feat(rbac)!: disable fine-grained inheritance by default (#19988)

[fffinkel]

We would like to allow our engineers to use the rollback functionality while having auto-sync enabled, without granting them the ability to edit an application's sub-resource manifests. For compliance purposes, we can only deploy using a known set of manifests from a protected source, which is the git repo holding our manifests that engineers do not have access to.

Using the rollback functionality when auto-sync is enabled requires the user to disable auto-sync, which in turn requires update permissions on the application itself. We can allow this by doing the following:

p, my-user, applications, update, */*, allow

However, this will also allow engineers to edit application manifests. It follows that we would like to add a deny for the application's sub-resources, but as the RBAC documentation states, this deny is ignored.

This PR changes application resource RBAC to allow users to set separate update/delete permissions for the application itself, but still deny sub-resources. We can then do something like this:

p, my-user, applications, update, */*, allow
p, my-user, applications, update/*/Deployment/*, */*, deny

It introduces a breaking change to RBAC (see #19988), so it will have to wait until V3. To allow this functionality in V2, a config value (server.rbac.enablev3 in argocd-cm) was added that allows the user to opt in to this new behavior. I did my best to implement #19988 in the first commit, and then to add the config value gating in a following commit, so that the first commit can be cherry-picked or the second commit reverted when the V3 release is cut.

RBAC docs: https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#fine-grained-permissions-for-updatedelete-action

The cherry pick in v2 will be for #20600
Closes #19988

Checklist:

• Either (a) I've created an enhancement proposal and discussed it with the community, (b) this is a bug fix, or (c) this does not need to be in the release notes.
• The title of the PR states what changed and the related issues number (used for the release note).
• The title of the PR conforms to the Toolchain Guide
• I've included "Closes [ISSUE #]" or "Fixes [ISSUE #]" in the description to automatically close the associated issue.
• I've updated both the CLI and UI to expose my feature, or I plan to submit a second PR with them.
• Does this PR require documentation updates?
• I've updated documentation as required by this PR.
• I have signed off all my commits as required by DCO
• I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
• My build is green (troubleshooting builds).
• My new feature complies with the feature status guidelines.
• I have added a brief description of why this PR is necessary and/or what this PR solves.
• Optional. My organization is added to USERS.md.
• Optional. For bug fixes, I've indicated what older releases this fix should be cherry-picked into (this may or may not happen depending on risk/complexity).

[bunnyshell]

❌ Preview Environment deleted from Bunnyshell

Available commands (reply to this comment):

• 🚀 /bns:deploy to deploy the environment

[codecov]

Codecov Report

Attention: Patch coverage is 64.70588% with 6 lines in your changes missing coverage. Please review.

Project coverage is 55.29%. Comparing base (d4d6713) to head (f49008c).
Report is 7 commits behind head on master.

Files with missing lines	Patch %	Lines
server/application/application.go	62.50%	2 Missing and 1 partial ⚠️
util/settings/settings.go	66.66%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #20671      +/-   ##
==========================================
- Coverage   55.31%   55.29%   -0.03%     
==========================================
  Files         337      339       +2     
  Lines       56824    57172     +348     
==========================================
+ Hits        31430    31611     +181     
- Misses      22710    22842     +132     
- Partials     2684     2719      +35     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[andrii-korotkov-verkada]

I think instead of introducing a breaking change we should create a new mechanism for setting permissions for applications themselves only.

Maybe we introduce the new permission terms like update_self or delete_self.

I'd probably comment on the issue and continue the discussion there.

[fffinkel]

I've updated this PR per @agaudreault 's comments. Thanks everyone!

[agaudreault]

Merged master with v3 changes and updated the current code to reflect the behavior for v3.

The only change for a cherry pick in v2 would be

• Docs update
• Change the flag default to false.
• Update tests for the behavior when the flag is not specified

[agaudreault]

/cherry-pick release-2.14

[gcp-cherry-pick-bot]

Cherry-pick failed with Merge error 606bd5b04393a06461d007d066da0f0d4a6c6d95 into temp-cherry-pick-a6393d-release-2.14