Argo CD implements multi-tenancy through two complementary mechanisms: AppProjects (resource-level isolation) and RBAC policies (action-level access control).
AppProject is a CR that scopes what a group of Applications can do:
sourceRepos: limits which Git repositories are allowed as Application sources for this project.destinations: limits which cluster/namespace combinations Applications in this project can deploy to.clusterResourceWhitelist / namespaceResourceBlacklist: controls which Kubernetes resource kinds are permitted.
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
name: team-frontend
namespace: argocd
spec:
sourceRepos:
- https://github.com/org/frontend-config.git
destinations:
- namespace: frontend-*
server: https://kubernetes.default.svc
clusterResourceWhitelist:
- group: ""
kind: Namespace
namespaceResourceBlacklist:
- group: ""
kind: ResourceQuota
RBAC is configured in the argocd-rbac-cm ConfigMap using Casbin policy syntax. Subjects (users, SSO groups, service accounts) are assigned roles that grant permissions on Argo CD resources.
# argocd-rbac-cm data.policy.csv
# p, <subject>, <resource>, <action>, <appproject>/<object>
p, role:frontend-dev, applications, get, team-frontend/*
p, role:frontend-dev, applications, sync, team-frontend/*
p, role:frontend-dev, applications, action/*, team-frontend/*
# g, <user or group>, <role>
g, engineering-frontend@example.com, role:frontend-dev
Built-in roles: role:readonly (view-only across all projects) and role:admin (full access). Custom roles can be scoped to a single AppProject. Combined, AppProjects and RBAC let you give a team full control over their own Applications without them being able to see or affect other teams' workloads.