Managing Argo CD Multi-Tenancy Effectively
summary
Recommends separating cluster-config Argo from tenant Argo instances (or sharding per-team) to avoid privilege escalation, using app projects per team with project-specific roles and a global project for inherited blacklists and sync windows, and preferring declarative management via Git PRs. Warns namespace-scoped Argo CD hits scale pain in the tens/hundreds of namespaces, so cluster-scope plus resource inclusions/exclusions or blacklists is a common mitigation. Notes Applications/AppSets in Any Namespace (beta) and impersonation as promising fixes for safer multi-tenancy.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 0:22Agenda
- 0:48Overview
- 4:44ChallengesRecommendations
- 8:29Declarative Management
- 11:26ARB Recommendations
- 17:05The Future
related talks
26mUnlocking the Power of Multi-Tenancy in ArgoCD: A Journey with Expedia..
38mMulti-Tenancy For Argo Workflows And Argo CD At Adobe
21mMulti-Tenant ArgoCD with security and isolation
24mThe Hidden Dangers of Defaults: Securing Multi-Tenant Argo CD Install...
13mMitigating Privilege Escalation in Multi-Tenant Argo CD
17mRedefining the Multi-Cluster Story of Argo CD
24mScaling Argo Security and Multi-Tenancy in AWS EKS at the New York Times
18mUnveil the Secret Ingredients for Argo CD in the Enterprise-Scale