"Deny destinations" for Projects

[thomassandslyst]

Summary

Currently projects can have a list of destinations to the namespaces and clusters they can deploy to, but there is nothing to say "You can deploy anywhere except...".

Motivation

We have a few general use projects that all our deployments go into currently. We've now got a demand to make a protected area but ArgoCD's projects model doesn't allow you to specify where you can't deploy, and given that ArgoCD has cluster admin anyone can make a deployment in the normal project which deploys to a protected namespace.

Proposal

Support glob-style strings for the destinations namespace and server elements with the ability to deny it by prefixing with "!". This is used quite well in Serverless's patterns.
If there are only "allow" destinations then it would default to deny-everything-else.
If there are only "deny" destinations then it would default to allow-everything-else.

[flaviomoringa]

Just to push this, this is tremendously important for us, since we want our users to be able to deploy what they want, but to not mess around with the namespace where our landscape apps are running.

Is there any way around this with the current versions?

Thanks

[ricardojdsilva87]

Hello,
Just to add some information. The deny to namespace for example would need to be done in argo side, meaning that we could not use the roles, rolebinding, clusterrolebinding settings for kubernetes like it's being done right now, because the kubernetes API can used to only allow access to the resources and does not support regex patterns or the deny.
This limits the actions on argocd side since if we allow the deploy to just 1 namespace it will limit the user to create new namespaces and if we deny access to create certain API resources (pods, deployments, ingresses) it will be denied to all namespaces.
This would be a great feature to argo!
Thanks

[ricmano]

I also really need this feature

[tzeappa]

This is a feature that I would also need very much. Thank you!

[crenshaw-dev]

@thomassandslyst what do you think of the !exclude pattern in the destinations field vs. a namespace field in the resource deny-list? #9047

[blakepettersson]

IMO I think that having the !exclude pattern is more extendable; we could extend this pattern elsewhere to e.g. exclude sources.

[TiaguPinto]

I also really need this feature

[mvlbarcelos]

Hello.
Would be amazing this feature.

[alfredo-gil]

Hello,
It would be great to have this feature!

[blakepettersson]

Need some final approvals on #9652 for that to happen 😄

[crenshaw-dev]

This will be in 2.5 (~mid-August). Thank you @blakepettersson!