All 29 RBAC questions
More in RBAC
How do you create a read-only role scoped to one project? What is a local account and when would you use one? How do you manage RBAC declaratively under GitOps? How do you restrict which repositories a project can use? What permissions are needed to manage ApplicationSets? How do AppProjects and RBAC work together for multi-tenancy? How do you grant fine-grained permissions like sync but not delete? How do you manage RBAC for API/automation accounts (project roles and tokens)? How do you troubleshoot 'permission denied' errors in ArgoCD? How does the scopes setting affect group mapping?
Advertisement
Back to results for “Namespaces”
ArgoCD › RBAC

How do you prevent a team from deploying to namespaces they don't own?

Intermediate

Answer

Constrain the AppProject's destinations to the team's clusters/namespaces (with patterns like team-a-*). Even with sync rights, apps in that project can't target other namespaces, because the project rejects disallowed destinations at validation.
destinations:
  - server: '*'
    namespace: 'team-a-*'
Real-world example Team A's apps can only deploy into team-a-* namespaces; a manifest targeting kube-system is rejected.

Common follow-ups: What enforces the namespace limit? | Do sync rights override project destinations?

Applications Multi-cluster RBAC
All 29 RBAC questions