path to Argo CD config (default /home/user/.config/argocd/config) --controller-name string Name of the Argo CD Application controller; set this or the ARGOCD_APPLICATION_CONTROLLER_NAME environment variable when the controllers name label differs from the default, for example when installing via the Helm chart (default argocd-application-controller) --core If set to true then CLI talks directly to Kubernetes instead of talking to Argo CD API server --grpc-web Enables gRPC-web protocol. Useful if Argo CD server is behind proxy which does not support HTTP2. --grpc-web-root-path string Enables gRPC-web protocol. Useful if Argo CD server is behind proxy which does not support HTTP2. Set web root. -H, --header strings Sets additional header to all requests made by Argo CD CLI. (Can be repeated multiple times to add multiple headers, also supports comma separated headers) --http-retry-max int Maximum number of retries to establish http connection to Argo CD server --insecure Skip server certificate and domain verification --kube-context string Directs the command to the given kube-context --logformat string Set the logging format. One of: json|text (default json) --loglevel string Set the logging level. One of: debug|info|warn|error (default info) --plaintext Disable TLS --port-forward Connect to a random argocd-server port using port forwarding --port-forward-namespace string Namespace name which should be used for port forwarding --prompts-enabled Force optional interactive prompts to be enabled or disabled, overriding local configuration. If not specified, the local configuration value will be used, which is false by default. --redis-compress string Enable this if the application controller is configured with redis compression enabled. (possible values: gzip, none) (default gzip) --redis-haproxy-name string Name of the Redis HA Proxy; set this or the ARGOCD_REDIS_HAPROXY_NAME environment variable when the HA Proxys name label differs from the default, for example when installing via the Helm chart (default argocd-redis-ha-haproxy) --redis-name string Name of the Redis deployment; set this or the ARGOCD_REDIS_NAME environment variable when the Rediss name label differs from the default, for example when installing via the Helm chart (default argocd-redis) --repo-server-name string Name of the Argo CD Repo server; set this or the ARGOCD_REPO_SERVER_NAME environment variable when the servers name label differs from the default, for example when installing via the Helm chart (default argocd-repo-server) --server-crt string Server certificate file --server-name string Name of the Argo CD API server; set this or the ARGOCD_SERVER_NAME environment variable when the servers name label differs from the default, for example when installing via the Helm chart (default argocd-server)一个值得注意的细节虽然这条命令挂在argocd admin面向 Argo CD 管理员、需要直接 Kubernetes 访问之下但它实际并不调用 Argo CD API Server而是通过 kubeconfig 直接连接目标 Kubernetes 集群做 API Discovery。因此上面的--auth-token、--server等 Argo CD 连接参数对该命令本身并不生效真正起作用的是 kubeconfig 相关参数。工作原理从 ClusterRole 到 namespaceResourceWhitelist命令的核心实现是 generateProjectAllowList整个流程分为四步。1. 