Missing permission for web-based terminal in Argocd UI

Signed-off-by: akhil nittala <nakhil@redhat.com>

Author: akhilnittala

controllers/argocd/policyrule.go

@@ -5,6 +5,7 @@ import (
 
 	"golang.org/x/mod/semver"
 
+	argoproj "github.com/argoproj-labs/argocd-operator/api/v1beta1"
 	"github.com/argoproj-labs/argocd-operator/common"
 
 	v1 "k8s.io/api/rbac/v1"
@@ -148,8 +149,8 @@ func policyRuleForDexServer() []v1.PolicyRule {
 	}
 }
 
-func policyRuleForServer() []v1.PolicyRule {
-	return []v1.PolicyRule{
+func policyRuleForServer(cr *argoproj.ArgoCD) []v1.PolicyRule {
+	policyRules := []v1.PolicyRule{
 		{
 			APIGroups: []string{
 				"*",
@@ -226,6 +227,20 @@ func policyRuleForServer() []v1.PolicyRule {
 			},
 		},
 	}
+	if isWebTerminalEnabled(cr) {
+		policyRules = append(policyRules, v1.PolicyRule{
+			APIGroups: []string{
+				"",
+			},
+			Resources: []string{
+				"pods/exec",
+			},
+			Verbs: []string{
+				"create",
+			},
+		})
+	}
+	return policyRules
 }
 
 func policyRuleForNotificationsController() []v1.PolicyRule {
@@ -399,7 +414,7 @@ func policyRuleForServerClusterRole() []v1.PolicyRule {
 	}
 }
 
-func getPolicyRuleList(client client.Client) []struct {
+func getPolicyRuleList(client client.Client, cr *argoproj.ArgoCD) []struct {
 	name       string
 	policyRule []v1.PolicyRule
 } {
@@ -415,7 +430,7 @@ func getPolicyRuleList(client client.Client) []struct {
 			policyRule: policyRuleForDexServer(),
 		}, {
 			name:       common.ArgoCDServerComponent,
-			policyRule: policyRuleForServer(),
+			policyRule: policyRuleForServer(cr),
 		}, {
 			name:       common.ArgoCDRedisHAComponent,
 			policyRule: policyRuleForRedisHa(client),

controllers/argocd/policyrule_test.go

@@ -0,0 +1,63 @@
+package argocd
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	v1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	argoproj "github.com/argoproj-labs/argocd-operator/api/v1beta1"
+)
+
+func hasPodsExecRule(rules []v1.PolicyRule) bool {
+	for _, r := range rules {
+		if len(r.Resources) == 1 &&
+			r.Resources[0] == "pods/exec" {
+			return true
+		}
+	}
+	return false
+}
+
+func TestPolicyRuleForServer_WebTerminal(t *testing.T) {
+	webTerminalEnabled := true
+	tests := []struct {
+		name string
+		cr   *argoproj.ArgoCD
+		want bool
+	}{
+		{
+			name: "default",
+			cr: &argoproj.ArgoCD{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "example",
+					Namespace: "default",
+				},
+				Spec: argoproj.ArgoCDSpec{},
+			},
+			want: false,
+		},
+		{
+			name: "disabled",
+			cr:   &argoproj.ArgoCD{},
+			want: false,
+		},
+		{
+			name: "enabled",
+			cr: &argoproj.ArgoCD{
+				Spec: argoproj.ArgoCDSpec{
+					WebTerminalEnabled: &webTerminalEnabled,
+				},
+			},
+			want: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rules := policyRuleForServer(tt.cr)
+			assert.Equal(t, tt.want, hasPodsExecRule(rules))
+		})
+	}
+}

controllers/argocd/role.go

@@ -66,7 +66,7 @@ func newClusterRole(name string, rules []v1.PolicyRule, cr *argoproj.ArgoCD) *v1
 
 // reconcileRoles will ensure that all ArgoCD Service Accounts are configured.
 func (r *ReconcileArgoCD) reconcileRoles(cr *argoproj.ArgoCD) error {
-	params := getPolicyRuleList(r.Client)
+	params := getPolicyRuleList(r.Client, cr)
 
 	for _, param := range params {
 		if _, err := r.reconcileRole(param.name, param.policyRule, cr); err != nil {

controllers/argocd/rolebinding.go

@@ -88,7 +88,7 @@ func newRoleBindingWithname(name string, cr *argoproj.ArgoCD) *v1.RoleBinding {
 
 // reconcileRoleBindings will ensure that all ArgoCD RoleBindings are configured.
 func (r *ReconcileArgoCD) reconcileRoleBindings(cr *argoproj.ArgoCD) error {
-	params := getPolicyRuleList(r.Client)
+	params := getPolicyRuleList(r.Client, cr)
 
 	for _, param := range params {
 		if err := r.reconcileRoleBinding(param.name, param.policyRule, cr); err != nil {

controllers/argocd/service_account.go

@@ -58,7 +58,7 @@ func getServiceAccountName(crName, name string) string {
 
 // reconcileServiceAccounts will ensure that all ArgoCD Service Accounts are configured.
 func (r *ReconcileArgoCD) reconcileServiceAccounts(cr *argoproj.ArgoCD) error {
-	params := getPolicyRuleList(r.Client)
+	params := getPolicyRuleList(r.Client, cr)
 
 	for _, param := range params {
 		if err := r.reconcileServiceAccountPermissions(param.name, param.policyRule, cr); err != nil {