User Isolation in SSO rbac feature for ARGO

[dsetty25]

we have enabled sso in argoserver .suppose there are 2 users ; user1 & user2 and they use 2 separate SA in same namespace. If so can there be any isolation between user1 and user2 ?? or in other words the wf created by user1 shunt be visible to user2 and deleted by the other user or vice versa.. Is it achievable in the sso rbac concept in the latest version.

And also workflows.argoproj.io/rbac-rule: "'admin' in groups" ...why is this groups word hardcoded ?

[alexec]

groups is hard-coded as it is a de facto standard OIDC claim.

Isolation is how you set it up. If you need users 100% isolated, you need to one service account/role and role binding per user

[toninis]

Regardless isolating the users with kubernetes RBAC you still have full view Access on all workflows when you deploy Argo Workflows in cluster-install mode .

[toninis]

There is no such option yet to remove anonymous read access so far correct ?

[alexec]

#6444