Currently argocd applies the label openshift.io/cluster-monitoring to all namespaces that deploy a ArgoCD CR instance. This then allows the namespace to create a rogue PrometheusRule that can then have adverse effects on the platform monitoring stack. As the label is applied the rule is rolled out cluster wide. This gives anyone who has argocd instances deployed a way to escalate out of their namespace isolation and affect the entire cluster.