Update manifests to v0.12.3

* Add auditing to patching commands

* Omit Patch Resource logs to prevent secret leaks

.argo-ci/ci.yaml

@@ -0,0 +1,163 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Workflow
+metadata:
+  generateName: argo-cd-ci-
+spec:
+  entrypoint: argo-cd-ci
+  arguments:
+    parameters:
+    - name: revision
+      value: master
+    - name: repo
+      value: https://github.com/argoproj/argo-cd.git
+  volumes:
+    - name: k3setc
+      emptyDir: {}
+    - name: k3svar
+      emptyDir: {}
+    - name: tmp
+      emptyDir: {}
+
+  templates:
+  - name: argo-cd-ci
+    steps:
+    - - name: build-e2e
+        template: build-e2e
+
+      - name: test
+        template: ci-builder
+        arguments:
+          parameters:
+          - name: cmd
+            value: "dep ensure && make lint test && bash <(curl -s https://codecov.io/bash) -f coverage.out"
+
+  # The step builds argo cd image, deploy argo cd components into throw-away kubernetes cluster provisioned using k3s and run e2e tests against it.
+  - name: build-e2e
+    inputs:
+      artifacts:
+        - name: code
+          path: /go/src/github.com/argoproj/argo-cd
+          git:
+            repo: "{{workflow.parameters.repo}}"
+            revision: "{{workflow.parameters.revision}}"
+    container:
+      image: argoproj/argo-cd-ci-builder:v0.13.1
+      imagePullPolicy: Always
+      command: [sh, -c]
+      # Main contains build argocd image. The image is saved it into k3s agent images directory so it could be preloaded by the k3s cluster.
+      args: ["
+          dep ensure && until docker ps; do sleep 3; done && \
+          make image DEV_IMAGE=true && mkdir -p /var/lib/rancher/k3s/agent/images && \
+          docker save argocd:latest > /var/lib/rancher/k3s/agent/images/argocd.tar && \
+          touch /var/lib/rancher/k3s/ready && until ls /etc/rancher/k3s/k3s.yaml; do sleep 3; done && \
+          kubectl create ns argocd-e2e && kustomize build ./test/manifests/ci | kubectl apply -n argocd-e2e -f - && \
+          kubectl rollout status deployment -n argocd-e2e argocd-application-controller && kubectl rollout status deployment -n argocd-e2e argocd-server && \
+          git config --global user.email \"test@example.com\" && \
+          export ARGOCD_SERVER=$(kubectl get service argocd-server -o=jsonpath={.spec.clusterIP} -n argocd-e2e):443 && make test-e2e"
+      ]
+      workingDir: /go/src/github.com/argoproj/argo-cd
+      env:
+        - name: USER
+          value: argocd
+        - name: DOCKER_HOST
+          value: 127.0.0.1
+        - name: DOCKER_BUILDKIT
+          value: "1"
+        - name: KUBECONFIG
+          value: /etc/rancher/k3s/k3s.yaml
+      volumeMounts:
+        - name: tmp
+          mountPath: /tmp
+        - name: k3setc
+          mountPath: /etc/rancher/k3s
+        - name: k3svar
+          mountPath: /var/lib/rancher/k3s
+    sidecars:
+      - name: dind
+        image: docker:18.09-dind
+        securityContext:
+          privileged: true
+        resources:
+          requests:
+            memory: 2048Mi
+            cpu: 500m
+        mirrorVolumeMounts: true
+
+      # Steps waits for file /var/lib/rancher/k3s/ready which indicates that all required images are ready, then starts the cluster.
+      - name: k3s
+        image: rancher/k3s:v0.3.0-rc1
+        imagePullPolicy: Always
+        command: [sh, -c]
+        args: ["until ls /var/lib/rancher/k3s/ready; do sleep 3; done && k3s server || true"]
+        securityContext:
+          privileged: true
+        volumeMounts:
+          - name: tmp
+            mountPath: /tmp
+          - name: k3setc
+            mountPath: /etc/rancher/k3s
+          - name: k3svar
+            mountPath: /var/lib/rancher/k3s
+
+  - name: ci-builder
+    inputs:
+      parameters:
+      - name: cmd
+      artifacts:
+      - name: code
+        path: /go/src/github.com/argoproj/argo-cd
+        git:
+          repo: "{{workflow.parameters.repo}}"
+          revision: "{{workflow.parameters.revision}}"
+    container:
+      image: argoproj/argo-cd-ci-builder:v0.13.1
+      imagePullPolicy: Always
+      command: [bash, -c]
+      args: ["{{inputs.parameters.cmd}}"]
+      workingDir: /go/src/github.com/argoproj/argo-cd
+      env:
+      - name: CODECOV_TOKEN
+        valueFrom:
+          secretKeyRef:
+            name: codecov-token
+            key: codecov-token
+      resources:
+        requests:
+          memory: 1024Mi
+          cpu: 200m
+    archiveLocation:
+      archiveLogs: true
+
+  - name: ci-dind
+    inputs:
+      parameters:
+      - name: cmd
+      artifacts:
+      - name: code
+        path: /go/src/github.com/argoproj/argo-cd
+        git:
+          repo: "{{workflow.parameters.repo}}"
+          revision: "{{workflow.parameters.revision}}"
+    container:
+      image: argoproj/argo-cd-ci-builder:v0.13.1
+      imagePullPolicy: Always
+      command: [sh, -c]
+      args: ["until docker ps; do sleep 3; done && {{inputs.parameters.cmd}}"]
+      workingDir: /go/src/github.com/argoproj/argo-cd
+      env:
+      - name: DOCKER_HOST
+        value: 127.0.0.1
+      - name: DOCKER_BUILDKIT
+        value: "1"
+      resources:
+        requests:
+          memory: 1024Mi
+          cpu: 200m
+    sidecars:
+    - name: dind
+      image: docker:18.09-dind
+      securityContext:
+        privileged: true
+      mirrorVolumeMounts: true
+    archiveLocation:
+      archiveLogs: true

