Separate RBAC permission for pruning

[sfc-gh-jelsesiy]

Summary

It would be great to have a separate RBAC permission for pruning that can be granted on the application level.

Motivation

Today for auto prune to work, any application needs the delete permission. However, this also allows users to delete any resource manually via the Argo UI. Instead, pruning based on a git revision change should work without granting users the delete permission.

Proposal

p, role:staging-db-admins, applications, prune, staging-db-admins/*, allow

The issue is closely related to the concerns expressed in #3593

[magro]

Are there any plans to implement this?

[PrayagS]

+1. It would be nice to have a separate permission for destructive sync operations like prune, replace, force, and so on.