Description of problem: Deployed an Argo cluster from the GitOps operator using a CM. Specified a secret with the namespaces parameter (managed namespaces) and left it blank, which should default to 'All Namespaces'. Instead the cluster defaults to managing the namespace it belongs to. After changing it both with a CM and in the web interface, when openshift remediates, it reverts back to the specific namespace. Deleting the secret manually seems to fix the problem Version-Release number of selected component (if applicable): Openshift 4.7 GitOps 1.2.0 ArgoCD 2.22.0-openshift How reproducible: Haven't tried deleting the Argo cluster yet since we have users on it. Other clusters without the secret configured dont seem to have this issue Steps to Reproduce: 1. Deploy ArgoCD with the following secret kind: Secret apiVersion: v1 metadata: name: <redacted> namespace: <redacted> data: namespaces: '' type: Opaque Actual results: Cluster reverts to only being able to manage the namespace it belongs to Expected results: Manage all namespaces Additional info:
This behavior is expected, currently there is a PR by myself in review (https://github.com/openshift/openshift-docs/pull/35854) to add a change to the OpenShift docs to add cross-namespace Argo CD permissions, which I think should fix this issue- user needs to explicitly elevate their instance to cluster scoped in the subscription. This change will apply to 4.7 and 4.8
@an
Sorry for the rogue comment above, I'm not used to BZ... My PR for this has been merged so therefore I think this issue can be considered resolved.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:0056