.circleci/config.yml

@@ -1,365 +0,0 @@
-version: 2.1
-commands:
-  prepare_environment:
-    steps:
-      - run:
-          name: Configure environment
-          command: |
-            set -x
-            echo "export GOCACHE=/tmp/go-build-cache" | tee -a $BASH_ENV
-            echo "export ARGOCD_TEST_VERBOSE=true" | tee -a $BASH_ENV
-            echo "export ARGOCD_TEST_PARALLELISM=8" | tee -a $BASH_ENV
-            echo "export ARGOCD_SONAR_VERSION=4.2.0.1873" | tee -a $BASH_ENV
-  configure_git:
-    steps:
-      - run:
-          name: Configure Git
-          command: |
-            set -x
-            # must be configured for tests to run
-            git config --global user.email you@example.com
-            git config --global user.name "Your Name"
-            echo "export PATH=/home/circleci/.go_workspace/src/github.com/argoproj/argo-cd/hack:\$PATH" | tee -a $BASH_ENV
-            echo "export GIT_ASKPASS=git-ask-pass.sh" | tee -a $BASH_ENV
-  restore_vendor:
-    steps:
-      - restore_cache:
-          name: Restore vendor cache
-          keys:
-            - vendor-v2-{{ checksum "Gopkg.lock" }}
-  save_vendor:
-    steps:
-      - save_cache:
-          name: Save vendor cache
-          key: vendor-v2-{{ checksum "Gopkg.lock" }}
-          paths:
-            - ./vendor
-      - persist_to_workspace:
-          root: .
-          paths:
-            - vendor
-  save_coverage_info:
-    steps:
-      - persist_to_workspace:
-          root: .
-          paths:
-            - coverage.out
-  save_node_modules:
-    steps:
-      - persist_to_workspace:
-          root: ~/argo-cd
-          paths:
-            - ui/node_modules
-  attach_vendor:
-    steps:
-      - attach_workspace:
-          at: .
-  install_golang:
-    steps:
-      - run:
-          name: Install Golang v1.14.1
-          command: |
-            go get golang.org/dl/go1.14.1
-            [ -e /home/circleci/sdk/go1.14.1 ] || go1.14.1 download
-            go env
-            echo "export GOPATH=/home/circleci/.go_workspace" | tee -a $BASH_ENV
-            echo "export PATH=/home/circleci/sdk/go1.14.1/bin:\$PATH" | tee -a $BASH_ENV
-  save_go_cache:
-    steps:
-      - save_cache:
-          key: go-v2-{{ .Branch }}-{{ .Environment.CIRCLE_JOB }}
-          # https://circleci.com/docs/2.0/language-go/
-          paths:
-            - /home/circleci/.cache/go-build
-            - /home/circleci/sdk/go1.14.1
-  restore_go_cache:
-    steps:
-      - restore_cache:
-          keys:
-            - go-v2-{{ .Branch }}-{{ .Environment.CIRCLE_JOB }}
-
-  save_go_cache_docker:
-    steps:
-      - save_cache:
-          name: Save Go build cache
-          key: go-docker-v2-{{ .Branch }}-{{ .Environment.CIRCLE_WORKFLOW_ID }}
-          # https://circleci.com/docs/2.0/language-go/
-          paths:
-            - /tmp/go-build-cache
-  restore_go_cache_docker:
-    steps:
-      - restore_cache:
-          name: Restore Go build cache
-          keys:
-            - go-docker-v2-{{ .Branch }}-{{ .Environment.CIRCLE_WORKFLOW_ID }}
-jobs:
-  build:
-    docker:
-      - image: argoproj/argocd-test-tools:v0.5.0
-    working_directory: /go/src/github.com/argoproj/argo-cd
-    steps:
-      - prepare_environment
-      - checkout
-      - restore_vendor
-      - run:
-          name: Ensuring Gopkg.lock is up-to-date
-          command: make dep-check-local
-      - run:
-          name: Syncing vendor dependencies
-          command: dep ensure -v
-      - run: make build-local
-      - run: chmod -R 777 vendor
-      - run: chmod -R 777 ${GOCACHE}
-      - save_vendor
-      - save_go_cache_docker
-
-  codegen:
-    docker:
-      - image: argoproj/argocd-test-tools:v0.5.0
-    working_directory: /go/src/github.com/argoproj/argo-cd
-    steps:
-      - prepare_environment
-      - checkout
-      - restore_vendor
-      - run: helm2 init --client-only
-      - run: make codegen-local
-      - run:
-          name: Check nothing has changed
-          command: |
-            set -xo pipefail
-            # This makes sure you ran `make pre-commit` before you pushed.
-            # We exclude the Swagger resources; CircleCI doesn't generate them correctly.
-            # When this fails, it will, create a patch file you can apply locally to fix it.
-            # To troubleshoot builds: https://argoproj.github.io/argo-cd/developer-guide/ci/
-            git diff --exit-code -- . ':!Gopkg.lock'  ':!assets/swagger.json' | tee codegen.patch
-      - store_artifacts:
-          path: codegen.patch
-          destination: .
-  test:
-    working_directory: /go/src/github.com/argoproj/argo-cd
-    docker:
-      - image: argoproj/argocd-test-tools:v0.5.0
-    steps:
-      - prepare_environment
-      - checkout
-      - configure_git
-      - restore_vendor
-      - run: dep ensure -v
-      - restore_go_cache_docker
-      - run: make test-local
-      - run:
-          name: Uploading code coverage
-          command: bash <(curl -s https://codecov.io/bash) -f coverage.out
-      - run:
-          name: Output of test-results
-          command: |
-            ls -l test-results || true
-            cat test-results/junit.xml || true
-      - save_coverage_info
-      - store_test_results:
-          path: test-results
-      - store_artifacts:
-          path: test-results
-          destination: .
-  
-  lint:
-    working_directory: /go/src/github.com/argoproj/argo-cd
-    docker:
-      - image: argoproj/argocd-test-tools:v0.5.0
-    steps:
-      - prepare_environment
-      - checkout
-      - configure_git
-      - restore_vendor
-      - run: dep ensure -v
-      - restore_go_cache_docker
-      - run:
-          name: Run golangci-lint
-          command: ARGOCD_LINT_GOGC=10 make lint-local
-      - run:
-          name: Check that nothing has changed
-          command: |
-            gDiff=$(git diff)
-            if test "$gDiff" != ""; then
-              echo
-              echo "###############################################################################"
-              echo "golangci-lint has made automatic corrections to your code. Please check below"
-              echo "diff output and commit this to your local branch, or run make lint locally."
-              echo "###############################################################################"
-              echo
-              git diff
-              exit 1
-            fi
-
-  sonarcloud:
-    working_directory: /go/src/github.com/argoproj/argo-cd
-    docker:
-      - image: argoproj/argocd-test-tools:v0.5.0
-    environment:
-      NODE_MODULES: /go/src/github.com/argoproj/argo-cd/ui/node_modules
-    steps:
-      - prepare_environment
-      - checkout
-      - attach_workspace:
-          at: .
-      - run:
-          command: mkdir -p /tmp/cache/scanner
-          name: Create cache directory if it doesn't exist
-      - restore_cache:
-          keys:
-            - v1-sonarcloud-scanner-4.2.0.1873
-      - run:
-          command: |
-            set -e
-            VERSION=4.2.0.1873
-            SONAR_TOKEN=$SONAR_TOKEN
-            SCANNER_DIRECTORY=/tmp/cache/scanner
-            export SONAR_USER_HOME=$SCANNER_DIRECTORY/.sonar
-            OS="linux"
-            echo $SONAR_USER_HOME
-
-            if [[ ! -x "$SCANNER_DIRECTORY/sonar-scanner-$VERSION-$OS/bin/sonar-scanner" ]]; then
-              curl -Ol https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-$VERSION-$OS.zip
-              unzip -qq -o sonar-scanner-cli-$VERSION-$OS.zip -d $SCANNER_DIRECTORY
-            fi
-
-            chmod +x $SCANNER_DIRECTORY/sonar-scanner-$VERSION-$OS/bin/sonar-scanner
-            chmod +x $SCANNER_DIRECTORY/sonar-scanner-$VERSION-$OS/jre/bin/java
-
-            # Workaround for a possible bug in CircleCI
-            if ! echo $CIRCLE_PULL_REQUEST | grep https://github.com/argoproj; then
-              unset CIRCLE_PULL_REQUEST
-              unset CIRCLE_PULL_REQUESTS
-            fi
-
-            # Explicitly set NODE_MODULES
-            export NODE_MODULES=/go/src/github.com/argoproj/argo-cd/ui/node_modules
-            export NODE_PATH=/go/src/github.com/argoproj/argo-cd/ui/node_modules
-
-            $SCANNER_DIRECTORY/sonar-scanner-$VERSION-$OS/bin/sonar-scanner
-          name: SonarCloud
-      - save_cache:
-          key: v1-sonarcloud-scanner-4.2.0.1873
-          paths:
-            - /tmp/cache/scanner
-    
-  e2e:
-    working_directory: /home/circleci/.go_workspace/src/github.com/argoproj/argo-cd
-    machine:
-      image: ubuntu-1604:201903-01
-    environment:
-      ARGOCD_FAKE_IN_CLUSTER: "true"
-      ARGOCD_SSH_DATA_PATH: "/tmp/argo-e2e/app/config/ssh"
-      ARGOCD_TLS_DATA_PATH: "/tmp/argo-e2e/app/config/tls"
-      ARGOCD_E2E_K3S: "true"
-    steps:
-      - run:
-          name: Install and start K3S v0.5.0
-          command: |
-            curl -sfL https://get.k3s.io | sh -
-            sudo chmod -R a+rw /etc/rancher/k3s
-            kubectl version
-          environment:
-            INSTALL_K3S_EXEC: --docker
-            INSTALL_K3S_VERSION: v0.5.0
-      - prepare_environment
-      - restore_go_cache_docker
-      - checkout
-      - restore_cache:
-          keys: [e2e-dl-v2]
-      - run: sudo ./hack/install.sh dep-linux
-      - save_cache:
-          key: e2e-dl-v2
-          paths: [/tmp/dl]
-      - attach_vendor
-      - run: dep ensure -v
-      - run:
-          name: Update kubectl configuration for container
-          command: |
-            ipaddr=$(ifconfig $IFACE |grep "inet " | awk '{print $2}')
-            if echo $ipaddr | grep -q 'addr:'; then
-              ipaddr=$(echo $ipaddr | awk -F ':' '{print $2}')
-            fi
-            test -d $HOME/.kube || mkdir -p $HOME/.kube
-            kubectl config view --raw | sed -e "s/127.0.0.1:6443/${ipaddr}:6443/g" -e "s/localhost:6443/${ipaddr}:6443/g" > $HOME/.kube/config
-          environment:
-            IFACE: ens4
-      - run:
-          name: Start E2E test server
-          command: make start-e2e
-          background: true
-          environment:
-            DOCKER_SRCDIR: /home/circleci/.go_workspace/src
-            ARGOCD_E2E_TEST: "true"
-            ARGOCD_IN_CI: "true"
-      - run:
-          name: Wait for API server to become available
-          command: |
-            count=1
-            until curl -v http://localhost:8080/healthz; do 
-              sleep 10;
-              if test $count -ge 60; then
-                echo "Timeout"
-                exit 1
-              fi
-              count=$((count+1))
-            done
-      - run:
-          name: Run E2E tests
-          command: |
-            make test-e2e
-          environment:
-            ARGOCD_OPTS: "--plaintext"
-            ARGOCD_E2E_K3S: "true"
-            IFACE: ens4
-            DOCKER_SRCDIR: /home/circleci/.go_workspace/src
-      - store_test_results:
-          path: test-results
-      - store_artifacts:
-          path: test-results
-          destination: .
-  ui:
-    docker:
-      - image: node:11.15.0
-    working_directory: ~/argo-cd/ui
-    steps:
-      - checkout:
-          path: ~/argo-cd/
-      - restore_cache:
-          keys:
-            - yarn-packages-v4-{{ checksum "yarn.lock" }}
-      - run: yarn install --frozen-lockfile --ignore-optional --non-interactive
-      - save_cache:
-          key: yarn-packages-v4-{{ checksum "yarn.lock" }}
-          paths: [~/.cache/yarn, node_modules]
-      - run: yarn test
-      - run: ./node_modules/.bin/codecov -p ..
-      - run: NODE_ENV='production' yarn build
-      - run: yarn lint
-      - save_node_modules
-
-orbs:
-  sonarcloud: sonarsource/sonarcloud@1.0.1
-
-workflows:
-  version: 2
-  workflow:
-    jobs:
-      - build
-      - test:
-          requires:
-            - build
-      - codegen:
-          requires:
-            - build
-      - ui:
-          requires:
-            - build
-      - sonarcloud:
-          context: SonarCloud
-          requires:
-            - test
-            - ui
-      - e2e:
-          requires:
-            - build

.codecov.yml

@@ -1,17 +1,6 @@
 ignore:
 - "**/*.pb.go"
-- "**/*.pb.gw.go"
-- "**/*generated.go"
-- "**/*generated.deepcopy.go"
 - "**/*_test.go"
-- "pkg/apis/client/.*"
+- "pkg/apis/.*"
 - "pkg/client/.*"
-- "vendor/.*"
-coverage:
-  status:
-    # we've found this not to be useful
-    patch: off
-    project:
-      default:
-        # allow test coverage to drop by 2%, assume that it's typically due to CI problems
-        threshold: 2
+- "test/.*"

.dockerignore

@@ -10,4 +10,3 @@ dist/
 cmd/**/debug
 debug.test
 coverage.out
-ui/node_modules/

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,44 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: 'bug'
-assignees: ''
----
-
-If you are trying to resolve an environment-specific issue or have a one-off question about the edge case that does not require a feature then please consider asking a
-question in argocd slack [channel](https://argoproj.github.io/community/join-slack).
-
-Checklist:
-
-* [ ] I've searched in the docs and FAQ for my answer: http://bit.ly/argocd-faq.
-* [ ] I've included steps to reproduce the bug.
-* [ ] I've pasted the output of `argocd version`.
-
-**Describe the bug**
-
-A clear and concise description of what the bug is.
-
-**To Reproduce**
-
-A list of the steps required to reproduce the issue. Best of all, give us the URL to a repository that exhibits this issue.
-
-**Expected behavior**
-
-A clear and concise description of what you expected to happen.
-
-**Screenshots**
-
-If applicable, add screenshots to help explain your problem.
-
-**Version**
-
-```shell
-Paste the output from `argocd version` here.
-```
-
-**Logs**
-
-```
-Paste any relevant application logs here.
-```

.github/ISSUE_TEMPLATE/enhancement_proposal.md

@@ -1,18 +0,0 @@
----
-name: Enhancement proposal
-about: Propose an enhancement for this project
-title: ''
-labels: 'enhancement'
-assignees: ''
----
-# Summary
-
-What change you think needs making.
-
-# Motivation
-
-Please give examples of your use case, e.g. when would you use this.
-
-# Proposal
-
-How do you think this should be implemented?

.github/no-response.yml

@@ -1 +0,0 @@
-# See https://github.com/probot/no-response

.github/pull_request_template.md

@@ -1,7 +0,0 @@
-Checklist:
-
-* [ ] Either (a) I've created an [enhancement proposal](https://github.com/argoproj/argo-cd/issues/new/choose) and discussed it with the community, (b) this is a bug fix, or (c) this does not need to be in the release notes.
-* [ ] The title of the PR states what changed and the related issues number (used for the release note).
-* [ ] I've updated both the CLI and UI to expose my feature, or I plan to submit a second PR with them.
-* [ ] Optional. My organization is added to USERS.md.
-* [ ] I've signed the CLA and my build is green ([troubleshooting builds](https://argoproj.github.io/argo-cd/developer-guide/ci/)). 

