delete permission wrong issue in pipeline and failing

[akhilksm]

• p, proj:test:test-admin, applications, delete/, test/, allow i have given this permission in appset and it was working able to delete pods/statefulsets etc. I am using v3.0 and getting this error when pipeline ran "Permission not allowed.

fatal: [localhost]: FAILED! => {"changed": true, "cmd": ["argocd", "proj", "role", "create-token", "test", "test", "-e", "7d", "-t"], "delta": "0:00:02.163625", "end": "2026-05-22 14:32:08.192753", "msg": "non-zero return code", "rc": 20, "start": "2026-05-22 14:32:06.029128", "stderr": "time="2026-05-22T14:32:08Z" level=fatal msg="rpc error: code = InvalidArgument desc = invalid policy rule 'p, proj:test:test, applications, delete/, test/, allow': invalid action 'delete/'"", "stderr_lines": ["time="2026-05-22T14:32:08Z" level=fatal msg="rpc error: code = InvalidArgument desc = invalid policy rule 'p, proj:test:test, applications, delete/, test/, allow': invalid action 'delete/'""], "stdout": "", "stdout_lines": []}" any mistake could be in pipeline or in the way i have given delete permission

[ELHart05]

The error is pointing at the action token, and it's correct: delete/ isn't a valid action. The trailing slash puts you into Argo CD's fine-grained sub-resource form, but that form needs the rest of the path after it. The format is:

<action>/<group>/<kind>/<namespace>/<name>

A bare delete/ with nothing after the slash gets rejected as invalid action 'delete/'. To allow deleting an application's managed resources (pods, statefulsets, and so on), write it out:

p, proj:test:test-admin, applications, delete/*/*/*/*, test/*, allow

or scope it, for example delete/*/Pod/*/* or delete/apps/StatefulSet/*/*.

As for why it worked before and broke on v3.0: this is a documented v3.0 behavior change. Before v3, the bare delete (and update) action also covered an application's managed resources, so your old rule happened to allow deleting pods and statefulsets. In v3.0, bare delete / update apply only to the Application object itself; acting on the resources it manages now requires the fine-grained delete/<group>/<kind>/<namespace>/<name> form.

So if you need both (delete the app object and delete its managed resources), give both lines:

p, proj:test:test-admin, applications, delete, test/*, allow
p, proj:test:test-admin, applications, delete/*/*/*/*, test/*, allow

One more thing: the resource side should be test/* (project test, any application), not test/. The docs recommend always writing all four segments after the action so the rule is unambiguous.

Refs: Argo CD RBAC, fine-grained permissions for application-related resources, and the v3.0 upgrade notes covering the delete / update sub-resource change.