Namespaced Installation requirements

[mech422]

Summary

Could someone please clarify permissions required for a namespaced install?

We were given a namespace to install argocd to, however it does NOT seem to have cluster read abilities...
Is this a supported configuration ? According to #3191 (comment) : "Read roles do seem to need to be cluster-wide." Can someone knowledgeable confirm or deny this please ?

I've tried adding exclusions for tons of resources that were throwing errors:

data:
resource.exclusions: |
- apiGroups:
- "*"
kinds:
- "persistentvolumeclaims"
- "persistentvolumes"
- "podsecuritypolicies"
- "deployments"
- "admissionregistration.k8s.io"
- "horizontalpodautoscalers"
- "jobs"
- "pods"

but I get ComparisonError's cycling thru all the resources I've already excluded:

ComparisonError failed to sync cluster https://100.64.0.1:443: failed to load initial state of resource StatefulSet.apps: statefulsets.apps is forbidden: User "system:serviceaccount:products-citadel:argocd-application-controller" cannot list resource "statefulsets" in API group "apps" at the cluster scope 2021-03-05 09:33:24 -0700 MST
ComparisonError failed to sync cluster https://100.64.0.1:443: failed to load initial state of resource StatefulSet.apps: statefulsets.apps is forbidden: User "system:serviceaccount:products-citadel:argocd-application-controller" cannot list resource "statefulsets" in API group "apps" at the cluster scope 2021-03-05 09:33:24 -0700 MST
ComparisonError failed to sync cluster https://100.64.0.1:443: failed to load initial state of resource Deployment.apps: deployments.apps is forbidden: User "system:serviceaccount:products-citadel:argocd-application-controller" cannot list resource "deployments" in API group "apps" at the cluster scope 2021-03-05 09:50:52 -0700 MST
ComparisonError failed to sync cluster https://100.64.0.1:443: failed to load initial state of resource Deployment.apps: deployments.apps is forbidden: User "system:serviceaccount:products-citadel:argocd-application-controller" cannot list resource "deployments" in API group "apps" at the cluster scope 2021-03-05 09:50:52 -0700 MST

If someone could clarify the requirements and setup process for Namespace'd installs, I'd appreciate it!

Thanks!

[alexmt]

hello @mech422 ,

Argo CD assumes cluster-wide access. As I understand you want to manage resource in one namespace only. If this is the case you can connect specify namespace in cluster configuration: https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#clusters

You can use argocd CLI as well:

argocd cluster add <context-name> --namespace namespace1 --namespace2

Note: it has a performance penalty. Argo CD uses K8S watch API to monitor resources state. Unfortunately, Kubernetes supports only "watching" only one namespace or all namespaces. So Argo CD has to keep more open watch requests if you configure multiple namespaces in cluster config.

[mech422]

Hi Alex!

Thanks for the help! the 'cluster add' turned out to be the key. I was able to remove the resource black lists once I had done this.