.github/stale.yml

@@ -1,4 +0,0 @@
-# See https://github.com/probot/stale
-# See https://github.com/probot/stale
-exemptLabels:
-  - backlog

.github/workflows/gh-pages.yaml

@@ -1,27 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    branches:
-      - master
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-      - name: Setup Python
-        uses: actions/setup-python@v1
-        with:
-          python-version: 3.x
-      - name: build
-        run: |
-          pip install mkdocs==1.0.4 mkdocs_material==4.1.1
-          mkdocs build
-          mkdir ./site/.circleci && echo '{version: 2, jobs: {build: {branches: {ignore: gh-pages}}}}' > ./site/.circleci/config.yml
-      - name: deploy
-        uses: peaceiris/actions-gh-pages@v2.5.0
-        env:
-          PERSONAL_TOKEN: ${{ secrets.PERSONAL_TOKEN }}
-          PUBLISH_BRANCH: gh-pages
-          PUBLISH_DIR: ./site

.github/workflows/image.yaml

@@ -1,59 +0,0 @@
-name: Image
-
-on:
-  push:
-    branches:
-      - master
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    env:
-      GOPATH: /home/runner/work/argo-cd/argo-cd
-    steps:
-      - uses: actions/setup-go@v1
-        with:
-          go-version: '1.14.1'
-      - uses: actions/checkout@master
-        with:
-          path: src/github.com/argoproj/argo-cd
-      - uses: actions/cache@v1
-        with:
-          path: src/github.com/argoproj/argo-cd/vendor
-          key: ${{ runner.os }}-go-dep-${{ hashFiles('**/Gopkg.lock') }}
-      # download dependencies
-      - run: mkdir -p $GITHUB_WORKSPACE/bin && curl https://raw.githubusercontent.com/golang/dep/master/install.sh | sh
-        working-directory: src/github.com/argoproj/argo-cd
-      - run: $GOPATH/bin/dep ensure -v
-        working-directory: ./src/github.com/argoproj/argo-cd
-
-      # get image tag
-      - run: echo ::set-output name=tag::$(cat ./VERSION)-${GITHUB_SHA::8}
-        working-directory: ./src/github.com/argoproj/argo-cd
-        id: image
-
-      # build
-      - run: |
-          docker images -a --format "{{.ID}}" | xargs -I {} docker rmi {}
-          make image DEV_IMAGE=true DOCKER_PUSH=false IMAGE_NAMESPACE=docker.pkg.github.com/argoproj/argo-cd IMAGE_TAG=${{ steps.image.outputs.tag }}
-        working-directory: ./src/github.com/argoproj/argo-cd
-
-      # publish
-      - run: |
-          docker login docker.pkg.github.com --username $USERNAME --password $PASSWORD
-          docker push docker.pkg.github.com/argoproj/argo-cd/argocd:${{ steps.image.outputs.tag }}
-        env:
-          USERNAME: ${{ secrets.USERNAME }}
-          PASSWORD: ${{ secrets.TOKEN }}
-
-      # deploy
-      - run: git clone "https://$TOKEN@github.com/argoproj/argoproj-deployments"
-        env:
-          TOKEN: ${{ secrets.TOKEN }}
-      - run: |
-          docker run -v $(pwd):/src -w /src --rm -t lyft/kustomizer:v3.3.0 kustomize edit set image argoproj/argocd=docker.pkg.github.com/argoproj/argo-cd/argocd:${{ steps.image.outputs.tag }}
-          git config --global user.email 'ci@argoproj.com'
-          git config --global user.name 'CI'
-          git diff --exit-code && echo 'Already deployed' || (git commit -am 'Upgrade argocd to ${{ steps.image.outputs.tag }}' && git push)
-        working-directory: argoproj-deployments/argocd
-      # TODO: clean up old images once github supports it: https://github.community/t5/How-to-use-Git-and-GitHub/Deleting-images-from-Github-Package-Registry/m-p/41202/thread-id/9811

.gitignore

@@ -3,12 +3,8 @@
 .DS_Store
 vendor/
 dist/
-site/
 *.iml
 # delve debug binaries
 cmd/**/debug
 debug.test
 coverage.out
-test-results
-.scannerwork
-.scratch

.golangci.yml

@@ -1,22 +1,22 @@
 run:
-  timeout: 2m
+  deadline: 8m
   skip-files:
     - ".*\\.pb\\.go"
   skip-dirs:
-    - pkg/client/
-    - vendor/
+    - pkg/client
+    - vendor
+linter-settings:
+  goimports:
+    local-prefixes: github.com/argoproj/argo-cd
 linters:
   enable:
     - vet
-    - deadcode
+    - gofmt
     - goimports
+    - deadcode
     - varcheck
     - structcheck
     - ineffassign
     - unconvert
-    - unparam
-linters-settings:
-  goimports:
-    local-prefixes: github.com/argoproj/argo-cd
-service:
-  golangci-lint-version: 1.21.0
+    - misspell
+  disable-all: true

CONTRIBUTING.md

@@ -0,0 +1,183 @@
+# Contributing
+## Before You Start
+
+You must install and run the ArgoCD using a local Kubernetes (e.g. Docker for Desktop or Minikube) first. This will help you understand the application, but also get your local environment set-up.
+
+Then, to get a good grounding in Go, try out [the tutorial](https://tour.golang.org/).
+
+## Pre-requisites
+
+Install:
+
+* [docker](https://docs.docker.com/install/#supported-platforms)
+* [golang](https://golang.org/)
+* [dep](https://github.com/golang/dep)
+* [protobuf](https://developers.google.com/protocol-buffers/)
+* [ksonnet](https://github.com/ksonnet/ksonnet#install)
+* [helm](https://github.com/helm/helm/releases)
+* [kustomize](https://github.com/kubernetes-sigs/kustomize/releases)
+* [go-swagger](https://github.com/go-swagger/go-swagger/blob/master/docs/install.md)
+* [jq](https://stedolan.github.io/jq/)
+* [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/).
+* [minikube](https://kubernetes.io/docs/setup/minikube/) or Docker for Desktop
+
+```
+brew tap go-swagger/go-swagger
+brew install go dep protobuf kubectl ksonnet/tap/ks kubernetes-helm jq go-swagger 
+```
+
+Set up environment variables (e.g. is `~/.bashrc`):
+
+```
+export GOPATH=~/go
+export PATH=$PATH:$GOPATH/bin
+```
+
+Install go dependencies:
+
+```
+go get -u github.com/golang/protobuf/protoc-gen-go
+go get -u github.com/go-swagger/go-swagger/cmd/swagger
+go get -u github.com/grpc-ecosystem/grpc-gateway/protoc-gen-grpc-gateway
+go get -u github.com/grpc-ecosystem/grpc-gateway/protoc-gen-swagger
+go get -u github.com/golangci/golangci-lint/cmd/golangci-lint 
+go get -u github.com/mattn/goreman 
+```
+
+## Building
+
+```
+go get -u github.com/argoproj/argo-cd
+dep ensure
+make
+```
+
+The make command can take a while, and we recommend building the specific component you are working on
+
+* `make codegen` - Builds protobuf and swagger files
+* `make cli` - Make the argocd CLI tool
+* `make server` - Make the API/repo/controller server
+* `make argocd-util` - Make the administrator's utility, used for certain tasks such as import/export
+
+## Running Tests
+
+To run unit tests:
+
+```
+make test
+```
+
+To run e2e tests:
+
+```
+make test-e2e
+```
+
+## Running Locally
+
+It is much easier to run and debug if you run ArgoCD on your local machine than in the Kubernetes cluster.
+
+You should scale the deployemnts to zero:
+
+```
+kubectl -n argocd scale deployment.extensions/argocd-application-controller --replicas 0
+kubectl -n argocd scale deployment.extensions/argocd-dex-server --replicas 0
+kubectl -n argocd scale deployment.extensions/argocd-repo-server --replicas 0
+kubectl -n argocd scale deployment.extensions/argocd-server --replicas 0
+kubectl -n argocd scale deployment.extensions/argocd-redis --replicas 0
+```
+
+Then checkout and build the UI next to your code
+
+```
+cd ~/go/src/github.com/argoproj
+git clone git@github.com:argoproj/argo-cd-ui.git
+```
+
+Follow the UI's [README](https://github.com/argoproj/argo-cd-ui/blob/master/README.md) to build it.
+
+Note: you'll need to use the https://localhost:6443 cluster now.
+
+Then start the services:
+
+```
+cd ~/go/src/github.com/argoproj/argo-cd
+goreman start
+```
+
+You can now execute `argocd` command against your locally running ArgoCD by appending `--server localhost:8080 --plaintext --insecure`, e.g.:
+
+```
+argocd app set guestbook --path guestbook --repo https://github.com/argoproj/argocd-example-apps.git --dest-server https://localhost:6443  --dest-namespace default --server localhost:8080 --plaintext --insecure
+```
+
+You can open the UI: http://localhost:8080
+
+Note: you'll need to use the https://kubernetes.default.svc cluster now.
+
+## Running Local Containers
+
+You may need to run containers locally, so here's how:
+
+Create login to Docker Hub, then login.
+
+```
+docker login
+```
+
+Add your username as the environment variable, e.g. to your `~/.bash_profile`:
+
+```
+export IMAGE_NAMESPACE=alexcollinsintuit
+```
+
+If you have not built the UI image (see [the UI README](https://github.com/argoproj/argo-cd-ui/blob/master/README.md)), then do the following:
+
+```
+docker pull argoproj/argocd-ui:latest
+docker tag argoproj/argocd-ui:latest $IMAGE_NAMESPACE/argocd-ui:latest
+docker push $IMAGE_NAMESPACE/argocd-ui:latest
+```
+
+Build the images:
+
+```
+DOCKER_PUSH=true make image
+```
+
+Update the manifests:
+
+```
+make manifests
+```
+
+Install the manifests:
+
+```
+kubectl -n argocd apply --force -f manifests/install.yaml
+```
+
+Scale your deployments up:
+
+```
+kubectl -n argocd scale deployment.extensions/argocd-application-controller --replicas 1
+kubectl -n argocd scale deployment.extensions/argocd-dex-server --replicas 1
+kubectl -n argocd scale deployment.extensions/argocd-repo-server --replicas 1
+kubectl -n argocd scale deployment.extensions/argocd-server --replicas 1
+kubectl -n argocd scale deployment.extensions/argocd-redis --replicas 1
+```
+
+Now you can set-up the port-forwarding (see [README](README.md)) and open the UI or CLI.
+
+## Pre-commit Checks
+
+Before you commit, make sure you've formatted and linted your code, or your PR will fail CI:
+
+```
+STAGED_GO_FILES=$(git diff --cached --name-only | grep ".go$")
+
+gofmt -w $STAGED_GO_FILES
+
+make codgen
+make precommit ;# lint and test
+```

