ApplicationSet controller cannot access appprojects (2.12.0)

[robertcoltheart]

Describe the bug
Using argocd-operator v0.11.0

When configuring the appset controller with ArgoCD 2.12.0, the controller fails to create applications because the service account does not have permission to list or watch AppProjects

level=info msg="listed ApplicationSets" count=1 type=createSecretEventHandler  
7 reflector.go:539] pkg/mod/k8s.io/client-go@v0.29.6/tools/cache/reflector.go:229: failed to list *v1alpha1.AppProject:appprojects.argoproj.io is forbidden: User "system:serviceaccount:argocd:example-applicationset-controller" cannot list resource "appprojects" in API group "argoproj.io" in the namespace "argocd"
7 reflector.go:147] pkg/mod/k8s.io/client-go@v0.29.6/tools/cache/reflector.go:229: Failed to watch *v1alpha1.AppProject: failed to list *v1alpha1.AppProject: appprojects.argoproj.io is forbidden: User "system:serviceaccount:argocd:example-applicationset-controller" cannot list resource "appprojects" in API group "argoproj.io" in the namespace "argocd"

Upon inspection, the policy rules created for app sets seems to only include get for appprojects and the controller also needs list and watch. See https://github.com/argoproj-labs/argocd-operator/blob/master/controllers/argocd/policyrule.go#L497

From the main Argo repo, this role should also include list and watch, see https://github.com/argoproj/argo-cd/blob/master/manifests/base/applicationset-controller/argocd-applicationset-controller-role.yaml#L27

To Reproduce

apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
  name: example
  namespace: argocd
spec:
  version: v2.12.0
  applicationSet:
    enabled: true
  server:
    insecure: true

Expected behavior
The correct role permissions should be used

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.

[domvie]

Having the same issue on 2.12. Did you manage to solve this by manually adding the policies?

[svghadi]

Thanks, @robertcoltheart , for reporting the issue. It seems that the problem is affecting only certain appset generators. For example, when I tried the clusters and list generators, I didn't see any errors in the logs, and the applications were created successfully. However, with the git generator, I did encounter these errors. Anyway, it's a bug that has been fixed upstream with argoproj/argo-cd#18943. I'll take a look at your PR shortly.