How do I correctly format an RBAC action for ArgoCD rollouts?

[rteeling-evernorth]

I'm trying to create a project-level RBAC permission allowing a project role to use the web ui to approve of rollouts.

I've set the action path to actions/*/Rollouts/* and it works, but this is a little too general for me. I want to narrow it down to just the rollout api group, but the official documentation is somewhat ambiguous and I'm having problem formatting the string.

Official docs say:

The action action corresponds to either built-in resource customizations defined in the Argo CD repository, or to custom resource actions defined by you. The action path is of the form action///. For example, a resource customization path resource_customizations/extensions/DaemonSet/actions/restart/action.lua corresponds to the action path action/extensions/DaemonSet/restart. You can also use glob patterns in the action path: action/* (or regex patterns if you have enabled the regex match mode).

https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#the-action-action

The above doc says that given the actions for rollouts live in resource_customizations/argoproj.io/Rollout, I should use the path
action/extensions/argoproj.io/Rollout/* but that doesnt seem to work. Does anyone know how to actually format this path?

Thanks!

[agaudreault]

In the example, DaemonSet is in the extensions api group.
For Rollout, it is in the argoproj.io api group.
So the resulting policy based on action/<api-group>/<Kind>/<action-name> format as documented is action/argoproj.io/Rollout/*.