Permit only Project-scoped clusters to be a valid Destination

[blakepettersson]

Summary

It seems to be the case that project-scoped Applications can be installed onto clusters which are not a part of the same project.

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: "some-app"
spec:
  destination:
    # This destination might not actually be a cluster which belongs to `foo-project`
    server: https://some-k8s-server/
    namespace: "some-ns"
  project: foo-project

Motivation

So far this has not been a problem, but it would be nice to ensure that this situation cannot happen at all. We have a bunch of developers that are slinging Applications left and right, and we'd like to ensure that mistakes (or something more... sinister) cannot happen.

Proposal

In AppProjectSpec we would add an extra attribute, permitOnlyProjectScopedClusters or something similar.

Then in app_project_types.go, we can extend the existing validation we have on IsDestinationPermitted to be something like this:

func (proj AppProject) IsDestinationPermitted(dst ApplicationDestination, projectClusters func(project string) ([]*Cluster, error)) (bool, error) {
        // The existing logic we have for isDestinationPermitted
	destinationMatched := proj.isDestinationPermitted(dst) 
	if destinationMatched && proj.Spec.PermitOnlyProjectScopedClusters {
		clusters, err := projectClusters(proj.Name)
		if err != nil {
			return false, err
		}

		// TODO: If no project clusters are found, return an error instead?
		for _, cluster := range clusters {
			if cluster.Server == dst.Server {
				return true, nil
			}
		}

		return false, nil
	}

	return destinationMatched, nil
}

projectClusters is a function which would wrap ArgoDB.GetProjectClusters, where we'd get all clusters for the given AppProject and then check if that a destination is indeed a part of the given AppProject.

[crenshaw-dev]

Would you be up for writing a PR?

@alexmt and @jannfis do you agree that this restriction would make sense?

[blakepettersson]

Yes, of course 😄