I have some crude tooling which tries to make rancher and argocd harmonious. I'm currently trying to get some permissions concepts aligned between the 2 (argocd driven pushing

ProjectRoleTemplateBinding

into rancher). Running this in the cluster with a service account results in the webhook rejecting the management of the binding with

is attempting to grant RBAC permissions not currently held

, what would be the best way around this? Can I ignore that check on specific namespaces or somehow flag the service account to be ignored in this context?