How can I limit resources being created in namespaces which do not belong to a application?

[joyartoun]

Hi all,

I have trouble understanding something. I know it's possible with "argocd in any namespace" to deploy the Application resource to any namespace. However, does that actually limit resourses being created in any namespace? We have a argocd installed in our cluster and a customer wants to use it, but I want to limit which namespace their resources can be deployed to. Is that even possible?

BR

[ChristianCiach]

I know it's possible with "argocd in any namespace" to deploy the Application resource to any namespace. However, does that actually limit resourses being created in any namespace?

No.

I want to limit which namespace their resources can be deployed to. Is that even possible?

Yes! You can limit the which clusters and namespaces an application can deploy to by configuring the corresponding Project of the Application. See spec.destinations at https://argo-cd.readthedocs.io/en/stable/operator-manual/project-specification/

You can even limit which kinds of resources the applications belonging to the project can deploy. For example, by default applications cannot deploy cluster-scoped resources like CRDs.

[mridang]

I'm running into these issues but I just deployed it using Helm. Should I be using the operator for these? Any help will do. 🙏