Cluster level Namespace "target-argocd" can not be managed when in namespaced mode

[t0tec]

I'm running argo-cd in namespace mode in namespace kring-argocd. I'm managing one namespace kring-dev within the same cluster where argo-cd is running.

Not ideal but the infrastructure we use are VM's where kubernetes (v1.20.4) is installed is and we are restricted at namespaced scope level. I cannot create clusterroles/clusterrolebindings except when I ask for them. So that's why I use the namespace installation.

I have a SA argocd-manager-namespace-admin within our system namespace kring-system

I have done following steps for managing the cluster:
argocd cluster add $(kubectl config current-context) --name=kring-tst --in-cluster --system-namespace=kring-system --namespace=kring-dev --service-account=argocd-manager-namespace-admin

which results in:

apiVersion: v1
data:
  config: <bearer-token-of-argocd-manager-namespace-admin>
  name: kring-tst
  namespaces: kring-dev
  server: https://kubernetes.default.svc
kind: Secret
metadata:
  labels:
    argocd.argoproj.io/secret-type: cluster
  name: cluster-kubernetes.default.svc-3396314289
  namespace: kring-argocd
type: Opaque

Now when I setup my git project to let argo-cd manage the namespace resource (to recreate from scratch):

apiVersion: v1
kind: Namespace
metadata:
  name: kring-dev

I get the following error in the UI:

ComparisonError | Cluster level Namespace "kring-dev" can not be managed when in namespaced mode | 33 minutes ago (Wed Jun 16 2021 14:55:31 GMT+0200)

When checking if I can create a namespace with the argocd-manager-namespace-admin SA

$ kubectl auth can-i create namespaces --as system:serviceaccount:kring-system:argocd-manager-namespace-admin
Warning: resource 'namespaces' is not namespace scoped
yes

So because of the warning the resource 'namespaces' is not namespace scoped I was thinking it's not possible to manage namespaces within my git project? Or is there any workaround except for using the argo-cd default installation (non namespaced mode)?

[jannfis]

Hi @t0tec,

once you configure Argo CD to be namespace scoped, it will not be able to handle any cluster-scoped resources anymore. And as you correctly pointed out, Namespace is such a cluster scoped resource. You can still manage resources within that Namespace in namespaced-mode.

So yes, if you need to manage cluster-scoped resource, you would need to install the cluster-scoped manifests (and also remove the namespaces limitation from the cluster secret).

[t0tec]

Thank you for the confirmation!