Repository navigation
Missing impersonate verb for serviceaccounts in default server clusterRoleRules (v3.5.x / Chart v10.4.0) #4028
Description
Describe the bug
After upgrading Argo CD to version v3.5.1 (using helm chart v10.4.0), users encounter a forbidden error when attempting to delete resources via the Argo CD UI or API.
This happens because Argo CD v3.5 extended the application impersonation capabilities to server operations. The argocd-server now attempts to impersonate the application controller's ServiceAccount during deletion/management tasks. However, the default ClusterRole generated by the Helm Chart does not grant the argocd-server the permission to impersonate serviceaccounts.
Related helm chart
argo-cd
Helm chart version
v10.4.0
To Reproduce
- Deploy Argo CD using helm chart
v10.4.0(Argo CD app versionv3.5.1) with default RBAC settings (server.clusterRoleRules.enabledset tofalse). - Log into the Argo CD UI.
- Attempt to delete a live resource managed by Argo CD, for example pod.
- The deletion fails with the RBAC impersonation error.
Expected behavior
The default ClusterRole (or namespace-scoped Role) created for argocd-server should automatically include the impersonate verb for serviceaccounts to support the architectural changes introduced in Argo CD v3.5.x.
Screenshots
Additional context
I think that adding following rule to the default server role templates (both ClusterRole and Role) should fix the problem:
- apiGroups:
- ""
resources:
- serviceaccounts
verbs:
- impersonate
Activity
lemon0333 commentedon Aug 22, 2026
I'd like to take this one. I'll add an
impersonaterule forserviceaccounts(apiGroups: [""],verbs: ["impersonate"]) to the default server RBAC templates (both the ClusterRole and namespace-scoped Role), guarded under the chart-managed default-rules path so it doesn't affect users supplying their ownserver.clusterRoleRules.rules. This restores UI/API resource deletion under Argo CD v3.5.x, which now impersonates the application controller's ServiceAccount on delete/manage. PR incoming.jmeridth commentedon Sep 1, 2026
Triage question to help route the fix: can you confirm whether
application.sync.impersonation.enabled: trueis set in yourargocd-cm? Upstream v3.5.1 ships noimpersonateRBAC grants in its own manifests, and default installs never send impersonation headers, so theforbiddenerror on delete should only occur with that feature enabled. See the discussion on #4031 for why the fix will likely be an opt-in scoped grant or documentation rather than a default RBAC change.