Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

此内容没有您所选择的语言版本。

Chapter 1. Managing the application set resources in non-control plane namespaces

Important

Argo CD application sets in non-control plane namespaces is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

By using application sets, you can automate and manage the deployments of multiple Argo CD applications declaratively from a single mono-repository to many clusters at once with greater flexibility.

With Red Hat OpenShift GitOps 1.12 and later, as a cluster administrator, you can create and manage the ApplicationSet resources in non-control plane namespaces declaratively, other than the openshift-gitops control plane namespace, by explicitly enabling and configuring the ArgoCD and ApplicationSet custom resources (CRs) as per your requirements. This functionality is particularly useful in multitenancy environments when you want to manage deployments of Argo CD applications for your isolated teams. This functionality is called the ApplicationSet in any namespace feature in the Argo CD open source project.

Note

The generated Argo CD applications can create resources in any non-control plane namespace. However, the application itself will be in the same namespace as the application set resources.

1.1. Prerequisites
复制链接

As a cluster administrator, you can define a certain set of non-control plane namespaces wherein users can create, update, and reconcile ApplicationSet resources. You must explicitly enable and configure the ArgoCD and ApplicationSet custom resources (CRs) as per your requirements.

Procedure

  1. Set the sourceNamespaces parameter for the applicationSet spec to include the non-control plane namespaces:

    Example Argo CD custom resource

    apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
  name: example
  namespace: spring-petclinic
spec:
  applicationSet:
    sourceNamespaces:
    1 
    
      - dev
    2
    Copy to Clipboard Toggle word wrap

    1
    List of non-control plane namespaces for creating and managing ApplicationSet resources.
    2
    Name of the target namespace for the Argo CD server to create and manage ApplicationSet resources.
    Note

    At the moment, the use of wildcards (*) is not supported in the .spec.applicationSet.sourceNamespaces field.

  2. Verify that the following role-based access control (RBAC) resources are either created or modified by the GitOps Operator:

    Expand
    NameKindPurpose

    <argocd_name>-<argocd_namespace>-argocd-applicationset-controller

    ClusterRole and ClusterRoleBinding

    For the Argo CD ApplicationSet Controller to watch and list ApplicationSet resources at cluster-level

    <argocd_name>-<argocd_namespace>-applicationset

    Role and RoleBinding

    For the Argo CD ApplicationSet Controller to manage ApplicationSet resources in target namespace

    <argocd_name>-<target_namespace>

    Role and RoleBinding

    For the Argo CD server to manage ApplicationSet resources in target namespace through UI, API, or CLI

    Note

    The Operator adds the argocd.argoproj.io/applicationset-managed-by-cluster-argocd label to the target namespace.

1.3. Allowing Source Code Manager Providers
复制链接

Important

Please read this section carefully. Misconfiguration could lead to potential security issues.

Allowing ApplicationSet resources in non-control plane namespaces can result in the exfiltration of secrets through malicious API endpoints in Source Code Manager (SCM) Provider or Pull Request (PR) generators. To prevent unauthorized access to sensitive information, the Operator disables the SCM Provider and PR generators by default as a precautionary measure.

Procedure

  • To use the SCM Provider and PR generators, explicitly define a list of allowed SCM Providers:

    Example Argo CD custom resource

    apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
  name: example-argocd
spec:
  applicationSet:
    sourceNamespaces:
      - dev
    scmProviders:
    1 
    
      - https://git.mydomain.com/
      - https://gitlab.mydomain.com/
    Copy to Clipboard Toggle word wrap

    1
    The list of URLs of the allowed SCM Providers.
Note

If you use a URL that is not in the list of allowed SCM Providers, the Argo CD ApplicationSet Controller will reject it.

返回顶部
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

Theme

© 2025 Red Hat