Simplify Application in Any namespace

[speedfl]

Hello.

I would like to understand why Application in any namespace feature https://argo-cd.readthedocs.io/en/stable/operator-manual/app-any-namespace/ required to add sourceNamespaces in AppProject ?

In the future I would also like to see ApplicationSet to be multi namespace.

However AppProject cannot enforce this as it is for Applications only. Therefore I would probably do a recommendation to use Kyverno, Gatekeeper or custom Admission Webhook to manage this.

I don't think it is a good idea to re-invent the wheel with ArgoCD while this can be achieved with already existing tool. A simple recommendation would do the job.

An example with Kyverno:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: applicationset-name-matches-project
  annotations:
    policies.kyverno.io/title: Ensure ApplicationSet Name Matches Project
    policies.kyverno.io/category: Argo
    policies.kyverno.io/severity: medium
    kyverno.io/kyverno-version: 1.6.2
    policies.kyverno.io/minversion: 1.6.0
    kyverno.io/kubernetes-version: "1.23"
    policies.kyverno.io/subject: ApplicationSet
    policies.kyverno.io/description: >-
      This policy ensures that the name of the ApplicationSet is the
      same value provided in the project.      
spec:
  validationFailureAction: audit
  background: true
  rules:
   - name: app-project-must-match-namespace
      match:
        any:
        - resources:
            kinds:
              - Application
            namespaces:
              - team-one
              - team-two
              - team-three
      preconditions:
        all:
        - key: "{{ request.operation || 'BACKGROUND' }}"
          operator: NotEquals
          value: DELETE
      validate:
        message: "The namespace must match the project."
        pattern:
          spec: 
            project: "{{request.object.metadata.namespace}}"    
    - name: appset-app-project-must-match-namespace
      match:
        any:
        - resources:
            kinds:
              - ApplicationSet
            namespaces:
              - team-one
              - team-two
              - team-three
      preconditions:
        all:
        - key: "{{ request.operation || 'BACKGROUND' }}"
          operator: NotEquals
          value: DELETE
      validate:
        message: "The namespace must match the project."
        pattern:
          spec:
            template:
              spec:
                project: "{{request.object.metadata.namespace}}"

[jannfis]

The sourceNamespaces field defines a list of namespaces an application must exist in in order to specify this AppProject in its own project field. Without this, every application could bind itself to every project, eventually leading to privilege escalation and compromise.

I would like to ask how using a Kyverno (or Gatekeeper, or other tool's) policy is more simple to implement this (very application specific) logic than specifying a list of namespaces in a field in the AppProject?

Also, I see some additional constraints:

• Not everyone uses Kyverno, Gatekeeper or something similar
• Not everyone wants to use Kyverno, Gatekeeper or something similar
• Not everyone wants to learn the policy language of a policy enforcement tool

I'm trying to understand how this is re-inventing the wheel. One is a very simple way to configure this, the other is a very complex, easy-to-get-wrong type piece of configuration.

Argo CD definitely doesn't want to get opinionated about a policy enforcement tool, nor provide (possibly faulty, outdated, etc) configuration snippets for any of those to ensure the security of the system. Don't get me wrong, I'm not arguing against those tools (or the things they implement), I think they are pretty important for a lot of stuff. But I don't think they should solve a problem that is native to Argo CD.

Last but not least, I think for ApplicationSet, the implementation of "any namespace" could be simple enough:

• ApplicationSets will be picked up from namespaces that are in a global list of allowed namespaces (e.g. similar to the --application-namespaces for the application controller)
• Applications from an ApplicationSet will be generated in the same namespace as the ApplicationSet
• From there on, it will be handled as any other Application, e.g. restrictions from the AppProject apply

I don't see the need for an ApplicationSet in namespace foo to be able to generate an application in namespace bar.

[speedfl]

@jannfis thanks a lot for your answer. :)

And moreover thanks a lot for your suggestion in 3 points !!!

I am currently working on #12378 and your help removed the haze in my brain!