Agent (autonomous mode) wont list/show CRDs for other clusters

[myoung34]

Describe the bug

using the resource proxy to view live manifests for cluster-scoped resources (specifically CustomResourceDefinitions), the agent rejects the request with resource not managed by app, even though the CRD is part of the Application's resource tree and tracked by ArgoCD.

Namespaced resources (Deployments, ReplicaSets, Pods, Services, ConfigMaps, etc.) from the same Application work correctly via the resource proxy.

Setup:

• Principal on cluster A (argocd namespace)
• Agent on cluster B (argocd-agent namespace)
• Application kyverno deployed to cluster B via argocd-agent, managing 65 resources including CRDs
• Agent ClusterRole has wildcard permissions (/ all verbs)
• Resource proxy enabled on both principal and agent

Steps to reproduce the behaviour

• Open the ArgoCD UI on the principal
• Navigate to an Application managed by a remote agent (e.g., cluster-nonprod-green/kyverno)
• Click on a namespaced resource (e.g., ReplicaSet kyverno-reports-controller-76b8ddfcb9) → LIVE MANIFEST loads successfully
• Click on a cluster-scoped CRD (e.g., policyexceptions.kyverno.io) → LIVE MANIFEST fails

Expected behavior
The live manifest for the CRD should be fetched and displayed, since the CRD is part of the Application's resource tree.

Additional context

The UI shows: Resource not found in cluster: apiextensions.k8s.io/v1/CustomResourceDefinition:policyexceptions.kyverno.io

Agent logs:

time="2026-04-04T15:44:39Z" level=info msg="Processing resource request for resource of type apiextensions.k8s.io/v1, Resource=customresourcedefinitions named /policyexceptions.kyverno.io" http_method=GET method=processIncomingResourceRequest module=ResourceProxy uuid=cff4574f-d9ac-4741-ac3a-f62f3f04b887
time="2026-04-04T15:44:39Z" level=error msg="could not request resource: customresourcedefinitions.apiextensions.k8s.io \"policyexceptions.kyverno.io\" is forbidden: resource not managed by app: resource not managed by app" http_method=GET method=processIncomingResourceRequest module=ResourceProxy uuid=cff4574f-d9ac-4741-ac3a-f62f3f04b887

This reproduces for all CRDs in the application

time="2026-04-04T15:44:34Z" level=error msg="could not request resource: customresourcedefinitions.apiextensions.k8s.io \"policies.kyverno.io\" is forbidden: resource not managed by app: resource not managed by app" http_method=GET method=processIncomingResourceRequest module=ResourceProxy uuid=ad954547-d91f-4cc1-ac85-a22746b6c08c
Working example for comparison (namespaced resource from the same app):

time="2026-04-04T15:44:53Z" level=info msg="Processing resource request for resource of type apps/v1, Resource=replicasets named kyverno/kyverno-reports-controller-76b8ddfcb9" http_method=GET method=processIncomingResourceRequest module=ResourceProxy uuid=61b2d1fd-bbae-4f03-8405-3c2000717ace

No errors; the live manifest is returned successfully.

Principal logs: No errors related to CRDs on the principal side. The request reaches the agent and is rejected there.

(From AI below):
The agent's processIncomingResourceRequest has an access control check that verifies whether a requested resource is "managed by" an Application before proxying it. This check appears to fail for cluster-scoped resources like CRDs, likely because the lookup doesn't match resources without a namespace. The RBAC permissions are not the issue (wildcard ClusterRole is in place) — the rejection happens at the application-level access control layer within the resource proxy code.

[myoung34]

Actually its not limited to just remote clusters, this is in cluster-local (same cluster as principal but agent in autonomous mode in argocd-agent ns)

[jannfis]

This is a side-effect of argoproj/argo-cd#17400 and argoproj/argo-cd#613

For the time being, we might want to skip the "is managed?" check for CRDs. The authorization flow from Argo CD would still apply.

[jgwest]

@cjcocokrisp raised argoproj/argo-cd#27907 for this

[cjcocokrisp]

Deployed a test app with a small CRD to an autonomous agent where the repo server was running the image with my patch just to make sure it worked and you can view CRDs in the UI now.

[rayl15]

Opened #968 for the agent side of this. It skips the resource proxy's managed-resource check for GET requests on CRD objects, since CRDs don't carry Argo CD tracking metadata (argoproj/argo-cd#17400) — matching @jannfis's suggestion above. Argo CD's own authorization still gates access.

This is complementary to argoproj/argo-cd#27907 (the opt-in repo-server flag): the agent-side change makes CRDs viewable regardless of whether that flag is enabled.

Scope note: PATCH/DELETE on CRDs and CRD-subresource reads remain gated. Happy to widen that if maintainers prefer.