Web Terminal feature is now working whereas it was not before (due to lack of permission)

[gaeljw]

Hello folks,

This will be broad question but looking for guidance at what to check for.

Context:

• 1 ArgoCD installation (HA) on Cluster A
• ArgoCD manages both the local Cluster A and a remote cluster B
• Web Terminal feature is enabled via the ArgoCD config map

For some time, we had the Web Terminal feature working only for pods on remoter cluster B because we specifically added the proper permissions in the ClusterRole in remote Cluster B. But the Web Terminal was not working in local Cluster A because the role didn't have the proper permissions.

Today, I just realized that we now have access to the Web Terminal in local Cluster A as well.

My guess is that this is due to an upgrade of ArgoCD, the behaviour changed (we are currently running v3.0.1, we were on v2.x not so long ago).

However, according to the documentation Web Terminal can only work if the following permission is set on the argocd-server ClusterRole:

- apiGroups:
  - ""
  resources:
  - pods/exec
  verbs:
  - create

But it's not our case and still the feature works.

Our ClusterRole:

  - verbs:
      - delete
      - get
      - patch
    apiGroups:
      - '*'
    resources:
      - '*'
  - verbs:
      - list
    apiGroups:
      - ''
    resources:
      - events
  - verbs:
      - get
    apiGroups:
      - ''
    resources:
      - pods
      - pods/log
  - verbs:
      - get
      - list
      - watch
    apiGroups:
      - argoproj.io
    resources:
      - applications
      - applicationsets
  - verbs:
      - create
    apiGroups:
      - batch
    resources:
      - jobs
  - verbs:
      - create
    apiGroups:
      - argoproj.io
    resources:
      - workflows

Am I missing something or is this an issue in ArgoCD? What could I check additionally?