通过 API Discovery 获取集群全部资源列表getResourceList 使用clientcmd.ClientConfig构建 kubernetes 客户端配置再通过discovery.NewDiscoveryClientForConfig调用ServerPreferredResources()拉取集群中所有 API 组/版本及其资源清单[]*metav1.APIResourceList。源码还静态导入了 GCP、OIDC、Azure 三个 client-go 认证插件插件导入保证在 GKE/AKS 等环境中 kubeconfig 认证方式可以直接工作。2. 读取并转换 ClusterRole 文件命令把文件先解析为unstructured.Unstructured再经scheme.Scheme.Convert转换为强类型的rbacv1.ClusterRole。文件不存在、YAML 非法或不是 ClusterRole 对象时都会返回包装后的错误并终止。3. 按三条规则筛选生成白名单这是理解输出结果的关键源码逻辑筛选循环可归纳为跳过不含 APIGroups 的规则len(rule.APIGroups) 0的规则即 core 组的省略写法apiGroups: []如只写resources: [pods]会被直接跳过core 组的资源不会进入白名单只认create动词规则verbs中必须包含大小写不敏感的create否则整条规则被跳过——白名单只收集该项目允许创建的资源只取第一条 APIGroup 并与发现结果精确匹配对每条规则取rule.APIGroups[0]把resources中的名字与 Discovery 返回的同组 API 资源名逐一比对命中后追加metav1.GroupKind{Group, Kind}。这意味着*通配的资源名或集群中不存在的资源名不会被收录输出的 Kind 以集群实际发现结果为准。如果没有任何规则满足条件namespaceResourceWhitelist会是空列表。4. 构造 AppProject 并输出 YAML命令构造Kind: AppProject、APIVersion: argoproj.io/v1alpha1、Name: PROJ_NAME的对象仅填充Spec.NamespaceResourceWhitelist字段然后yaml.Marshal后写到 stdout 或-o指定文件。实际输出形如apiVersion: argoproj.io/v1alpha1 kind: AppProject metadata: name: my-project spec: namespaceResourceWhitelist: - group: kind: Service - group: apps kind: Deployment你可以把这份 YAML 中的namespaceResourceWhitelist段落合并进现有 AppProject 清单再kubectl apply到集群该命令本身只生成内容、不写集群。生成的白名单在 Argo CD 中如何生效生成结果写入AppProject.Spec.NamespaceResourceWhitelist字段定义见 types.go注释为 contains list of whitelisted namespace level resources。项目校验逻辑在 AppProject.IsGroupKindNamePermitted对命名空间级资源白名单为空nil时放行全部非空时资源必须在白名单中且不命中黑名单才允许部署对集群级资源不走该白名单而是由clusterResourceWhitelist管理——这与 项目文档 中命名空间级资源走白名单allow list集群级资源走黑名单deny list的表述一致对应测试 TestAppProject_IsGroupKindPermitted 覆盖了空白名单拒绝所有命名空间资源、白名单命中放行、黑名单优先等场景可作为白名单语义的可验证依据。项目文档 还补充了一个 UI 层面的影响当项目启用了namespaceResourceWhitelist资源树中 GroupKind 不在白名单内的子资源会被隐藏只影响展示不影响已部署资源的同步权限。此外若启用了 Global Projectv1.8各项目的白名单会与全局项目合并——mergeVirtualProject 会直接append全局项目的NamespaceResourceWhitelist到项目自身列表projects 文档 也把namespaceResourceWhitelist列为可继承字段之一。实操示例假设你有一份团队 RBAC 用的 ClusterRoleapiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: team-app-role rules: - apiGroups: [] resources: [services, configmaps] verbs: [get, list, watch, create] - apiGroups: [apps] resources: [deployments] verbs: [get, list, watch, create, update] - apiGroups: [batch] resources: [jobs] verbs: [get, list]执行argocd admin proj generate-allow-list ./team-app-role.yaml team-apps \ --kubeconfig ~/.kube/config -o team-apps-whitelist.yaml依据前文三条筛选规则可以预期apps/Deployments和 core 组的规则都会进入白名单core 组规则因apiGroups: []非空而保留而batch/Jobs因 verbs 中没有create被排除。若 ClusterRole 里 core 组写成省略形式apiGroups: []则 services/configmaps 也不会出现——这是该命令与直觉最容易产生出入的地方。相关命令与延伸阅读argocd admin proj命令族下还有argocd admin proj generate-spec —— 生成项目的声明式配置argocd admin proj update-role-policy—— 批量更新项目角色策略白名单的日常维护也可用面向普通用户的argocd proj allow-namespace-resource/deny-namespace-resource等命令见 Projects 文档。核心源码入口为 cmd/argocd/commands/admin/project_allowlist.go白名单字段定义与校验分别在 pkg/apis/application/v1alpha1/types.go 和 pkg/apis/application/v1alpha1/app_project_types.go。【免费下载链接】argo-cdDeclarative Continuous Deployment for Kubernetes项目地址: https://gitcode.com/GitHub_Trending/ar/argo-cd创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考