RBAC granular permissions to rollback application

[marcogenualdo]

I have several applications on a Kubernetes cluster deployed using ArgoCD. One role needs to be able, among other things, to rollback a given application. I know that the line

p, role:default, applications, update, */*, allow

grants the rollback permission, but it also grants permission to change the application in any way (e.g. edit yaml values), which is undesirable. Is there a set of policies that allows me to grant a role only the rollback operation?

[tapas-clear]

I don't believe there is a way to have granular permissions specific for rollback (at least with v2.12) but I believe sync not update is what actually grants access to rollback. Therefore, granting sync and thus rollback permissions wouldn't allow access to editing the yaml values if that's the main concern.

p, role:default, applications, sync, */*, allow

Source code to why I think it's sync not update: https://github.com/argoproj/argo-cd/blob/master/server/application/application.go#L2042