ArgoCD Custom Role feature with namespaced scoped role and not cluster role

[Cyben]

Hello,
I'm using ArgoCD as an operator in my environment and by default it creates multiple service accounts.
I'm looking into minimizing the permissions of those service accounts.

For example for the argocd-argocd-server the below rule is included:

- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - get
  - patch
  - delete

This rule, especially the option to delete everything is complitely unnecessary in my case.

I have reviewed and tested the Custom Role feature, the problem with that solution is the use of Cluster Role.
While the argocd-argocd-server should have access to secrets in the namespace it is installed in, there is no reason to give it cluster scoped access to secrets not even for read usage.

What would be the proper solution here?
I there any other solution for that use-case?