Dockerfile

@@ -1,19 +1,12 @@
-ARG BASE_IMAGE=debian:10-slim
 ####################################################################################################
 # Builder image
 # Initial stage which pulls prepares build dependencies and CLI tooling we need for our final image
 # Also used as the image in CI jobs so needs all dependencies
 ####################################################################################################
-FROM golang:1.14.1 as builder
-
-RUN echo 'deb http://deb.debian.org/debian buster-backports main' >> /etc/apt/sources.list
+FROM golang:1.11.4 as builder
 
 RUN apt-get update && apt-get install -y \
-    openssh-server \
-    nginx \
-    fcgiwrap \
     git \
-    git-lfs \
     make \
     wget \
     gcc \
@@ -23,54 +16,102 @@ RUN apt-get update && apt-get install -y \
 
 WORKDIR /tmp
 
-ADD hack/install.sh .
-ADD hack/installers installers
+# Install docker
+ENV DOCKER_CHANNEL stable
+ENV DOCKER_VERSION 18.09.1
+RUN wget -O docker.tgz "https://download.docker.com/linux/static/${DOCKER_CHANNEL}/x86_64/docker-${DOCKER_VERSION}.tgz" && \
+    tar --extract --file docker.tgz --strip-components 1 --directory /usr/local/bin/ && \
+    rm docker.tgz
 
-RUN ./install.sh dep-linux
-RUN ./install.sh packr-linux
-RUN ./install.sh kubectl-linux
-RUN ./install.sh ksonnet-linux
-RUN ./install.sh helm2-linux
-RUN ./install.sh helm-linux
-RUN ./install.sh kustomize-linux
+# Install dep
+ENV DEP_VERSION=0.5.0
+RUN wget https://github.com/golang/dep/releases/download/v${DEP_VERSION}/dep-linux-amd64 -O /usr/local/bin/dep && \
+    chmod +x /usr/local/bin/dep
+
+# Install gometalinter
+ENV GOMETALINTER_VERSION=2.0.12
+RUN curl -sLo- https://github.com/alecthomas/gometalinter/releases/download/v${GOMETALINTER_VERSION}/gometalinter-${GOMETALINTER_VERSION}-linux-amd64.tar.gz | \
+    tar -xzC "$GOPATH/bin" --exclude COPYING --exclude README.md --strip-components 1 -f- && \
+    ln -s $GOPATH/bin/gometalinter $GOPATH/bin/gometalinter.v2
+
+# Install packr
+ENV PACKR_VERSION=1.21.9
+RUN wget https://github.com/gobuffalo/packr/releases/download/v${PACKR_VERSION}/packr_${PACKR_VERSION}_linux_amd64.tar.gz && \
+    tar -vxf packr*.tar.gz -C /tmp/ && \
+    mv /tmp/packr /usr/local/bin/packr
+
+# Install kubectl
+# NOTE: keep the version synced with https://storage.googleapis.com/kubernetes-release/release/stable.txt
+ENV KUBECTL_VERSION=1.14.0
+RUN curl -L -o /usr/local/bin/kubectl -LO https://storage.googleapis.com/kubernetes-release/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl && \
+    chmod +x /usr/local/bin/kubectl && \
+    kubectl version --client
+
+# Install ksonnet
+ENV KSONNET_VERSION=0.13.1
+RUN wget https://github.com/ksonnet/ksonnet/releases/download/v${KSONNET_VERSION}/ks_${KSONNET_VERSION}_linux_amd64.tar.gz && \
+    tar -C /tmp/ -xf ks_${KSONNET_VERSION}_linux_amd64.tar.gz && \
+    mv /tmp/ks_${KSONNET_VERSION}_linux_amd64/ks /usr/local/bin/ks && \
+    ks version
+
+# Install helm
+ENV HELM_VERSION=2.12.1
+RUN wget https://storage.googleapis.com/kubernetes-helm/helm-v${HELM_VERSION}-linux-amd64.tar.gz && \
+    tar -C /tmp/ -xf helm-v${HELM_VERSION}-linux-amd64.tar.gz && \
+    mv /tmp/linux-amd64/helm /usr/local/bin/helm && \
+    helm version --client
+
+# Install kustomize
+ENV KUSTOMIZE1_VERSION=1.0.11
+RUN curl -L -o /usr/local/bin/kustomize1 https://github.com/kubernetes-sigs/kustomize/releases/download/v${KUSTOMIZE1_VERSION}/kustomize_${KUSTOMIZE1_VERSION}_linux_amd64 && \
+    chmod +x /usr/local/bin/kustomize1 && \
+    kustomize1 version
+
+
+ENV KUSTOMIZE_VERSION=2.0.3
+RUN curl -L -o /usr/local/bin/kustomize https://github.com/kubernetes-sigs/kustomize/releases/download/v${KUSTOMIZE_VERSION}/kustomize_${KUSTOMIZE_VERSION}_linux_amd64 && \
+    chmod +x /usr/local/bin/kustomize && \
+    kustomize version
+
+# Install AWS IAM Authenticator
+ENV AWS_IAM_AUTHENTICATOR_VERSION=0.4.0-alpha.1
+RUN curl -L -o /usr/local/bin/aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/${AWS_IAM_AUTHENTICATOR_VERSION}/aws-iam-authenticator_${AWS_IAM_AUTHENTICATOR_VERSION}_linux_amd64 && \
+    chmod +x /usr/local/bin/aws-iam-authenticator
+
+# Install golangci-lint
+RUN wget https://install.goreleaser.com/github.com/golangci/golangci-lint.sh  && \
+    chmod +x ./golangci-lint.sh && \
+    ./golangci-lint.sh -b $GOPATH/bin && \
+    golangci-lint linters
+
+COPY .golangci.yml ${GOPATH}/src/dummy/.golangci.yml
+
+RUN cd ${GOPATH}/src/dummy && \
+    touch dummy.go \
+    golangci-lint run
 
 ####################################################################################################
 # Argo CD Base - used as the base for both the release and dev argocd images
 ####################################################################################################
-FROM $BASE_IMAGE as argocd-base
-
-USER root
-
-RUN echo 'deb http://deb.debian.org/debian buster-backports main' >> /etc/apt/sources.list
+FROM debian:9.5-slim as argocd-base
 
 RUN groupadd -g 999 argocd && \
     useradd -r -u 999 -g argocd argocd && \
     mkdir -p /home/argocd && \
-    chown argocd:0 /home/argocd && \
-    chmod g=u /home/argocd && \
-    chmod g=u /etc/passwd && \
+    chown argocd:argocd /home/argocd && \
     apt-get update && \
-    apt-get install -y git git-lfs python3-pip && \
+    apt-get install -y git && \
     apt-get clean && \
-    pip3 install awscli==1.18.80 && \
     rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
+COPY hack/ssh_known_hosts /etc/ssh/ssh_known_hosts
 COPY hack/git-ask-pass.sh /usr/local/bin/git-ask-pass.sh
 COPY --from=builder /usr/local/bin/ks /usr/local/bin/ks
-COPY --from=builder /usr/local/bin/helm2 /usr/local/bin/helm2
 COPY --from=builder /usr/local/bin/helm /usr/local/bin/helm
 COPY --from=builder /usr/local/bin/kubectl /usr/local/bin/kubectl
+COPY --from=builder /usr/local/bin/kustomize1 /usr/local/bin/kustomize1
 COPY --from=builder /usr/local/bin/kustomize /usr/local/bin/kustomize
-# script to add current (possibly arbitrary) user to /etc/passwd at runtime
-# (if it's not already there, to be openshift friendly)
-COPY uid_entrypoint.sh /usr/local/bin/uid_entrypoint.sh
-
-# support for mounting configuration from a configmap
-RUN mkdir -p /app/config/ssh && \
-    touch /app/config/ssh/ssh_known_hosts && \
-    ln -s /app/config/ssh/ssh_known_hosts /etc/ssh/ssh_known_hosts 
-
-RUN mkdir -p /app/config/tls
+COPY --from=builder /usr/local/bin/aws-iam-authenticator /usr/local/bin/aws-iam-authenticator
 
 # workaround ksonnet issue https://github.com/ksonnet/ksonnet/issues/298
 ENV USER=argocd
@@ -78,26 +119,11 @@ ENV USER=argocd
 USER argocd
 WORKDIR /home/argocd
 
-####################################################################################################
-# Argo CD UI stage
-####################################################################################################
-FROM node:11.15.0 as argocd-ui
-
-WORKDIR /src
-ADD ["ui/package.json", "ui/yarn.lock", "./"]
-
-RUN yarn install
-
-ADD ["ui/", "."]
-
-ARG ARGO_VERSION=latest
-ENV ARGO_VERSION=$ARGO_VERSION
-RUN NODE_ENV='production' yarn build
 
 ####################################################################################################
 # Argo CD Build stage which performs the actual build of Argo CD binaries
 ####################################################################################################
-FROM golang:1.14.1 as argocd-build
+FROM golang:1.11.4 as argocd-build
 
 COPY --from=builder /usr/local/bin/dep /usr/local/bin/dep
 COPY --from=builder /usr/local/bin/packr /usr/local/bin/packr
@@ -116,8 +142,7 @@ RUN cd ${GOPATH}/src/dummy && \
 WORKDIR /go/src/github.com/argoproj/argo-cd
 COPY . .
 RUN make cli server controller repo-server argocd-util && \
-    make CLI_NAME=argocd-darwin-amd64 GOOS=darwin cli && \
-    make CLI_NAME=argocd-windows-amd64.exe GOOS=windows cli
+    make CLI_NAME=argocd-darwin-amd64 GOOS=darwin cli
 
 
 ####################################################################################################
@@ -125,4 +150,3 @@ RUN make cli server controller repo-server argocd-util && \
 ####################################################################################################
 FROM argocd-base
 COPY --from=argocd-build /go/src/github.com/argoproj/argo-cd/dist/argocd* /usr/local/bin/
-COPY --from=argocd-ui ./src/dist/app /shared/app

Dockerfile.dev

@@ -3,4 +3,3 @@
 ####################################################################################################
 FROM argocd-base
 COPY argocd* /usr/local/bin/
-COPY --from=argocd-ui ./src/dist/app /shared/app

Gopkg.toml

@@ -7,7 +7,6 @@ required = [
   "github.com/gogo/protobuf/protoc-gen-gofast",
   "github.com/gogo/protobuf/protoc-gen-gogofast",
   "k8s.io/code-generator/cmd/go-to-protobuf",
-  "k8s.io/kube-openapi/cmd/openapi-gen",
   "github.com/grpc-ecosystem/grpc-gateway/protoc-gen-grpc-gateway",
   "github.com/grpc-ecosystem/grpc-gateway/protoc-gen-swagger",
   "golang.org/x/sync/errgroup",
@@ -19,7 +18,7 @@ required = [
 
 [[constraint]]
   name = "github.com/gogo/protobuf"
-  version = "1.3.1"
+  version = "1.1.1"
 
 # override github.com/grpc-ecosystem/go-grpc-middleware's constraint on master
 [[override]]
@@ -35,58 +34,21 @@ required = [
   name = "github.com/prometheus/client_golang"
   revision = "7858729281ec582767b20e0d696b6041d995d5e0"
 
