600-application-admin-rbac

Application Admin RBAC Helm Chart

This Helm chart automatically installs scoped RBAC permissions for ArgoCD service accounts when cluster_admin_role=true. It prepares the cluster for future operations using application_admin_role=true.

Overview

This chart dynamically detects which namespaces exist for a MAS instance and applies appropriate RBAC resources:

• Per-namespace Role: Grants permissions to manage MAS resources within each namespace
• Per-namespace RoleBinding: Binds the Role to the ArgoCD service account
• ClusterRole: Provides read-only access to cluster-level resources (nodes, namespaces, storageclasses)
• ClusterRoleBinding: Binds the ClusterRole to the ArgoCD service account

Resources Created

Resource Type	Resource Name	Namespace	Condition	Installed By
ClusterRole	Instance-scoped readonly cluster role	N/A (cluster-scoped)	Always	cluster_admin_role
ClusterRoleBinding	Instance-scoped readonly cluster role binding	N/A (cluster-scoped)	Always	cluster_admin_role
Role	Per-namespace generated roles	Existing MAS instance namespaces	When matching namespaces exist	cluster_admin_role
RoleBinding	Per-namespace generated role bindings	Existing MAS instance namespaces	When matching namespaces exist	cluster_admin_role

Dynamic Namespace Detection

The chart uses Helm's lookup function to check if namespaces exist before creating RBAC resources. This means:

• ✅ RBAC is only created for namespaces that actually exist
• ✅ No failures if optional apps (e.g., Visual Inspection) are not installed
• ✅ Automatically adapts to the actual deployment configuration

Namespace Patterns

The following namespace patterns are checked for each instance:

• db2u-{instance_id}
• ibm-software-central
• mas-{instance_id}-core
• mas-{instance_id}-manage
• mas-{instance_id}-sls
• mas-{instance_id}-syncres
• mas-{instance_id}-visualinspection

Usage Scenarios

Scenario 1: cluster_admin_role=true

When ArgoCD has cluster-admin privileges:

1. ArgoCD creates all namespaces (CreateNamespace=true)
2. ArgoCD installs this RBAC chart at sync-wave 600
3. RBAC grants scoped permissions to the ArgoCD service account
4. Cluster is prepared for future application-admin operations

Scenario 2: cluster_admin_role=false, application_admin_role=true

When ArgoCD does NOT have cluster-admin:

1. ArgoCD uses the pre-installed RBAC (from Scenario 1 or manual installation)
2. ArgoCD can manage MAS resources in existing namespaces
3. ArgoCD cannot create namespaces (CreateNamespace=false)

Configuration

Values

# Instance ID for namespace generation
instance_id: "inst1"

# ArgoCD namespace (used to derive service account)
argo_namespace: "openshift-gitops"

# Service account configuration (optional)
# Defaults to: {argo_namespace}-argocd-application-controller
service_account:
  name: ""
  namespace: ""

# Namespace patterns (can be customized)
# These patterns must match the namespaceConditions in generate_application_admin_rbac.py
namespace_patterns:
  - "db2u-{inst}"
  - "mas-{inst}-syncres"
  - "mas-{inst}-core"
  - "mas-{inst}-manage"
  - "mas-{inst}-assist"
  - "mas-{inst}-iot"
  - "mas-{inst}-monitor"
  - "mas-{inst}-health"
  - "mas-{inst}-optimizer"
  - "mas-{inst}-predict"
  - "mas-{inst}-visualinspection"
  - "mas-{inst}-facilities"
  - "mas-{inst}-sls"
  - "mas-{inst}-syncres"
  - "mas-{inst}-visualinspection"

Service Account

By default, the chart derives the service account name from the ArgoCD namespace:

• ArgoCD namespace: mas-argocd
• Service account: mas-argocd-argocd-application-controller

You can override this by setting service_account.name and service_account.namespace.

