apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: my-project
  namespace: no-argocd
spec:
  roles:
    # A role which provides read-only access to all applications in the project
    - name: read-only
      description: Read-only privileges to my-project
      policies:
        - p, proj:my-project:read-only, applications, get, my-project/*, allow
      groups:
        - my-oidc-group