-[[override]]
-  branch = "release-1.16"
+[[constraint]]
+  branch = "release-1.12"
   name = "k8s.io/api"
 
-[[override]]
-  branch = "release-1.16"
-  name = "k8s.io/kubernetes"
-
-[[override]]
-  branch = "release-1.16"
+[[constraint]]
+  branch = "release-1.12"
   name = "k8s.io/code-generator"
 
-[[override]]
-  branch = "release-1.16"
-  name = "k8s.io/apimachinery"
-
-[[override]]
-  branch = "release-1.16"
-  name = "k8s.io/apiextensions-apiserver"
-
-[[override]]
-  branch = "release-1.16"
-  name = "k8s.io/apiserver"
-
-[[override]]
-  branch = "release-1.16"
-  name = "k8s.io/kubectl"
-
-[[override]]
-  branch = "release-1.16"
-  name = "k8s.io/cli-runtime"
-
-[[override]]
-  version = "2.0.3"
-  name = "sigs.k8s.io/kustomize"
-
-# ASCIIRenderer does not implement blackfriday.Renderer
-[[override]]
-  name = "github.com/russross/blackfriday"
-  version = "1.5.2"
- 
-[[override]]
-  branch = "release-13.0"
+[[constraint]]
+  branch = "release-9.0"
   name = "k8s.io/client-go"
 
-[[override]]
-  name = "github.com/casbin/casbin"
-  version = "1.9.1"
-
 [[constraint]]
   name = "github.com/stretchr/testify"
-  version = "1.5.1"
+  version = "1.2.2"
 
 [[constraint]]
   name = "github.com/gobuffalo/packr"
@@ -99,32 +61,3 @@ required = [
 [[constraint]]
   branch = "master"
   name = "github.com/yudai/gojsondiff"
-
-# Fixes: Could not introduce sigs.k8s.io/kustomize@v2.0.3, as it has a dependency on github.com/spf13/cobra with constraint ^0.0.2, which has no overlap with existing constraint 0.0.5 from (root)
-[[override]]
-  name = "github.com/spf13/cobra"
-  revision = "0.0.5"
-
-# TODO: move off of k8s.io/kube-openapi and use controller-tools for CRD spec generation
-# (override argoproj/argo contraint on master)
-[[override]]
-  revision = "30be4d16710ac61bce31eb28a01054596fe6a9f1"
-  name = "k8s.io/kube-openapi"
-
-# jsonpatch replace operation does not apply: doc is missing key: /metadata/annotations
-[[override]]
-  name = "github.com/evanphx/json-patch"
-  version = "v4.1.0"
-
-[[constraint]]
-  name = "github.com/google/uuid"
-  version = "1.1.1"
-
-
-[[constraint]]
-  name = "github.com/alicebob/miniredis"
-  version = "2.7.0"
-
-[[constraint]]
-  name = "github.com/bsm/redislock"
-  version = "0.4.3"

Makefile

@@ -1,4 +1,4 @@
-PACKAGE=github.com/argoproj/argo-cd/common
+PACKAGE=github.com/argoproj/argo-cd
 CURRENT_DIR=$(shell pwd)
 DIST_DIR=${CURRENT_DIR}/dist
 CLI_NAME=argocd
@@ -9,93 +9,14 @@ GIT_COMMIT=$(shell git rev-parse HEAD)
 GIT_TAG=$(shell if [ -z "`git status --porcelain`" ]; then git describe --exact-match --tags HEAD 2>/dev/null; fi)
 GIT_TREE_STATE=$(shell if [ -z "`git status --porcelain`" ]; then echo "clean" ; else echo "dirty"; fi)
 PACKR_CMD=$(shell if [ "`which packr`" ]; then echo "packr"; else echo "go run vendor/github.com/gobuffalo/packr/packr/main.go"; fi)
-VOLUME_MOUNT=$(shell if test "$(go env GOOS)"=="darwin"; then echo ":delegated"; elif test selinuxenabled; then echo ":Z"; else echo ""; fi)
-
-GOPATH?=$(shell if test -x `which go`; then go env GOPATH; else echo "$(HOME)/go"; fi)
-GOCACHE?=$(HOME)/.cache/go-build
-
-DOCKER_SRCDIR?=$(GOPATH)/src
-DOCKER_WORKDIR?=/go/src/github.com/argoproj/argo-cd
-
-ARGOCD_PROCFILE?=Procfile
-
-# Configuration for building argocd-test-tools image
-TEST_TOOLS_NAMESPACE?=argoproj
-TEST_TOOLS_IMAGE=argocd-test-tools
-TEST_TOOLS_TAG?=v0.5.0
-ifdef TEST_TOOLS_NAMESPACE
-TEST_TOOLS_PREFIX=${TEST_TOOLS_NAMESPACE}/
-endif
-
-# You can change the ports where ArgoCD components will be listening on by
-# setting the appropriate environment variables before running make.
-ARGOCD_E2E_APISERVER_PORT?=8080
-ARGOCD_E2E_REPOSERVER_PORT?=8081
-ARGOCD_E2E_REDIS_PORT?=6379
-ARGOCD_E2E_DEX_PORT?=5556
-ARGOCD_E2E_YARN_HOST?=localhost
-
-ARGOCD_IN_CI?=false
-ARGOCD_TEST_E2E?=true
-
-ARGOCD_LINT_GOGC?=20
-
-# Runs any command in the argocd-test-utils container in server mode
-# Server mode container will start with uid 0 and drop privileges during runtime
-define run-in-test-server
-	docker run --rm -it \
-		--name argocd-test-server \
-		-e USER_ID=$(shell id -u) \
-		-e HOME=/home/user \
-		-e GOPATH=/go \
-		-e GOCACHE=/tmp/go-build-cache \
-		-e ARGOCD_IN_CI=$(ARGOCD_IN_CI) \
-		-e ARGOCD_E2E_TEST=$(ARGOCD_E2E_TEST) \
-		-e ARGOCD_E2E_YARN_HOST=$(ARGOCD_E2E_YARN_HOST) \
-		-v ${DOCKER_SRCDIR}:/go/src${VOLUME_MOUNT} \
-		-v ${GOCACHE}:/tmp/go-build-cache${VOLUME_MOUNT} \
-		-v ${HOME}/.kube:/home/user/.kube${VOLUME_MOUNT} \
-		-v /tmp:/tmp${VOLUME_MOUNT} \
-		-w ${DOCKER_WORKDIR} \
-		-p ${ARGOCD_E2E_APISERVER_PORT}:8080 \
-		-p 4000:4000 \
-		$(TEST_TOOLS_PREFIX)$(TEST_TOOLS_IMAGE):$(TEST_TOOLS_TAG) \
-		bash -c "$(1)"
-endef
-
-# Runs any command in the argocd-test-utils container in client mode
-define run-in-test-client
-	docker run --rm -it \
-	  --name argocd-test-client \
-		-u $(shell id -u) \
-		-e HOME=/home/user \
-		-e GOPATH=/go \
-		-e ARGOCD_E2E_K3S=$(ARGOCD_E2E_K3S) \
-		-e GOCACHE=/tmp/go-build-cache \
-		-e ARGOCD_LINT_GOGC=$(ARGOCD_LINT_GOGC) \
-		-v ${DOCKER_SRCDIR}:/go/src${VOLUME_MOUNT} \
-		-v ${GOCACHE}:/tmp/go-build-cache${VOLUME_MOUNT} \
-		-v ${HOME}/.kube:/home/user/.kube${VOLUME_MOUNT} \
-		-v /tmp:/tmp${VOLUME_MOUNT} \
-		-w ${DOCKER_WORKDIR} \
-		$(TEST_TOOLS_NAMESPACE)/$(TEST_TOOLS_IMAGE):$(TEST_TOOLS_TAG) \
-		bash -c "$(1)"
-endef
-
-# 
-define exec-in-test-server
-	docker exec -it -u $(shell id -u) -e ARGOCD_E2E_K3S=$(ARGOCD_E2E_K3S) argocd-test-server $(1)
-endef
-
-PATH:=$(PATH):$(PWD)/hack
 
 # docker image publishing options
-DOCKER_PUSH?=false
-IMAGE_NAMESPACE?=
+DOCKER_PUSH=false
+IMAGE_TAG=latest
 # perform static compilation
-STATIC_BUILD?=true
+STATIC_BUILD=true
 # build development images
-DEV_IMAGE?=false
+DEV_IMAGE=false
 
 override LDFLAGS += \
   -X ${PACKAGE}.version=${VERSION} \
@@ -110,8 +31,6 @@ endif
 ifneq (${GIT_TAG},)
 IMAGE_TAG=${GIT_TAG}
 LDFLAGS += -X ${PACKAGE}.gitTag=${GIT_TAG}
-else
-IMAGE_TAG?=latest
 endif
 
 ifeq (${DOCKER_PUSH},true)
@@ -127,77 +46,46 @@ endif
 .PHONY: all
 all: cli image argocd-util
 
-.PHONY: gogen
-gogen:
-	go generate ./util/argo/...
-
 .PHONY: protogen
 protogen:
 	./hack/generate-proto.sh
 
-.PHONY: openapigen
-openapigen:
-	./hack/update-openapi.sh
-
 .PHONY: clientgen
 clientgen:
 	./hack/update-codegen.sh
 
-.PHONY: codegen-local
-codegen-local: gogen protogen clientgen openapigen manifests-local
-
 .PHONY: codegen
-codegen:
-	$(call run-in-test-client,make codegen-local)
+codegen: protogen clientgen format-code
 
 .PHONY: cli
 cli: clean-debug
 	CGO_ENABLED=0 ${PACKR_CMD} build -v -i -ldflags '${LDFLAGS}' -o ${DIST_DIR}/${CLI_NAME} ./cmd/argocd
 
-.PHONY: cli-docker
-	go build -v -i -ldflags '${LDFLAGS}' -o ${DIST_DIR}/${CLI_NAME} ./cmd/argocd
-
 .PHONY: release-cli
 release-cli: clean-debug image
 	docker create --name tmp-argocd-linux $(IMAGE_PREFIX)argocd:$(IMAGE_TAG)
 	docker cp tmp-argocd-linux:/usr/local/bin/argocd ${DIST_DIR}/argocd-linux-amd64
 	docker cp tmp-argocd-linux:/usr/local/bin/argocd-darwin-amd64 ${DIST_DIR}/argocd-darwin-amd64
-	docker cp tmp-argocd-linux:/usr/local/bin/argocd-windows-amd64.exe ${DIST_DIR}/argocd-windows-amd64.exe
 	docker rm tmp-argocd-linux
 
