Running ArgoCD in namespaced mode

[antonionappi88]

Hello,

I'm trying to run ArgoCD in namespace mode. Because mostly of the apps that should manage will be outside of the cluster where it sits. My problem is that the sync fails with Cluster level CustomResourceDefinition "appprojects.argoproj.io" can not be managed when in namespaced mode.

I'm installing it manually via

kustomize build https://github.com/argoproj/argo-cd/manifests/namespace-install/?ref=v2.0.0 | kubectl create -n argocd -f -

Then I try to create an application to manage ArgoCD by itself in the same namespace where I installed it.

Here the app

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: argo-self
  namespace: argocd
  labels:
    app: argocd
spec:
  destination:
    namespace: argocd
    server: https://kubernetes.default.svc
  project: default
  source:
    path: .
    repoURL: my_repo
    targetRevision: qa
  # Sync policy
  syncPolicy:
    automated: # automated sync by default retries failed attempts 5 times with following delays between attempts ( 5s, 10s, 20s, 40s, 80s ); retry controlled using `retry` field.
      prune: false # Specifies if resources should be pruned during auto-syncing ( false by default ).
      selfHeal: false # Specifies if partial app sync should be executed when resources are changed only in target Kubernetes cluster and no git change detected ( false by default ).
    syncOptions:     # Sync options which modifies sync behavior
    - Validate=false # disables resource validation (equivalent to 'kubectl apply --validate=true')
    - CreateNamespace=false # Namespace Auto-Creation ensures that namespace specified as the application destination exists in the destination cluster.
    # The retry feature is available since v1.7

This is the kustomization.yaml file that is used by the self_argo application.

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
- https://github.com/argoproj/argo-cd/manifests/namespace-install/?ref=v2.0.0
- ./rbac/argocd-repo-server-sa.yaml
- ./rbac/argocd-repo-server-role.yaml
- ./rbac/argocd-repo-server-rolebinding.yaml
- ./rbac/argocd-application-controller-role.yaml
- ./rbac/argocd-application-controller-rolebinding.yaml

patchesStrategicMerge:
- ./patches/argocd_patch.yaml
- ./patches/argocd_cm_patch.yaml
- ./patches/application_crd.yaml
- ./patches/appprojects_crd.yaml
- ./patches/insecure_argocd_server.yaml
- ./patches/argocd_rbac_cm_patch.yaml

In the CRD patches I add different annotation to try to ignored them during sync:

argocd.argoproj.io/compare-options: IgnoreExtraneous
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
argocd.argoproj.io/sync-options: Prune=false

But still ArgoCD complains about Cluster level CustomResourceDefinition "appprojects.argoproj.io" can not be managed when in namespaced mode

Do you know if I can workaround this ? Basically I'd like that ArgoCD is able to manage itself in the namespace where is created.

Cheers,
Antonio

[jannfis]

Hey @antonionappi88, to run Argo CD in a true namespace scoped mode, you will need to confine Argo CD's in-cluster cluster configuration to only those namespaces.

The easiest way to do so is via the UI. Go to "Configuration" -> "Clusters", select the "in-cluster" cluster, click "Edit" and put the namespace into the "Namespaces" field. Then save. This way, Argo CD will not try to look up cluster level resources (and won't require any permissions to do so).

This can also be done by creating the appropriate in-cluster secret in a declarative way, as described here: https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#clusters - the server fields needs to be https://kubernetes.default.svc in this case.