application-controller listing deployments since v2.9.3

[therealdwright]

Checklist:

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug

Since upgrading to v2.9.3 the application controller has started listing deployments causing large volumes of access denied events.

To Reproduce

Upgrade to v2.9.3 using namespace install and observe events from system:serviceaccount:argocd:argocd-application-controller listing v1/deployments

Expected behavior

Access is granted if this call is necessary.

Screenshots

Version

argocd-application-controller/v2.9.3+6eba5be (linux/amd64)

[therealdwright]

I attempted to patch the RBAC with the list deployments permission, and then it started performing watch on deployments. Is it expected in the new release for ArgoCD to perform these operations? I want to verify before continuing to add more RBAC.

[crenshaw-dev]

It is expected. I believe @ishitasequeira plans to open a PR to add the necessary RBAC.

[jgwest]

Fixed by #16785