 .PHONY: argocd-util
 argocd-util: clean-debug
 	# Build argocd-util as a statically linked binary, so it could run within the alpine-based dex container (argoproj/argo-cd#844)
-	CGO_ENABLED=0 ${PACKR_CMD} build -v -i -ldflags '${LDFLAGS}' -o ${DIST_DIR}/argocd-util ./cmd/argocd-util
-
-# .PHONY: dev-tools-image
-# dev-tools-image:
-# 	docker build -t $(DEV_TOOLS_PREFIX)$(DEV_TOOLS_IMAGE) . -f hack/Dockerfile.dev-tools
-# 	docker tag $(DEV_TOOLS_PREFIX)$(DEV_TOOLS_IMAGE) $(DEV_TOOLS_PREFIX)$(DEV_TOOLS_IMAGE):$(DEV_TOOLS_VERSION)
-
-.PHONY: test-tools-image
-test-tools-image:
-	docker build -t $(TEST_TOOLS_PREFIX)$(TEST_TOOLS_IMAGE) -f test/container/Dockerfile .
-	docker tag $(TEST_TOOLS_PREFIX)$(TEST_TOOLS_IMAGE) $(TEST_TOOLS_PREFIX)$(TEST_TOOLS_IMAGE):$(TEST_TOOLS_TAG)
-
-.PHONY: manifests-local
-manifests-local:
-	./hack/update-manifests.sh
+	CGO_ENABLED=0 go build -v -i -ldflags '${LDFLAGS}' -o ${DIST_DIR}/argocd-util ./cmd/argocd-util
 
 .PHONY: manifests
-manifests: test-tools-image
-	$(call run-in-test-client,make manifests-local IMAGE_TAG='${IMAGE_TAG}')
-
+manifests:
+	./hack/update-manifests.sh
 
 # NOTE: we use packr to do the build instead of go, since we embed swagger files and policy.csv
 # files into the go binary
 .PHONY: server
 server: clean-debug
 	CGO_ENABLED=0 ${PACKR_CMD} build -v -i -ldflags '${LDFLAGS}' -o ${DIST_DIR}/argocd-server ./cmd/argocd-server
-
+	
 .PHONY: repo-server
 repo-server:
-	CGO_ENABLED=0 ${PACKR_CMD} build -v -i -ldflags '${LDFLAGS}' -o ${DIST_DIR}/argocd-repo-server ./cmd/argocd-repo-server
+	CGO_ENABLED=0 go build -v -i -ldflags '${LDFLAGS}' -o ${DIST_DIR}/argocd-repo-server ./cmd/argocd-repo-server
 
 .PHONY: controller
 controller:
@@ -212,17 +100,14 @@ ifeq ($(DEV_IMAGE), true)
 # The "dev" image builds the binaries from the users desktop environment (instead of in Docker)
 # which speeds up builds. Dockerfile.dev needs to be copied into dist to perform the build, since
 # the dist directory is under .dockerignore.
-IMAGE_TAG="dev-$(shell git describe --always --dirty)"
 image: packr
 	docker build -t argocd-base --target argocd-base .
-	docker build -t argocd-ui --target argocd-ui .
 	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 dist/packr build -v -i -ldflags '${LDFLAGS}' -o ${DIST_DIR}/argocd-server ./cmd/argocd-server
 	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 dist/packr build -v -i -ldflags '${LDFLAGS}' -o ${DIST_DIR}/argocd-application-controller ./cmd/argocd-application-controller
 	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 dist/packr build -v -i -ldflags '${LDFLAGS}' -o ${DIST_DIR}/argocd-repo-server ./cmd/argocd-repo-server
 	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 dist/packr build -v -i -ldflags '${LDFLAGS}' -o ${DIST_DIR}/argocd-util ./cmd/argocd-util
 	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 dist/packr build -v -i -ldflags '${LDFLAGS}' -o ${DIST_DIR}/argocd ./cmd/argocd
 	CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 dist/packr build -v -i -ldflags '${LDFLAGS}' -o ${DIST_DIR}/argocd-darwin-amd64 ./cmd/argocd
-	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 dist/packr build -v -i -ldflags '${LDFLAGS}' -o ${DIST_DIR}/argocd-windows-amd64.exe ./cmd/argocd
 	cp Dockerfile.dev dist
 	docker build -t $(IMAGE_PREFIX)argocd:$(IMAGE_TAG) -f dist/Dockerfile.dev dist
 else
@@ -234,134 +119,27 @@ endif
 .PHONY: builder-image
 builder-image:
 	docker build  -t $(IMAGE_PREFIX)argo-cd-ci-builder:$(IMAGE_TAG) --target builder .
-	@if [ "$(DOCKER_PUSH)" = "true" ] ; then docker push $(IMAGE_PREFIX)argo-cd-ci-builder:$(IMAGE_TAG) ; fi
+	docker push $(IMAGE_PREFIX)argo-cd-ci-builder:$(IMAGE_TAG)
 
-# Pulls in all vendor dependencies
-.PHONY: dep
-dep:
-	$(call run-in-test-client,dep ensure -v)
-
-# Pulls in all vendor dependencies (local version)
-.PHONY: dep-local
-dep-local:
-	dep ensure -v
-
-# Pulls in all unvendored dependencies
 .PHONY: dep-ensure
 dep-ensure:
-	$(call run-in-test-client,dep ensure -no-vendor -v)
-
-# Pulls in all unvendored dependencies (local version)
-.PHONY: dep-ensure-local
-dep-ensure-local:
 	dep ensure -no-vendor
 
-# Runs dep check in a container to ensure Gopkg.lock is up-to-date with dependencies
-.PHONY: dep-check
-dep-check:
-	$(call run-in-test-client,make dep-check-local)
+.PHONY: format-code
+format-code:
+	./hack/format-code.sh
 
-# Runs dep check locally to ensure Gopkg.lock is up-to-date with dependencies
-.PHONY: dep-check-local
-dep-check-local:
-	if ! dep check -skip-vendor; then echo "Please make sure Gopkg.lock is up-to-date - see https://argoproj.github.io/argo-cd/developer-guide/faq/#why-does-the-build-step-fail"; exit 1; fi
-
-# Deprecated - replace by install-local-tools
-.PHONY: install-lint-tools
-install-lint-tools:
-	./hack/install.sh lint-tools
-
-# Run linter on the code
 .PHONY: lint
 lint:
-	$(call run-in-test-client,make lint-local)
+	golangci-lint run
 
-# Run linter on the code (local version)
-.PHONY: lint-local
-lint-local:
-	golangci-lint --version
-	# NOTE: If you get a "Killed" OOM message, try reducing the value of GOGC
-	# See https://github.com/golangci/golangci-lint#memory-usage-of-golangci-lint
-	GOGC=$(ARGOCD_LINT_GOGC) GOMAXPROCS=2 golangci-lint run --fix --verbose --timeout 300s
-
-.PHONY: lint-ui
-lint-ui:
-	$(call run-in-test-client,make lint-ui-local)
-
-.PHONY: lint-ui-local
-lint-ui-local:
-	cd ui && yarn lint
-
-# Build all Go code
-.PHONY: build
-build:
-	mkdir -p $(GOCACHE)
-	$(call run-in-test-client, make build-local)
-
-# Build all Go code (local version)
-.PHONY: build-local
-build-local:
-	go build -p 1 -v `go list ./... | grep -v 'resource_customizations\|test/e2e'`
-
-# Run all unit tests
-#
-# If TEST_MODULE is set (to fully qualified module name), only this specific
-# module will be tested.
 .PHONY: test
 test:
-	mkdir -p $(GOCACHE)
-	$(call run-in-test-client,make TEST_MODULE=$(TEST_MODULE) test-local)
+	go test -covermode=count -coverprofile=coverage.out `go list ./... | grep -v "github.com/argoproj/argo-cd/test/e2e"`
 
-# Run all unit tests (local version)
-.PHONY: test-local
-test-local:
-	if test "$(TEST_MODULE)" = ""; then \
-		./hack/test.sh -coverprofile=coverage.out `go list ./... | grep -v 'test/e2e'`; \
-	else \
-		./hack/test.sh -coverprofile=coverage.out "$(TEST_MODULE)"; \
-	fi
-
-# Run the E2E test suite. E2E test servers (see start-e2e target) must be
-# started before.
 .PHONY: test-e2e
-test-e2e: 
-	$(call exec-in-test-server,make test-e2e-local)
-
-# Run the E2E test suite (local version)
-.PHONY: test-e2e-local
-test-e2e-local: cli
-	# NO_PROXY ensures all tests don't go out through a proxy if one is configured on the test system
-	NO_PROXY=* ./hack/test.sh -timeout 15m -v ./test/e2e
-
-# Spawns a shell in the test server container for debugging purposes
-debug-test-server:
-	$(call run-in-test-server,/bin/bash)
-
-# Spawns a shell in the test client container for debugging purposes
-debug-test-client:
-	$(call run-in-test-client,/bin/bash)
-
-# Starts e2e server in a container
-.PHONY: start-e2e
-start-e2e: 
-	docker version
-	mkdir -p ${GOCACHE}
-	$(call run-in-test-server,make ARGOCD_PROCFILE=test/container/Procfile start-e2e-local)
-
-# Starts e2e server locally (or within a container)
-.PHONY: start-e2e-local
-start-e2e-local: 
-	kubectl create ns argocd-e2e || true
-	kubectl config set-context --current --namespace=argocd-e2e
-	kustomize build test/manifests/base | kubectl apply -f -
-	# set paths for locally managed ssh known hosts and tls certs data
-	ARGOCD_SSH_DATA_PATH=/tmp/argo-e2e/app/config/ssh \
-	ARGOCD_TLS_DATA_PATH=/tmp/argo-e2e/app/config/tls \
-	ARGOCD_E2E_DISABLE_AUTH=false \
-	ARGOCD_ZJWT_FEATURE_FLAG=always \
-	ARGOCD_IN_CI=$(ARGOCD_IN_CI) \
-	ARGOCD_E2E_TEST=true \
-		goreman -f $(ARGOCD_PROCFILE) start
+test-e2e: cli
+	go test -v -failfast -timeout 20m ./test/e2e
 
 # Cleans VSCode debug.test files from sub-dirs to prevent them from being included in packr boxes
 .PHONY: clean-debug
@@ -372,29 +150,8 @@ clean-debug:
 clean: clean-debug
 	-rm -rf ${CURRENT_DIR}/dist
 
-.PHONY: start
-start:
-	docker version
-	$(call run-in-test-server,make ARGOCD_PROCFILE=test/container/Procfile start-local ARGOCD_START=${ARGOCD_START})
-
-# Starts a local instance of ArgoCD
-.PHONY: start-local
-start-local:
-	# check we can connect to Docker to start Redis
-	killall goreman || true
-	kubectl create ns argocd || true
-	ARGOCD_ZJWT_FEATURE_FLAG=always \
-	ARGOCD_IN_CI=false \
-	ARGOCD_E2E_TEST=false \
-		goreman -f $(ARGOCD_PROCFILE) start ${ARGOCD_START}
-
-# Runs pre-commit validaiton with the virtualized toolchain
 .PHONY: pre-commit
-pre-commit: dep-ensure codegen build lint test
-
-# Runs pre-commit validation with the local toolchain
-.PHONY: pre-commit-local
-pre-commit-local: dep-ensure-local codegen-local build-local lint-local test-local
+pre-commit: dep-ensure codegen format-code test lint
 
