support a static allowlist of managed namespaces

Summary

Add support for running one Argo Workflows controller and Argo Server against a static allowlist of namespaces.

Today, Argo Workflows supports:

• cluster-scoped mode, which watches all namespaces and requires cluster-scoped RBAC; or
• namespaced/managed-namespace mode, which watches exactly one namespace.

The existing --managed-namespace option is a single namespace string. There is no mode where one controller/server instance watches a configured set of namespaces, such as ns-1, ns-2, and ns-3.

Motivation

Platform teams often need to provide a shared Argo Workflows installation for several application teams without granting the controller cluster-wide permissions.

This differs from running a separate Argo instance per namespace, and it avoids using instanceID which adds extra efforts for managing individual instances.

This will also reduce memory consumption as it will reduce the number of namespaces and resources watched.

Possible behaviour

Introduce a multi-namespace mode for both workflow-controller and argo server. Possible configuration API:

# workflow-controller-configmap
managedNamespaces:
  - team-a
  - team-b
  - team-c

or add adding environment variable or run time param

MANAGED_NAMESPACES=ns-1,ns-2,ns-3
or 
--managed-namespace=ns-1,ns-2,ns-3

Message from the maintainers:

Love this feature request? Give it a . We prioritise the proposals with the most .