Argo CD ApplicationSet Controller

repository·master·Indexed 20 days ago

https://github.com/argoproj/applicationset

A Kubernetes controller that automates the creation and management of multiple Argo CD Applications using templating and generators. It enables multi-cluster deployment, monorepo support, and self-service application delivery by acting as an Application factory that manages Application CRDs based on ApplicationSet resources.

Tokens
19.4K
Snippets
48
Records
71
Agent score
69%

What's inside Argo CD ApplicationSet

  1. What is the Argo CD ApplicationSet Controller?

    master

    The ApplicationSet controller is a Kubernetes controller that introduces the ApplicationSet CustomResourceDefinition (CRD). It enables automated management of multiple Argo CD Applications across various clusters and monorepos from a single resource.

    Key capabilities include:

    • Multi-cluster deployment: Deploy Argo CD Applications to multiple Kubernetes clusters simultaneously.
    • Monorepo support: Deploy multiple applications from a single Git repository.
    • Self-service: Allows unprivileged users to deploy applications to destination clusters/namespaces without requiring cluster administrator intervention.
    • Templated automation: Uses a single ApplicationSet resource to create, modify, and manage multiple Application resources via parameter substitution.
  2. What is the ApplicationSet controller?

    master

    The ApplicationSet controller is a Kubernetes controller that adds support for the ApplicationSet CustomResourceDefinition (CRD). It works alongside an existing Argo CD installation to automate and scale the management of Argo CD Application resources.

    Key capabilities include:

    • Multi-cluster targeting: Use a single manifest to target multiple Kubernetes clusters.
    • Multi-app deployment: Deploy multiple applications from one or more Git repositories using a single manifest.
    • Monorepo support: Efficiently manage multiple Argo CD Application resources defined within a single Git repository.
    • Multitenancy: Enables individual tenants in a cluster to deploy applications without requiring privileged cluster administrator intervention for every destination cluster or namespace.
  3. How ApplicationSet generators and templates work together

    master

    An ApplicationSet is comprised of two main stanzas:

    1. spec.generators: A producer that generates a list of parameters (key-value pairs).
    2. spec.template: An Argo CD Application template that uses those parameters via substitution.

    The Workflow

    1. The controller processes the generator to produce a set of parameters.
    2. These parameters are substituted into the {{parameter name}} placeholders within the template section.
    3. For every set of parameters produced, a unique Argo CD Application resource is rendered and created (or updated) in the Argo CD namespace.
    4. The Argo CD controller then manages these instantiated Application resources.
  4. Understand the lifecycle of ApplicationSet and Application resources

    master

    When an ApplicationSet creates Application resources, they are linked via .metadata.ownerReferences. By default, the lifecycle of the ApplicationSet, the Application, and the managed resources (e.g., Deployments, Services) are equivalent.

    When an ApplicationSet is deleted, the following sequence occurs:

    1. The ApplicationSet resource is deleted.
    2. The child Application resources are deleted (via owner references).
    3. The deployed resources on the managed cluster are deleted (handled by Argo CD via the resources-finalizer.argocd.argoproj.io finalizer).

    To prevent the deletion of deployed resources when the Application is deleted, you must set .syncPolicy.preserveResourcesOnDeletion to true in the ApplicationSet specification.

  5. Use generator templates to override spec-level templates

    master

    You can define a template field directly within a generator to override values in the global .spec.template. Generator templates act as patches against the outer template fields.

    Precedence Rules:

    • If both the generator template and the spec.template contain the same field, the generator's value takes precedence.
    • If only one template contains a specific field, that value is used.

    This allows you to define a common baseline in .spec.template and provide specific overrides for individual elements in a generator (e.g., a list or cluster generator).

    apiVersion: argoproj.io/v1alpha1
    kind: ApplicationSet
    metadata:
      name: guestbook
    spec:
      generators:
      - list:
          elements:
            - cluster: engineering-dev
              url: https://kubernetes.default.svc
          template:
            spec:
              source:
                # This path overrides the one in spec.template
                path: 'examples/template-override/{{cluster}}-override'
      template:
        spec:
          source:
            path: examples/template-override/default
  6. Understand ApplicationSet partial processing behavior in v0.3.0

    master

    In versions prior to v0.3.0, if an ApplicationSet generated any invalid Application resources (e.g., failing internal validation), the entire set was blocked, and no applications were created or modified.

    Starting with v0.3.0, the controller implements partial processing:

    • Invalid Applications: These are skipped.
    • Valid Applications: These will now be processed (created or modified) even if other applications generated by the same ApplicationSet are invalid.

    Action required: No changes to your ApplicationSet resource are required, but be aware that an upgrade may cause valid applications to suddenly appear or update if they were previously being blocked by a single invalid sibling application.

  7. How the Merge generator works

    master

    The merge generator combines parameters from a base (first) generator with matching parameter sets from subsequent generators.

    Matching Logic

    A parameter set is considered a match if it has the same values for the keys specified in mergeKeys. Non-matching parameter sets are discarded.

    Precedence

    Override precedence follows a bottom-to-top rule: values from a matching parameter set produced by a later generator (e.g., generator 3) take precedence over values from an earlier generator (e.g., generator 2).

