github.com/argoproj-labs/argocd-operator@v0.10.0/docs/usage/apps-in-any-namespace.md (about)

     1  # Applications in any namespace
     2  
     3  **Current feature state**: Beta
     4  
     5  Argo CD supports managing Application resources in namespaces other than the control plane's namespace (which is usally argocd), but this feature has to be explicitly enabled and configured appropriately.
     6  
     7  Argo CD administrators can define a certain set of namespaces where Application resources may be created, updated and reconciled in. However, applications in these additional namespaces will only be allowed to use certain AppProjects, as configured by the Argo CD administrators. This allows ordinary Argo CD users (e.g. application teams) to use patterns like declarative management of Application resources, implementing app-of-apps and others without the risk of a privilege escalation through usage of other AppProjects that would exceed the permissions granted to the application teams.
     8  
     9  !!! note
    10      This feature is considered beta feature in upstream Argo CD as of now. Some of the implementation details may change over the course of time until it is promoted to a stable status.
    11  
    12  ## Using application-namespaces
    13  
    14  In order to enable this feature, specify the namespaces where Argo CD should manage applications in the ArgoCD YAML with `spec.sourceNamespaces`. This field also supports wildcards, allowing flexible and dynamic namespace configurations. For example:
    15  
    16  ## Enable application creation in a specific namespace
    17  ```yaml
    18  apiVersion: argoproj.io/v1alpha1
    19  kind: ArgoCD
    20  metadata:
    21    name: example-argocd
    22  spec:
    23    sourceNamespaces:
    24      - some-namespace
    25  ```
    26  In this example:
    27  
    28  - Permissions are granted only to the specific namespace `some-namespace`.
    29  
    30  ## Enable application creation in namespaces matching a glob pattern
    31  
    32  ```yaml
    33  apiVersion: argoproj.io/v1alpha1
    34  kind: ArgoCD
    35  metadata:
    36    name: example-argocd-wildcard-pattern
    37  spec:
    38    sourceNamespaces:
    39      - app-team-*
    40  ```
    41  In this example:
    42  
    43  - Permissions are granted to namespaces matching the pattern `app-team-*`, such as `app-team-1`, `app-team-2`, etc.
    44  
    45  ## Enable application creation in all namespaces
    46  
    47  ```yaml
    48  apiVersion: argoproj.io/v1alpha1
    49  kind: ArgoCD
    50  metadata:
    51    name: example-argocd-all-namespaces
    52  spec:
    53    sourceNamespaces:
    54      - '*'
    55  ```
    56  In this example:
    57  
    58  - Permissions are granted for all namespaces on the Argo CD cluster using the `*` wildcard.
    59  
    60  For additional details on allowing namespaces in an AppProject, check the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/app-any-namespace/#allowing-additional-namespaces-in-an-appproject). This feature is also essential to enable apps-in-any-namespace.
    61  
    62  When a namespace is specified under `sourceNamespaces`, operator adds `argocd.argoproj.io/managed-by-cluster-argocd` label to the specified namespace. For example, the namespace would look like below:
    63  
    64  ```yaml
    65  apiVersion: v1
    66  kind: Namespace
    67  metadata:
    68    labels:
    69      argocd.argoproj.io/managed-by-cluster-argocd: example-argocd
    70      kubernetes.io/metadata.name: some-namespace
    71    name: some-namespace
    72  ```
    73  
    74  **Things to consider:**
    75  
    76  * No namespace can be managed by multiple argo-cd instances (cluster scoped or namespace scoped) i.e, only one of either `managed-by` or `managed-by-cluster-argocd` labels can be applied to a given namespace. We will be prioritizing `managed-by` label in case of a conflict as this feature is currently in beta, so the new roles/rolebindings will not be created if namespace is already labelled with `managed-by` label, and they will be deleted if a namespace is first added to the `sourceNamespacs` list and is later also labelled with `managed-by` label.
    77  
    78  * Users will not be create/manage apps and create app resources in the same namespace that is added to `sourceNamespaces` (as they both require their own labels) out of the box. As a workaround users will have to create custom roles to be able to create app resources in the namespace added to `sourceNamespaces`.
    79  
    80