ArgoCD create child HNC namespace

[Mais316]

I am trying to evaluate PR generator that spins up a dynamic review env, issue is we are not allowing our customers to create namespace outside hnc.

So how to make ArgoCD create app inside a child namespace, in general how to tell argocd that the new namespace is child of another namespace?

[crenshaw-dev]

You could use the CreateNamespace sync option to have the Application automatically create the namespace in which the preview app can live.

Alternatively, if you want to use a single namespace for all preview environments, you could use Helm to enforce prefixing all resource names with some unique name.

how to tell argocd that the new namespace is child of another namespace?

I'm not sure what this means. As far as I know, namespaces cannot be "children" of other namespaces.

[O5ten]

how to tell argocd that the new namespace is child of another namespace?

I'm not sure what this means.

I believe that @Mais316 is referring to Hierarchical Namespaces which is often used by managed platform vendors to have a top-namespace that propagates roles and rolebindings and similar resources to child-namespaces. I firmly believe that this is something that the Argo project should support in the long-run. Right now we have to create our SubnamespaceAnchors by hand. ✋🏻

https://kubernetes.io/blog/2020/08/14/introducing-hierarchical-namespaces/

[BronzeDeer]

@Mais316 and for anyone else happening across this:

You can work around this issue by creating an app that uses a very slim app of apps pattern which creates two apps, let's call them "sub-namespace" and "actual-app". "sub-namespace targets the parent namespace and creates only a SubnamespaceAnchor, while "actual-app" targets the new sub-namespace created by the Anchor. Eventual reconciliation will ensure that this works correctly, but it will likely work more slowly than doing imperatively it inside the AppSetController.

As the HNC picks up popularity or even gets considered for inclusion in kKubernetes by default, ArgoCD will likely have to start becoming more aware/compatible with it and its concepts. A big part/problem which might also relevant to the problem discussed by OP is tracking and applying correct self-service ability via "application-namespaces" and AppProject destination namespaces. Both currently only allow matching arbitrary future namespaces using name globs (typically "-*"). To support HNC, both would need to be able to match on label (example: create a root name-space argocd-self-service, and then match application-namespaces on the tree label argocd-self-service.tree.hnc.x-k8s.io/depth.

There are various considerations especially around security, performance and caching when allowing label based-matching.

@crenshaw-dev I want to start a request for comments around the design considerations before I begin writing a PR. Is it better to do this in an issue or a Discussion post?