Cluster wide impact for namespace scoped issue

[dmarquez-splunk]

Checklist:

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug
TL;DR
Applications created for a non-existent namespace causes cluster wide sync errors for unrelated namespaces.

Summary:

We experienced an issue where our CI pipelines created the resources necessary to onboard a new customer namespace, project, and application to the ArgoCD platform. For one reason or another the CI job failed to create the namespace where the customer application resources would get deployed to. This resulted in cluster wide impact for applications in other namespaces which prevented deployments and sync operations.

We agree that if argo is attempting to manage resources/apps in a non-existent namespace then there should be errors. However, we believe that is shouldn't impact all other applications in unrelated namespaces.

To Reproduce

1. Create app/project for a non-existent namespace
2. Attempt to create new apps in valid argocd managed namespaces

Expected behavior

Error is scoped to the app that is created for the non-existent namespace and should not impact other applications

Screenshots

Version

v2.10.2+fcf5d8c

Logs

error synchronizing cache state : failed to sync cluster <CLUSTER_URL> failed to load initial state of resource WorkloadGroup.networking.istio.io: workloadgroups.networking.istio.io is forbidden: User "system:serviceaccount:wfecd:cicd-deployer" cannot list resource "workloadgroups" in API group "networking.istio.io" in the namespace "non-existent-namespace"

The above error was shown in all applications cluster wide