Create a namespace before the other resources (and make the dry-run work)

[OpenGuidou]

Hello,

I have a use case where ArgoCD can only create namespaces in remote clusters. A rolebinding is then automatically created (via policy) to allow it to create any other kind of resources in this namespace.

The goal is to give access to ArgoCD to only namespaces it's creating in this remote cluster.

I'd like to create the namespaces in the same ArgoCD application as the other resources, and I've tried to create the namespace declaratively as a resource, or via the sync option CreateNamespace=true.

Both at failing at the dry-run step as the serviceaccount doesn't have the rights yet to create the other resources.

Would there be a way to skip the dry-run for the initial resources creation, or to have a sync sequencing where we would dry-run then sync groups of resources ?

Like:

1. Dry-run namespace
2. Apply namespace
3. Dry-run service
4. Apply service
5. Dry-run deployment
6. Apply deployment

Instead of the default (using sync-waves):

1. Dry-run namespace
2. Dry-run service
3. Dry-run deployment
4. Apply namespace
5. Apply service
6. Apply deployment