Argo CD UI auto-sync toggle uses resource action
Introduced 2026-08-04 · score 0.98
HOW TO USE IT
When a role needs to toggle auto-sync from the application details page without broad application update permission, grant the `toggle-auto-sync` action and application `get` access for the target application.
p, role:oncall, applications, action/argoproj.io/Application/toggle-auto-sync, */*, allow
p, role:oncall, applications, get, */*, allowWHY THIS HELPS
Allow a role to toggle application auto-sync without granting broad application update permission.
BEFORE THIS CHANGE
The auto-sync checkbox called `updateApp`, requiring broad `application update` permission.
REQUIREMENTS AND LIMITATIONS
- Version: v3.5.0
- applications (required): RBAC resource for Application-specific policies.
- action/argoproj.io/Application/toggle-auto-sync (required): Action policy path, in `action/<group>/<kind>/<action-name>` form.
- get (required): Allows reading the target application.
- */* (required): Application object pattern used in the example policy; application policy objects use `<app-project>/<app-name>`.
- Prerequisite: Configure SSO or one or more local users before defining additional RBAC roles.
- The `toggle-auto-sync` resource action was added earlier and is wired into the application details page by this change.
FIRST-PARTY EVIDENCE
- https://github.com/argoproj/argo-cd/releases/tag/v3.5.0
- https://github.com/argoproj/argo-cd/pull/27226
- https://github.com/argoproj/argo-cd/blob/v3.5.0/docs/operator-manual/rbac.md
Check the installed version and the source before using it. Entry JSON