 .PHONY: release-precheck
 release-precheck: manifests
@@ -403,54 +160,4 @@ release-precheck: manifests
 	@if [ "$(GIT_TAG)" != "v`cat VERSION`" ]; then echo 'VERSION does not match git tag'; exit 1; fi
 
 .PHONY: release
-release: pre-commit release-precheck image release-cli
-
-.PHONY: build-docs
-build-docs:
-	mkdocs build
-
-.PHONY: serve-docs
-serve-docs:
-	mkdocs serve
-
-.PHONY: lint-docs
-lint-docs:
-	#  https://github.com/dkhamsing/awesome_bot
-	find docs -name '*.md' -exec grep -l http {} + | xargs docker run --rm -v $(PWD):/mnt:ro dkhamsing/awesome_bot -t 3 --allow-dupe --allow-redirect --white-list `cat white-list | grep -v "#" | tr "\n" ','` --skip-save-results --
-
-.PHONY: publish-docs
-publish-docs: lint-docs
-	mkdocs gh-deploy
-
-# Verify that kubectl can connect to your K8s cluster from Docker
-.PHONY: verify-kube-connect
-verify-kube-connect:
-	$(call run-in-test-client,kubectl version)
-
-# Show the Go version of local and virtualized environments
-.PHONY: show-go-version
-show-go-version:
-	@echo -n "Local Go version: "
-	@go version
-	@echo -n "Docker Go version: "
-	$(call run-in-test-client,go version)
-
-# Installs all tools required to build and test ArgoCD locally
-.PHONY: install-tools-local
-install-tools-local:
-	./hack/install.sh dep-linux
-	./hack/install.sh packr-linux
-	./hack/install.sh kubectl-linux
-	./hack/install.sh ksonnet-linux
-	./hack/install.sh helm2-linux
-	./hack/install.sh helm-linux
-	./hack/install.sh codegen-tools
-	./hack/install.sh codegen-go-tools
-	./hack/install.sh lint-tools
-
-.PHONY: dep-ui
-dep-ui:
-	$(call run-in-test-client,make dep-ui-local)
-
-dep-ui-local:
-	cd ui && yarn install
+release: release-precheck pre-commit image release-cli

OWNERS

@@ -3,10 +3,6 @@ owners:
 - jessesuen
 
 approvers:
-- alexec
 - alexmt
-- dthomson25
-- jannfis
 - jessesuen
-- mayzhang2000
-- rachelwang20
+- merenbach

Procfile

@@ -1,7 +1,5 @@
-controller: sh -c "FORCE_LOG_COLORS=1 ARGOCD_FAKE_IN_CLUSTER=true go run ./cmd/argocd-application-controller/main.go --loglevel debug --redis localhost:${ARGOCD_E2E_REDIS_PORT:-6379} --repo-server localhost:${ARGOCD_E2E_REPOSERVER_PORT:-8081}"
-api-server: sh -c "FORCE_LOG_COLORS=1 ARGOCD_FAKE_IN_CLUSTER=true go run ./cmd/argocd-server/main.go --loglevel debug --redis localhost:${ARGOCD_E2E_REDIS_PORT:-6379} --disable-auth=${ARGOCD_E2E_DISABLE_AUTH:-'true'} --insecure --dex-server http://localhost:${ARGOCD_E2E_DEX_PORT:-5556} --repo-server localhost:${ARGOCD_E2E_REPOSERVER_PORT:-8081} --port ${ARGOCD_E2E_APISERVER_PORT:-8080} --staticassets ui/dist/app"
-dex: sh -c "go run github.com/argoproj/argo-cd/cmd/argocd-util gendexcfg -o `pwd`/dist/dex.yaml && docker run --rm -p ${ARGOCD_E2E_DEX_PORT:-5556}:${ARGOCD_E2E_DEX_PORT:-5556} -v `pwd`/dist/dex.yaml:/dex.yaml quay.io/dexidp/dex:v2.22.0 serve /dex.yaml"
-redis: docker run --rm --name argocd-redis -i -p ${ARGOCD_E2E_REDIS_PORT:-6379}:${ARGOCD_E2E_REDIS_PORT:-6379} redis:5.0.3-alpine --save "" --appendonly no --port ${ARGOCD_E2E_REDIS_PORT:-6379}
-repo-server: sh -c "FORCE_LOG_COLORS=1 ARGOCD_FAKE_IN_CLUSTER=true go run ./cmd/argocd-repo-server/main.go --loglevel debug --port ${ARGOCD_E2E_REPOSERVER_PORT:-8081} --redis localhost:${ARGOCD_E2E_REDIS_PORT:-6379}"
-ui: sh -c 'cd ui && ${ARGOCD_E2E_YARN_CMD:-yarn} start'
-git-server: test/fixture/testrepos/start-git.sh
+controller: sh -c "ARGOCD_FAKE_IN_CLUSTER=true go run ./cmd/argocd-application-controller/main.go --loglevel debug --redis localhost:6379 --repo-server localhost:8081"
+api-server: sh -c "ARGOCD_FAKE_IN_CLUSTER=true go run ./cmd/argocd-server/main.go --loglevel debug --redis localhost:6379 --disable-auth --insecure --dex-server http://localhost:5556 --repo-server localhost:8081 --staticassets ../argo-cd-ui/dist/app"
+repo-server: go run ./cmd/argocd-repo-server/main.go --loglevel debug --redis localhost:6379
+dex: sh -c "go run ./cmd/argocd-util/main.go gendexcfg -o `pwd`/dist/dex.yaml && docker run --rm -p 5556:5556 -v `pwd`/dist/dex.yaml:/dex.yaml quay.io/dexidp/dex:v2.14.0 serve /dex.yaml"
+redis: docker run --rm -i -p 6379:6379 redis:5.0.3-alpine --save "" --appendonly no

README.md

@@ -1,6 +1,5 @@
 [![slack](https://img.shields.io/badge/slack-argoproj-brightgreen.svg?logo=slack)](https://argoproj.github.io/community/join-slack)
 [![codecov](https://codecov.io/gh/argoproj/argo-cd/branch/master/graph/badge.svg)](https://codecov.io/gh/argoproj/argo-cd)
-[![Release Version](https://img.shields.io/github/v/release/argoproj/argo-cd?label=argo-cd)](https://github.com/argoproj/argo-cd/releases/latest)
 
 # Argo CD - Declarative Continuous Delivery for Kubernetes
 
@@ -8,31 +7,100 @@
 
 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.
 
-![Argo CD UI](docs/assets/argocd-ui.gif)
+![Argo CD UI](docs/argocd-ui.gif)
 
 ## Why Argo CD?
 
-1. Application definitions, configurations, and environments should be declarative and version controlled.
-1. Application deployment and lifecycle management should be automated, auditable, and easy to understand.
+Application definitions, configurations, and environments should be declarative and version controlled.
+Application deployment and lifecycle management should be automated, auditable, and easy to understand.
 
-## Who uses Argo CD?
+## Getting Started
 
-[Official Argo CD user list](USERS.md)
+### Quickstart
 
-## Documentation
+```bash
+kubectl create namespace argocd
+kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
+```
 
-To learn more about Argo CD [go to the complete documentation](https://argoproj.github.io/argo-cd/).
-Check live demo at https://cd.apps.argoproj.io/.
+Follow our [getting started guide](docs/getting_started.md). Further [documentation](docs/)
+is provided for additional features.
+
+## How it works
+
+Argo CD follows the **GitOps** pattern of using git repositories as the source of truth for defining
+the desired application state. Kubernetes manifests can be specified in several ways:
+* [kustomize](https://kustomize.io) applications
+* [helm](https://helm.sh) charts
+* [ksonnet](https://ksonnet.io) applications
+* [jsonnet](https://jsonnet.org) files 
+* Plain directory of YAML/json manifests
+* Any custom config management tool configured as a config management plugin
+
+Argo CD automates the deployment of the desired application states in the specified target environments.
+Application deployments can track updates to branches, tags, or pinned to a specific version of
+manifests at a git commit. See [tracking strategies](docs/tracking_strategies.md) for additional
+details about the different tracking strategies available.
+
+For a quick 10 minute overview of Argo CD, check out the demo presented to the Sig Apps community
+meeting:
+[![Alt text](https://img.youtube.com/vi/aWDIQMbp1cc/0.jpg)](https://youtu.be/aWDIQMbp1cc?t=1m4s)
+
+
+## Architecture
+
+![Argo CD Architecture](docs/argocd_architecture.png)
+
+Argo CD is implemented as a kubernetes controller which continuously monitors running applications
+and compares the current, live state against the desired target state (as specified in the git repo).
+A deployed application whose live state deviates from the target state is considered `OutOfSync`.
+Argo CD reports & visualizes the differences, while providing facilities to automatically or
+manually sync the live state back to the desired target state. Any modifications made to the desired
+target state in the git repo can be automatically applied and reflected in the specified target
+environments.
+
+For additional details, see [architecture overview](docs/architecture.md).
+
+## Features
+
+* Automated deployment of applications to specified target environments
+* Support for multiple config management/templating tools (Kustomize, Helm, Ksonnet, Jsonnet, plain-YAML)
+* Ability to manage and deploy to multiple clusters
+* SSO Integration (OIDC, OAuth2, LDAP, SAML 2.0, GitHub, GitLab, Microsoft, LinkedIn)
+* Multi-tenancy and RBAC policies for authorization
+* Rollback/Roll-anywhere to any application configuration committed in git repository
+* Health status analysis of application resources
+* Automated configuration drift detection and visualization
+* Automated or manual syncing of applications to its desired state
+* Web UI which provides real-time view of application activity
+* CLI for automation and CI integration
+* Webhook integration (GitHub, BitBucket, GitLab)
+* Access tokens for automation
+* PreSync, Sync, PostSync hooks to support complex application rollouts (e.g.blue/green & canary upgrades)
+* Audit trails for application events and API calls
+* Prometheus metrics
+* Parameter overrides for overriding ksonnet/helm parameters in git
 
 ## Community Blogs and Presentations
+* GitOps with Argo CD: [Simplify and Automate Deployments Using GitOps with IBM Multicloud Manager](https://www.ibm.com/blogs/bluemix/2019/02/simplify-and-automate-deployments-using-gitops-with-ibm-multicloud-manager-3-1-2/)
+* KubeCon talk: [CI/CD in Light Speed with K8s and Argo CD](https://www.youtube.com/watch?v=OdzH82VpMwI&feature=youtu.be)
+* KubeCon talk: [Machine Learning as Code](https://www.youtube.com/watch?v=VXrGp5er1ZE&t=0s&index=135&list=PLj6h78yzYM2PZf9eA7bhWnIh_mK1vyOfU)
+  * Among other things, desribes how Kubeflow uses Argo CD to implement GitOPs for ML
+* SIG Apps demo: [Argo CD - GitOps Continuous Delivery for Kubernetes](https://www.youtube.com/watch?v=aWDIQMbp1cc&feature=youtu.be&t=1m4s)
 
