Install ArgoCD as a tenant

[maksymvavilov]

ArgoCD could come in two "sauces" - the cluster-wide installation and the namespaced one but seems like in either case ArgoCD is expected to be able to list cluster-scoped resources.
As a tenant on the multitenant cluster, I'd like to install an instance of the ArgoCD to the namespace provided to me but despite the application controller service account being restricted to a single namespace it still tries to list cluster-scoped resources.
This leads me to two questions:

1. Is ArgoCD supposed to be installed by a tenant on the cluster?
2. Where I could find examples\guides\docs of such use cases?

[jannfis]

You need to restrict Argo CD to that (or more) namespaces to not have it require cluster wide read privileges.

This is accomplished by setting the namespaces field in the cluster config - you probably want to create one for the in-cluster configuration.

Documentation is here: https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#clusters

[maksymvavilov]

For people stumbling on this discussion: you could take it further and use resourceInclusions\exclusions to do finer tunning