Chapter 3. Managing the application resources in non-control plane namespaces
As a cluster administrator, you can create and manage the Application resources in non-control plane namespaces declaratively other than the openshift-gitops control plane namespace. This functionality is called the Applications in any namespace feature in the Argo CD open source project.
As a developer, if you are creating Argo CD applications in non-control plane namespaces other than the openshift-gitops control plane namespace, ensure that your cluster administrator grants the necessary permissions to them.
Otherwise, after the Argo CD reconciliation, you will see an error message similar to the following example:
Example error message
error while validating and normalizing app: error getting application's project: application 'app' in namespace 'dev' is not allowed to use project 'default'
error while validating and normalizing app: error getting application's project: application 'app' in namespace 'dev' is not allowed to use project 'default'
To use this functionality, you must explicitly enable and configure the target namespaces in the following objects:
-
The
ArgoCDcustom resource (CR) of your user-defined cluster-scoped Argo CD instance -
The
AppProjectcustom resource (CR) -
The
ApplicationCR
The process of creating and managing the Application resources in non-control plane namespaces consists of the following procedures:
-
Configuring the
ArgoCDCR of your user-defined cluster-scoped Argo CD instance with the target namespaces. -
Creating and configuring a user-defined
AppProjectinstance in theopenshift-gitopscontrol plane namespace and specify the target namespaces in the.spec.sourceNamespacesfield of the user-definedAppProjectinstance. -
Configuring the
metadata.namespaceand.spec.projectfields of theApplicationCR to reference the target namespaces and user-definedAppProjectinstance.
This functionality is useful in multitenancy environments when you want to manage deployments of Argo CD applications for your isolated teams.
To prevent privilege escalations for your application teams, you must meet the following requirements:
-
Do not configure non-control plane namespaces in the
.spec.sourceNamespacesfield of any privilegedAppProjectinstance, for example, thedefaultinstance of yourAppProjectCR installed in either theopenshift-gitopscontrol plane namespace or your defined namespace. -
Do not grant access to the
openshift-gitopscontrol plane namespace within theAppProjectCRD. -
Always create and configure user-defined
AppProjectinstances in theopenshift-gitopscontrol plane namespace, and then configure non-control plane namespaces in the.spec.sourceNamespacesfield within the corresponding user-definedAppProjectinstance.
3.1. Prerequisites Copy linkLink copied to clipboard!
- You have installed Red Hat OpenShift GitOps 1.13.0 or a later version on your OpenShift Container Platform cluster.
-
You have a user-defined cluster-scoped Argo CD instance in your defined namespace, for example,
spring-petclinicnamespace.
3.2. Configuring the Argo CD CR of your user-defined cluster-scoped Argo CD instance with the target namespaces Copy linkLink copied to clipboard!
As a cluster administrator, you can define a certain set of non-control plane namespaces in which users can create, update, and reconcile Application resources. You must first explicitly configure the target namespaces in the ArgoCD custom resource (CR) of your user-defined cluster-scoped Argo CD instance per your requirements.
Prerequisites
- You are logged in to the OpenShift Container Platform cluster as an administrator.
- You have installed Red Hat OpenShift GitOps 1.13.0 or a later version on your OpenShift Container Platform cluster.
-
You have a user-defined cluster-scoped Argo CD instance in your defined namespace, for example,
spring-petclinicnamespace.
Procedure
-
In the Administrator perspective of the web console, click Operators
Installed Operators. - From the Project list, select the project where the user-defined cluster-scoped Argo CD instance is installed.
- Select Red Hat OpenShift GitOps from the installed Operators list and go to the Argo CD tab.
- Click your user-defined cluster-scoped Argo CD instance.
Configure the
ArgoCDCR of your user-defined cluster-scoped Argo CD instance with the target namespaces:-
Click the YAML tab and edit the YAML file of the
ArgoCDCR. In the
ArgoCDCR, set the value of thesourceNamespacesparameter to include the non-control plane namespaces:Example
ArgoCDCRCopy to Clipboard Copied! Toggle word wrap Toggle overflow - 1
- The name of the user-defined cluster-scoped Argo CD instance.
- 2
- The namespace where you want to run the user-defined cluster-scoped Argo CD instance.
- 3
- The list of non-control plane namespaces for creating and managing
Applicationresources. - 4
- The name of the target namespace for the Argo CD server to create and manage
Applicationresources. - 5
- With wildcards (
*), specifies the name of the target namespaces matching the patternapp-team-*, such asapp-team-1andapp-team-2, for the Argo CD server to create and manageApplicationresources.
Click Save and Reload.
NoteWhen a target namespace is specified under the
sourceNamespacesfield, the Operator adds theargocd.argoproj.io/managed-by-cluster-argocdlabel to the specified namespace.Example
devtarget namespaceCopy to Clipboard Copied! Toggle word wrap Toggle overflow
-
Click the YAML tab and edit the YAML file of the
Verify that Operator adds the
argocd.argoproj.io/managed-by-cluster-argocdlabel to the specified namespace:-
Go to Administration
Namespaces and click Create Namespace. In the Create Namespace dialog box, provide the Name and click Create.
