In order to avoid the potential for privilege escalation, cluster administrators (responsible for installing the operator) should specifically identify the namespaces that cluster-scoped Argo Rollouts can be installed to.

The set of valid namespaces for cluster-scoped Argo Rollouts installs is specified (as a comma-separated list) via the CLUSTER_SCOPED_ARGO_ROLLOUTS_NAMESPACES environment variable of the operator.

This allows administrators to ensure that only authorized users have access to those namespaces.

A cluster-scoped Argo Rollouts install – by virtue of having the requirement of writing to objects across all the cluster-namespaces – requires a powerful ClusterRole/Binding. It is thus beneficial to set guard rails on who can access the namespace associated with that install.

See https://docs.google.com/document/d/1ad-4aH7B1fJi7WEEKSzXNpHiz8sebfLCnpaZRhWqIoQ/edit and https://redhat-internal.slack.com/archives/C01RQH8KQ87/p1726093952356569 for implementation details.

Acceptance Criteria (Mandatory)

• New env var 'CLUSTER_SCOPED_ARGO_ROLLOUTS_NAMESPACES': Argo Rollouts will only allow installs of cluster-scoped rollouts into these namespaces (will only reconcile RolloutManagers in these namespace, otherwise an error will be set on .status.conditions).
• Cluster-scoped Rollouts can be installed into 'openshift-gitops' by default, but only if 'CLUSTER_SCOPED_ARGO_ROLLOUTS_NAMESPACES' is empty.
  • Note: we can't hard code a reference to openshift-gitops into the 'argo-rollout-manager' repo, so we will instead need to provide a mechanism for gitops-operator to specify which namespaces are allowed to have cluster-scoped Rollouts installs by default.
  • For an example of how specify this in gitops-operator, see https://github.com/redhat-developer/gitops-operator/blob/6953e5a9936f597eed23f0a81fb28d49393b9ad0/cmd/main.go#L234 .
• See linked google doc for details.
• We will need to backport this to 1.13 and 1.14
• Doc updates required:
  • We will need to ensure this is documented as a breaking change in 1.13/1.14 docs.
  • The example RolloutManager CR on this page should be installed into openshift-gitops namespace. That is, .metadata.namespace should be 'openshift-gitops'
  • We should find a spot in the Rollout docs to document the 'CLUSTER_SCOPED_ARGO_ROLLOUTS_NAMESPACES' env var, and how it can be used to install cluster-scoped Argo Rollouts to different namespaces.
• Unit/E2E tests