Deployment

This chart is automatically deployed by the ArgoCD Application at: root-applications/ibm-mas-instance-root/templates/600-application-admin-rbac-app.yaml

Sync Wave: 600 (after all app installations that create namespaces)

Condition: Only deployed when cluster_admin_role=true

RBAC Rules Generation

IMPORTANT: The RBAC rules in this chart are auto-generated from the Python script:

./build/bin/generate_application_admin_rbac.py

This script:

1. Scans all Helm charts in the repository
2. Identifies resources that require application_admin_role permissions
3. Generates RBAC rules for both:
   • Kustomize: rbac/kustomize/base/application-admin-role.yaml
   • Helm Template: instance-applications/600-application-admin-rbac/templates/per-namespace-rbac.yaml

Updating RBAC Rules

When you add new resource types to any Helm chart:

1. Run the generator script:

   ./build/bin/generate_application_admin_rbac.py

2. The script will automatically update both targets:

   • Kustomize base files in rbac/kustomize/
   • Helm template in instance-applications/600-application-admin-rbac/templates/

3. Commit both updated files together

DO NOT manually edit per-namespace-rbac.yaml - your changes will be overwritten!

Comparison with Kustomize Approach

Aspect	Helm Chart (Automated)	Kustomize (Manual)
Deployment	Automatic via ArgoCD	Manual kubectl apply
Namespace Detection	Dynamic (lookup)	Static (pre-generated)
Multi-Instance	One chart per instance	One overlay per instance
Maintenance	Auto-generated by script	Auto-generated by script
Use Case	cluster_admin_role=true	Pre-install or manual setup

Related Files

• Generator Script: build/bin/generate_application_admin_rbac.py (generates both targets)
• Kustomize Base: rbac/kustomize/base/application-admin-role.yaml (generated)
• Kustomize Components: rbac/kustomize/components/cluster-readonly/ (generated)
• Helm Template: instance-applications/600-application-admin-rbac/templates/per-namespace-rbac.yaml (generated)
• ArgoCD Application: root-applications/ibm-mas-instance-root/templates/600-application-admin-rbac-app.yaml

Troubleshooting

RBAC not created for a namespace

Cause: The namespace doesn't exist when the chart is deployed.

Solution: Ensure the chart is deployed at sync-wave 600, after all namespace-creating apps.

Multiple instances conflict

Cause: ClusterRole/ClusterRoleBinding names must be unique per instance.

Solution: The chart automatically includes instance_id in cluster-level resource names.

Service account not found

Cause: Service account name or namespace is incorrect.

Solution: Verify the ArgoCD service account exists in the specified namespace.

Permissions Granted

Namespace-Level (Role)

The Role grants permissions to manage:

• Core resources: ConfigMaps, Secrets, Services, ServiceAccounts, Pods
• MAS resources: Suites, Workspaces, App Configs, JDBC Configs, etc.
• Database resources: Db2uInstances, Db2uEngines
• Networking: Routes, NetworkPolicies, Istio resources
• Batch: Jobs, CronJobs
• RBAC: Roles, RoleBindings (within namespace)

Cluster-Level (ClusterRole)

The ClusterRole grants read-only access to:

• Namespaces
• Nodes
• StorageClasses

Security Considerations

• RBAC is scoped to specific namespaces (not cluster-wide)
• Cluster-level access is read-only
• Service account is explicitly specified

Base Instance Values

This chart inherits common instance configuration values. The most frequently used base values are:

account:
  id: string                    # Account identifier
  name: string                  # Account name

region:
  id: string                    # Region identifier
  name: string                  # Region name

cluster:
  id: string                    # Cluster identifier
  name: string                  # Cluster name

instance:
  id: string                    # MAS instance identifier

sm:                             # Secrets Manager configuration
  aws_secret_region: string
  aws_access_key_id: string (secret reference)
  aws_secret_access_key: string (secret reference)

For complete documentation of all base instance values including optional fields like custom_labels, argocluster_instance, application_admin_service_account, mas_wipe_mongo_data, allow_list, additional_vpn, application_configuration, use_postdelete_hooks, additional_resources, extensions, enhanced_dr, and cli_image_repo, see the Instance Base Values Reference.

• Resources are labeled for tracking and management