For example, to create
devtarget namespace, enterdevin the Name field. You can repeat the previous steps to create theapp-team-1andapp-team-2target namespaces.The Namespaces page displays the created target namespaces.
-
Click the target namespace and go to the YAML tab to verify the
argocd.argoproj.io/managed-by-cluster-argocdlabel added by the Operator.
-
Go to Administration
Verify that your user-defined cluster-scoped Argo CD instance is configured with a cluster role to manage cluster-scoped resources:
-
Go to User Management
Roles and from the Filter list, select Cluster-wide Roles. Search for the created cluster roles by using the Search by name field. For example,
example-spring-petclinic-argocd-application-controllerandexample-spring-petclinic-argocd-server.The Roles page displays the created cluster roles.
Verify that the following role-based access control (RBAC) resources are created by the GitOps Operator:
Expand Name Kind Purpose <argocd_name>-<argocd_namespace>-argocd-application-controllerClusterRoleandClusterRoleBindingFor the Argo CD Application Controller to watch and list
Applicationresources at cluster-level<argocd_name>-<argocd_namespace>-argocd-serverClusterRoleandClusterRoleBindingFor the Argo CD Server to watch and list
Applicationresources at cluster-level<argocd_name>-<target_namespace>RoleandRoleBindingFor the Argo CD server to manage
Applicationresources in target namespace through the UI, API, or CLI
-
Go to User Management
3.3. Creating and configuring a user-defined AppProject instance with the target namespaces Copy linkLink copied to clipboard!
As a cluster administrator, you can define a certain set of non-control plane namespaces in which users can create, update, and reconcile Application resources. After you configure your user-defined cluster-scoped Argo CD instance with target namespaces, you must create and configure a user-defined AppProject instance in the openshift-gitops control plane namespace. In addition, you must explicitly configure the target namespaces in the .spec.sourceNamespaces field of the user-defined AppProject instance.
Applications in the GitOps control plane namespace (openshift-gitops) are allowed to set their .spec.project field to reference any AppProject instance, regardless of the restrictions placed by the .spec.sourceNamespaces field in the AppProject custom resource (CR).
Prerequisites
- You are logged in to the OpenShift Container Platform cluster as an administrator.
- You have installed Red Hat OpenShift GitOps 1.13.0 or a later version on your OpenShift Container Platform cluster.
Procedure
Create and configure a user-defined
AppProjectinstance in theopenshift-gitopscontrol plane namespace to specify the target namespaces in the.spec.sourceNamespacesfield:-
From the Project list, select the
openshift-gitopsproject. -
In the Administrator perspective of the web console, click Operators
Installed Operators Red Hat OpenShift GitOps and go to the AppProject tab. Click Create AppProject and enter the following configuration in the YAML view:
Example user-defined
AppProjectinstanceCopy to Clipboard Copied! Toggle word wrap Toggle overflow - 1
- The name of the user-defined
AppProjectinstance. - 2
- The control plane namespace where you want to run the user-defined
AppProjectinstance. - 3
- The list of non-control plane namespaces for creating and managing
Applicationresources. - 4
- The name of the target namespace for the Argo CD server to create and manage
Applicationresources. - 5
- With wildcards (
*), specifies the name of the target namespaces matching the patternapp-team-*, such asapp-team-1andapp-team-2, for the Argo CD server to create and manageApplicationresources. - 6
- References to the clusters and namespaces into which applications within the user-defined
AppProjectinstance can deploy. - 7
- References to the repositories from which applications within the user-defined
AppProjectinstance can pull manifests.
Click Create.
The AppProjects page displays the created user-defined
AppProjectinstance.
-
From the Project list, select the
3.4. Creating and configuring the Application CR to reference the target namespace and user-defined AppProject instance Copy linkLink copied to clipboard!
As a cluster administrator, you can define a certain set of non-control plane namespaces in which users can create, update, and reconcile Application resources. After you configure the target namespaces in the .spec.sourceNamespaces field of the user-defined AppProject instance, you must explicitly create and configure the Application custom resource (CR) with the parameters for the metadata.namespace and .spec.project fields to reference the target namespace and user-defined AppProject instance.
Prerequisites
- You are logged in to the OpenShift Container Platform cluster as an administrator.
- You have installed Red Hat OpenShift GitOps 1.13.0 or a later version on your OpenShift Container Platform cluster.
Procedure
Create and configure the
ApplicationCR with the parameters for themetadata.namespaceand.spec.projectfields to reference the target namespace and user-definedAppProjectinstance:- From the Project list, select the target namespace.
-
In the Administrator perspective of the web console, click Operators
Installed Operators Red Hat OpenShift GitOps and go to the Application tab. Click Create Application and enter the following configuration in the YAML view:
Example user-defined
AppProjectinstanceCopy to Clipboard Copied! Toggle word wrap Toggle overflow Click Create.
The Applications page displays the created application.
The
cluster-configsArgo CD application now has the statuses Healthy and Synced.