Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 1. Managing the application set resources in non-control plane namespaces

Important

Argo CD application sets in non-control plane namespaces is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

By using application sets, you can automate and manage the deployments of multiple Argo CD applications declaratively from a single mono-repository to many clusters at once with greater flexibility.

With Red Hat OpenShift GitOps 1.12 and later, as a cluster administrator, you can create and manage the ApplicationSet resources in non-control plane namespaces declaratively, other than the openshift-gitops control plane namespace, by explicitly enabling and configuring the ArgoCD and ApplicationSet custom resources (CRs) as per your requirements. This functionality is particularly useful in multitenancy environments when you want to manage deployments of Argo CD applications for your isolated teams. This functionality is called the ApplicationSet in any namespace feature in the Argo CD open source project.

Note

The generated Argo CD applications can create resources in any non-control plane namespace. However, the application itself will be in the same namespace as the application set resources.

1.1. Prerequisites
Copy link

As a cluster administrator, you can define a certain set of non-control plane namespaces wherein users can create, update, and reconcile ApplicationSet resources. You must explicitly enable and configure the ArgoCD and ApplicationSet custom resources (CRs) as per your requirements.

Procedure

  1. Set the sourceNamespaces parameter for the applicationSet spec to include the non-control plane namespaces:

    Example Argo CD custom resource: 

    apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
  name: example
  namespace: spring-petclinic
spec:
  applicationSet:
    sourceNamespaces:
      - dev

    where:

    spec.applicationSet
    Specifies the list of non-control plane namespaces for creating and managing ApplicationSet resources.
    Note

    At the moment, the use of wildcards (*) is not supported in the .spec.applicationSet.sourceNamespaces field.

  2. Verify that the following role-based access control (RBAC) resources are either created or modified by the GitOps Operator:

    Expand
    NameKindPurpose

    <argocd_name>-<argocd_namespace>-argocd-applicationset-controller

    ClusterRole and ClusterRoleBinding

    For the Argo CD ApplicationSet Controller to watch and list ApplicationSet resources at cluster-level

    <argocd_name>-<argocd_namespace>-applicationset

    Role and RoleBinding

    For the Argo CD ApplicationSet Controller to manage ApplicationSet resources in target namespace

    <argocd_name>-<target_namespace>

    Role and RoleBinding

    For the Argo CD server to manage ApplicationSet resources in target namespace through UI, API, or CLI

    Note

    The Operator adds the argocd.argoproj.io/applicationset-managed-by-cluster-argocd label to the target namespace.

Red Hat OpenShift GitOps controls which namespaces an Argo CD instance can use to create and manage ApplicationSet resources.

You enable this behavior by specifying allowed namespaces in the Argo CD custom resource (CR) using the spec.applicationSet.sourceNamespaces field. The Red Hat OpenShift GitOps Operator uses this configuration to determine which namespaces are permitted to host ApplicationSet resources and automatically provisions the required role-based access control (RBAC) resources.

The spec.applicationSet.sourceNamespaces field supports the following namespace selectors:

  • Explicit namespace names
  • Glob-style wildcard patterns
  • Regular expression patterns

The Red Hat OpenShift GitOps Operator evaluates these selectors at reconcile time and applies permissions to all matching namespaces. Permissions are also automatically applied to newly created namespaces that match the configured selectors.

To enable an Argo CD instance to manage ApplicationSet resources in a specific namespace, add the namespace name to the spec.applicationSet.sourceNamespaces field in the Argo CD custom resource.

Procedure

  1. Add the namespace name to the spec.applicationSet.sourceNamespaces field in the Argo CD custom resource: 

    apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
  name: example
spec:
  sourceNamespaces:
    - foo
  applicationSet:
    sourceNamespaces:
      - foo

    In this example, the Argo CD instance named example can create and manage ApplicationSet resources in the foo namespace.

1.3.2. Define glob-style in wildcard patterns
Copy link

To grant permissions across multiple namespaces that share a common naming convention, use glob-style wildcard patterns.

Procedure

  1. Use glob-style wildcard patterns in the spec.applicationSet.sourceNamespaces field to grant permissions across multiple namespaces: 

    apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
  name: example
spec:
  sourceNamespaces:
    - team-*
  applicationSet:
    sourceNamespaces:
      - team-*

    This configuration allows the Argo CD instance to manage ApplicationSet resources in namespaces, such as team-1 and team-2.

1.3.3. Define regular expressions in patterns
Copy link

To precisely control which namespaces receive permissions, use regular expressions. Regular expression patterns must be wrapped in forward slashes (/pattern/).

Procedure

  1. Use regular expression patterns wrapped in forward slashes in the spec.applicationSet.sourceNamespaces field: 

    apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
  name: example
spec:
  sourceNamespaces:
    - team-*
  applicationSet:
    sourceNamespaces:
      - /^team-(frontend|backend)$/
      - /^team-[0-9]+$/

    In this example, permissions are granted only to namespaces that match the specified regular expressions.

Note

Patterns wrapped in forward slashes (/pattern/\) are treated as regular expressions. Patterns without slashes are treated as glob-style wildcard patterns.

Important

To create applications in non-control-plane namespaces, Apps in Any Namespace must be enabled. Ensure that the target namespace names are included in the spec.sourceNamespaces field of the Argo CD custom resource.

Warning

Avoid using broad patterns. These patterns can match a large number of namespaces, including system or sensitive namespaces, and might grant unintended access. Use the most specific pattern that meets your requirements and regularly review which namespaces match your configuration.

1.4. Allowing Source Code Manager Providers
Copy link

Important

Please read this section carefully. Misconfiguration could lead to potential security issues.

Allowing ApplicationSet resources in non-control plane namespaces can result in the exfiltration of secrets through malicious API endpoints in Source Code Manager (SCM) Provider or Pull Request (PR) generators. To prevent unauthorized access to sensitive information, the Operator disables the SCM Provider and PR generators by default as a precautionary measure.

Procedure

  1. To use the SCM Provider and PR generators, explicitly define a list of allowed SCM Providers:

    Example Argo CD custom resource: 

    apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
  name: example-argocd
spec:
  applicationSet:
    sourceNamespaces:
      - dev
    scmProviders:
      - https://git.mydomain.com/
      - https://gitlab.mydomain.com/

    where:

    spec.applicationSet.scmProviders
    Specifies the list of URLs of the allowed SCM Providers.
    Note

    If you use a URL that is not in the list of allowed SCM Providers, the Argo CD ApplicationSet Controller will reject it.

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top