    Use the merge generator when you have a broad set of parameters but need to apply specific overrides to a subset of them.

  8. How the Cluster Generator works

    master

    The Cluster generator identifies clusters registered with Argo CD (stored as Secrets in the Argo CD namespace) and produces parameters to target them. For every cluster secret found, it provides the following parameters to the Application template:

    • name: The name of the cluster from the Secret.
    • nameNormalized: The cluster name converted to lowercase alphanumeric characters, -, or . (useful for creating valid Kubernetes resource names).
    • server: The cluster server URL from the Secret.
    • metadata.labels.<key>: Any label present in the Secret's metadata.
    • metadata.annotations.<key>: Any annotation present in the Secret's metadata.

    This allows you to dynamically generate Applications that target specific clusters using their metadata.

    apiVersion: argoproj.io/v1alpha1
    kind: ApplicationSet
    metadata:
      name: guestbook
      namespace: argocd
    spec:
      generators:
      - clusters: {}
      template:
        metadata:
          name: '{{nameNormalized}}-guestbook'
        spec:
          project: "default"
          source:
            repoURL: https://github.com/argoproj/argocd-example-apps/
            targetRevision: HEAD
            path: guestbook
          destination:
            server: '{{server}}'
            namespace: guestbook
  9. How the Matrix generator works

    master

    The Matrix generator is a combination-type generator that takes the outputs of two child generators and produces a Cartesian product of their parameters. It iterates through every possible combination of the parameters provided by each child generator.

    Common use cases include:

    • SCM Provider + Cluster: Scanning GitHub organizations for resources and targeting them to all available clusters.
    • Git File + List: Deploying a specific list of applications via configuration files to a fixed list of clusters.
    • Git Directory + Cluster Decision Resource: Locating application resources in Git folders and deploying them to clusters defined by an external custom resource.

    Any parameters produced by the combined generators can be used in the spec.template for parameter substitution.

  10. How the Cluster Decision Resource generator works

    master

    The clusterDecisionResource generator allows an ApplicationSet to dynamically generate applications based on the status of a custom Kubernetes resource.

    Mechanism

    1. Resource Scanning: The generator reads a specific resource's status field to find a list of clusters.
    2. Duck Typing: The generator looks for a list of key/value pairs where the values match existing ArgoCD cluster names.
    3. Parameter Availability: For every element in the identified list, all key/value pairs within that element are injected into the ApplicationSet template. Additionally, the standard name and server parameters remain available.
    4. Configuration: You must use a ConfigMap to tell the generator which resource to watch and how to parse its status.

    Configuration via ConfigMap

    To use this generator, create a ConfigMap in the ArgoCD namespace with the following data keys:

    • apiVersion: The apiVersion of the resource to be read.
    • kind: The plural kind of the resource.
    • statusListKey: The key within the resource's status that contains the list of clusters (defaults to clusters).
    • matchKey: The key name used within the list elements to identify the cluster name (e.g., name or clusterName).
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: my-configmap
    data:
      apiVersion: group.io/v1
      kind: mykinds
      statusListKey: clusters
      matchKey: name
  11. How ApplicationSet templates generate Argo CD Applications

    master

    An ApplicationSet uses a spec.template to define the structure of the Argo CD Application resources it produces. The controller combines parameters provided by a generator with the fields defined in the template using {{values}} syntax to create concrete Application resources.

    Key template fields correspond to the Argo CD Application spec:

    • project: The Argo CD Project to use (e.g., default).
    • source:
      • repoURL: URL of the Git repository.
      • targetRevision: Revision (tag, branch, or commit) of the repository.
      • path: Path within the repository where manifests are located.
    • destination:
      • name: Name of the cluster (as defined in Argo CD).
      • server: API Server URL for the cluster.
      • namespace: Target namespace for deployment.

    Important Constraints:

    • Referenced clusters must already be defined in Argo CD.
    • In the destination field, you must specify either name or server, but not both. Specifying both will result in an error.
    # Example template subfield from a Cluster generator
    template:
      metadata:
        name: '{{cluster}}-guestbook'
      spec:
        source:
          repoURL: https://github.com/infra-team/cluster-deployments.git
          targetRevision: HEAD
          path: guestbook/{{cluster}}
        destination:
          server: '{{url}}'
          namespace: guestbook
  12. How Cluster Decision Resource Duck-Typing works

    master

    The clusterDecisionResource generator uses duck-typing to extract cluster information from a Kubernetes resource's status block without needing to know the resource's full API schema.

    The Duck-Typing Process

    1. Identification: The generator uses the GVK (Group, Version, Kind) provided in a ConfigMap to find the target resource.
    2. Extraction: It looks at the status field of that resource and navigates to the key defined by statusListKey (e.g., decisions).
    3. Validation: For every item in that list, it looks at the value of the key defined by matchKey (e.g., clusterName). It then checks if that value corresponds to a valid cluster name already registered in Argo CD.
    4. Parameterization: Every key/value pair found inside the list items is injected into the ApplicationSet template as a parameter.

    Example Resource Shape

    The target resource being watched should look like this:

    apiVersion: mallard.io/v1beta1
    kind: Duck
    metadata:
      name: quak
    status:
      decisions:
      - clusterName: cluster-01
      - clusterName: cluster-02