I personally consider the ArgoCD UI an anti-feature. Attaching some hulking mass of Javascript dependencies to the thing that has cluster-admin rights to my production cluster is unnecessary attack surface for me.
ArgoCD also has its own auth system and permissions. You give ArgoCD cluster-admin rights, then it uses impersonation to pretend like it has lower permissions. One little bug there and you can trick ArgoCD into escalating your permissions, which happens a lot: https://github.com/argoproj/argo-cd/security/advisories/GHSA...
While not officially supported, you can technically deploy Flux with limited permissions, but ArgoCD's dependence on impersonation means it cannot run with lower permissions.
ArgoCD also has its own auth system and permissions. You give ArgoCD cluster-admin rights, then it uses impersonation to pretend like it has lower permissions. One little bug there and you can trick ArgoCD into escalating your permissions, which happens a lot: https://github.com/argoproj/argo-cd/security/advisories/GHSA...
While not officially supported, you can technically deploy Flux with limited permissions, but ArgoCD's dependence on impersonation means it cannot run with lower permissions.