Lightning Talk: How GitOps Changes Identity and RBAC Management
summary
Shows a concrete setup that uses OAuth2‑Token Exchange (RFC 8693) with Dex to swap GitHub Actions OIDC tokens into identities ArgoCD trusts, ties GitHub Teams to ArgoCD AppProjects so repo and human group membership map to the same permissions, and implements just‑in‑time RBAC by having CI run KRM/Kustomize functions that auto‑generate AppProject patches and open PRs (admin approval gates). Claims this eliminates manual token rotation and keeps permissions in sync across ArgoCD, GitHub, and Kubernetes.
AI-written summary · about
chapters (6)
- 0:00GitOps and identity management
- 2:07Permission boundaries in GitOps
- 3:31Impersonation for syncing permissions
- 4:56Token exchange for CI auth
- 7:03App projects with security
- 10:14Summary
related talks
10mLightning Talk: Exploring HashiCorp Vault and ArgoCD - the GitOps Way
06mLightning Talk: Secure GitOps for Regulated Workloads: Argo CD Meets Confidential...
34mSecure by Default with GitOps - A Guide to OPA with Argo CD
46mgit push permissions
13mLightning Talk: The Successful Recipe to Secure Your Fleet of...
37mSecure Multi-Tenant GitOps Application & Infrastructure Rollouts At Adobe
08mLightning Talk: Automatically Restrict Permissions for the GITHUB Token
27mSecure by Design: Embedding DevSecOps into Your GitOps Workflows