Multi-tenant cluster, want ArgoCD to only touch specific namespaces. Classic. You don't want the devs in namespace `side-project-mess` accidentally getting your production app of record.
Two real ways. Project scopes or cluster resource whitelists.
**Project Scopes** are the clean ArgoCD way. Define a Project, restrict its source repos and, crucially, its destination namespaces.
```yaml
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
name: team-a-prod
namespace: argocd
spec:
destinations:
- namespace: team-a-prod
server: https://kubernetes.default.svc
- namespace: team-a-staging
server: https://kubernetes.default.svc
sourceRepos:
- 'git@github.com:company/team-a-manifests.git'
```
Then your Application manifest must reference this project. No project, no sync.
**Cluster Resource Whitelist** is the sledgehammer. In your ArgoCD ConfigMap (`argocd-cm`), you can define `resource.includes` to *only* allow certain resources in specific namespaces. Everything else is ignored by Argo.
```yaml
data:
resource.exclusions: |
- apiGroups: ["*"]
clusters: ["*"]
namespaces: ["*"]
kinds: ["*"]
resource.inclusions: |
- apiGroups: ["*"]
clusters: ["*"]
namespaces: ["team-a-prod", "team-a-staging"]
kinds: ["*"]
```
The inclusion rule overrides the blanket exclusion. Dangerous if you mess up the YAML.
I use Projects. Lets you also slap on sync windows and role restrictions. The whitelist is for when you really, really don't trust anyone.