How to restrict access in ArgoCD? Who can sync, and who only has read-only access?

In ArgoCD, access control is implemented through RBAC (Role-Based Access Control). You can configure roles with different permissions:

• read-only: users can view the state of applications but cannot make changes or initiate synchronization.
• sync: users have the right to synchronize applications, modify configurations, and manage deployment.

For this, policies are set in the configuration file argocd-rbac-cm, for example:

policy.csv: |
  p, role:readonly, applications, get, */*, allow
  p, role:readonly, applications, list, */*, allow
  p, role:sync, applications, sync, */*, allow
  p, role:sync, applications, get, */*, allow
  p, role:sync, applications, update, */*, allow

Then, roles are assigned to users via groups or directly. This allows flexible access management and separation of read and synchronization rights.