-1. [Tutorial: Everything You Need To Become A GitOps Ninja](https://www.youtube.com/watch?v=r50tRQjisxw) 90m tutorial on GitOps and Argo CD.
-1. [Comparison of Argo CD, Spinnaker, Jenkins X, and Tekton](https://www.inovex.de/blog/spinnaker-vs-argo-cd-vs-tekton-vs-jenkins-x/)
-1. [Simplify and Automate Deployments Using GitOps with IBM Multicloud Manager 3.1.2](https://medium.com/ibm-cloud/simplify-and-automate-deployments-using-gitops-with-ibm-multicloud-manager-3-1-2-4395af317359)
-1. [GitOps for Kubeflow using Argo CD](https://www.kubeflow.org/docs/use-cases/gitops-for-kubeflow/)
-1. [GitOps Toolsets on Kubernetes with CircleCI and Argo CD](https://www.digitalocean.com/community/tutorials/webinar-series-gitops-tool-sets-on-kubernetes-with-circleci-and-argo-cd)
-1. [Simplify and Automate Deployments Using GitOps with IBM Multicloud Manager](https://www.ibm.com/blogs/bluemix/2019/02/simplify-and-automate-deployments-using-gitops-with-ibm-multicloud-manager-3-1-2/)
-1. [CI/CD in Light Speed with K8s and Argo CD](https://www.youtube.com/watch?v=OdzH82VpMwI&feature=youtu.be)
-1. [Machine Learning as Code](https://www.youtube.com/watch?v=VXrGp5er1ZE&t=0s&index=135&list=PLj6h78yzYM2PZf9eA7bhWnIh_mK1vyOfU). Among other things, describes how Kubeflow uses Argo CD to implement GitOPs for ML
-1. [Argo CD - GitOps Continuous Delivery for Kubernetes](https://www.youtube.com/watch?v=aWDIQMbp1cc&feature=youtu.be&t=1m4s)
-1. [Introduction to Argo CD : Kubernetes DevOps CI/CD](https://www.youtube.com/watch?v=2WSJF7d8dUg&feature=youtu.be)
+## Project Resources
+* Argo GitHub:  https://github.com/argoproj
+* Argo Slack:   [click here to join](https://argoproj.github.io/community/join-slack)
+* Argo website: https://argoproj.github.io/
+
+## Development Status
+* Argo CD is actively developed and is being used in production to deploy SaaS services at Intuit
+
+## Roadmap
+
+### v0.12
+* Support for custom K8S manifest templating engines
+* Support for custom health assessments (e.g. CRD health)
+* Improved prometheus metrics
+* Higher availability
+* UI improvements

SECURITY_CONTACTS

@@ -1,8 +0,0 @@
-# Defined below are the security contacts for this repo.
-#
-# DO NOT REPORT SECURITY VULNERABILITIES DIRECTLY TO THESE NAMES, FOLLOW THE
-# INSTRUCTIONS AT https://argoproj.github.io/argo-cd/security_considerations/#reporting-vulnerabilities
-
-alexmt
-edlee2121
-jessesuen

USERS.md

@@ -1,60 +0,0 @@
-## Who uses Argo CD?
-
-As the Argo Community grows, we'd like to keep track of our users. Please send a PR with your organization name if you are using Argo CD.
-
-Currently, the following organizations are **officially** using Argo CD:
-
-1. [127Labs](https://127labs.com/)
-1. [Adevinta](https://www.adevinta.com/)
-1. [ANSTO - Australian Synchrotron](https://www.synchrotron.org.au/)
-1. [ARZ Allgemeines Rechenzentrum GmbH ](https://www.arz.at/)
-1. [Baloise](https://www.baloise.com)
-1. [BioBox Analytics](https://biobox.io)
-1. [CARFAX](https://www.carfax.com)
-1. [Celonis](https://www.celonis.com/)
-1. [Codility](https://www.codility.com/)
-1. [Commonbond](https://commonbond.co/)
-1. [CyberAgent](https://www.cyberagent.co.jp/en/)
-1. [Cybozu](https://cybozu-global.com)
-1. [EDF Renewables](https://www.edf-re.com/)
-1. [Elium](https://www.elium.com)
-1. [END.](https://www.endclothing.com/)
-1. [Fave](https://myfave.com)
-1. [Future PLC](https://www.futureplc.com/)
-1. [GMETRI](https://gmetri.com/)
-1. [Healy](https://www.healyworld.net)
-1. [hipages](https://hipages.com.au/)
-1. [Intuit](https://www.intuit.com/)
-1. [KintoHub](https://www.kintohub.com/)
-1. [KompiTech GmbH](https://www.kompitech.com/)
-1. [Lytt](https://www.lytt.co/)
-1. [Major League Baseball](https://mlb.com)
-1. [Mambu](https://www.mambu.com/)
-1. [Max Kelsen](https://www.maxkelsen.com/)
-1. [Mirantis](https://mirantis.com/)
-1. [MOO Print](https://www.moo.com/)
-1. [OpenSaaS Studio](https://opensaas.studio)
-1. [Optoro](https://www.optoro.com/)
-1. [Peloton Interactive](https://www.onepeloton.com/)
-1. [Pipefy](https://www.pipefy.com/)
-1. [Prudential](https://prudential.com.sg)
-1. [Red Hat](https://www.redhat.com/)
-1. [Robotinfra](https://www.robotinfra.com)
-1. [Riskified](https://www.riskified.com/)
-1. [Saildrone](https://www.saildrone.com/)
-1. [Saloodo! GmbH](https://www.saloodo.com)
-1. [Syncier](https://syncier.com/)
-1. [Tesla](https://tesla.com/)
-1. [ThousandEyes](https://www.thousandeyes.com/)
-1. [Ticketmaster](https://ticketmaster.com)
-1. [Tiger Analytics](https://www.tigeranalytics.com/)
-1. [Twilio SendGrid](https://sendgrid.com)
-1. [tZERO](https://www.tzero.com/)
-1. [UBIO](https://ub.io/)
-1. [Universidad Mesoamericana](https://www.umes.edu.gt/)
-1. [Viaduct](https://www.viaduct.ai/)
-1. [Volvo Cars](https://www.volvocars.com/)
-1. [Walkbase](https://www.walkbase.com/)
-1. [Whitehat Berlin](https://whitehat.berlin) by Guido Maria Serra +Fenaroli
-1. [Yieldlab](https://www.yieldlab.de/)
-1. [MTN Group](https://www.mtn.com/)

VERSION

@@ -1 +1 @@
-1.5.7
+0.12.3

assets/badge.svg

@@ -1,24 +0,0 @@
-<svg width="131" height="20" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" >
-    <defs>
-        <filter id="dropShadow">
-            <feDropShadow dx="0.2" dy="0.4" stdDeviation="0.2" flood-color="#333" flood-opacity="0.5"/>
-        </filter>
-    </defs>
-
-    <clipPath id="roundedCorners">
-        <rect width="100%" height="100%" rx="3" opacity="1" />
-    </clipPath>
-
-    <g clip-path="url(#roundedCorners)">
-        <rect id="leftRect" fill="#555" x="0" y="0" width="74" height="20" />
-        <rect id="rightRect" fill="#4c1" x="74" y="0" width="57" height="20" />
-        <rect id="revisionRect" fill="#4c1" x="131" y="0" width="62" height="20" display="none"/>
-    </g>
-
-    <g fill="#fff" style="filter: url(#dropShadow);" text-anchor="middle" font-family="DejaVu Sans, sans-serif" font-size="90">
-        <image x="5" y="3" width="14" height="14" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB8AAAAeCAYAAADU8sWcAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAACXBIWXMAAABPAAAATwFjiv3XAAACC2lUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iWE1QIENvcmUgNS40LjAiPgogICA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPgogICAgICA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIgogICAgICAgICAgICB4bWxuczp0aWZmPSJodHRwOi8vbnMuYWRvYmUuY29tL3RpZmYvMS4wLyI+CiAgICAgICAgIDx0aWZmOlJlc29sdXRpb25Vbml0PjI8L3RpZmY6UmVzb2x1dGlvblVuaXQ+CiAgICAgICAgIDx0aWZmOkNvbXByZXNzaW9uPjE8L3RpZmY6Q29tcHJlc3Npb24+CiAgICAgICAgIDx0aWZmOk9yaWVudGF0aW9uPjE8L3RpZmY6T3JpZW50YXRpb24+CiAgICAgICAgIDx0aWZmOlBob3RvbWV0cmljSW50ZXJwcmV0YXRpb24+MjwvdGlmZjpQaG90b21ldHJpY0ludGVycHJldGF0aW9uPgogICAgICA8L3JkZjpEZXNjcmlwdGlvbj4KICAgPC9yZGY6UkRGPgo8L3g6eG1wbWV0YT4KD0UqkwAACpZJREFUSA11VnmQFcUZ//qY4527by92WWTXwHKqEJDDg0MQUioKSWopK4oaS9RAlMofUSPGbFlBSaViKomgQSNmIdECkUS8ophdozEJArKoKCsgIFlY2Pu9N29mero7X78FxCR2Vb8309PTv+/4fb9vCHz1II2Nm+jmzYul2bJsdlMyO7LyPGlZtYqQck1ZHCgwLZWiROeJgB7bDzpYb/7o0y/emzXv4Pts8+ZGBUC0uf/vQf57wdw3NTVRnOYFfXvj6pJcadkUmbDGRoxVSEItSYAQQrUmRBP81VoRpkFTJUMuZA/3g/28q3dn89b7u885D4348vgf8NPAxY033LJmSlDizlSOU94f6UhoHaZdC/3QCHWON2gDYBhAYyRAWgyD4QSi1815f29++vv/+CoD2Lm2nAFGl8mndzyxMMgk5/iW6xzPi/xVk+oyE8+vLNt14FR/0uYW14ox0IwUJ4ZAaUpAaaBEYByiyLbikWWNnnThvPIxu+L717auVeb81tbWsyk4C34u8I3LnlhcSCameMzykg7TwzOJGIYWQj+M+voLYcSo/hxY1E65FECUq4G4RFP0nSjMCMVAIIKUnOHkw90L6qq/vXvbh02trV8yoBh2E0NMY9GiG+58fIGXTF6epyw7JOnamZQbz/tCnDrVVzgqqdwTT0ZTdWDN0wPpMh3ZPZqHLSw98C7Y4RwtnAodsTwGAg0ppkcxrlkYJFID+Z0bn/zelsFImzQRXfScNJFiOG689dcT/FT6GzlqedVJTHRpPH6yz/PyfTlx2IrLCpvSdWrv5OXkX9fOJB/Mnaz3XzItap+yMDoyZgEE7F1SceIghryeRNwnTBkEqhRIxiLF6bCpDXNybW2v/ruxcTzbt2+zZmfCvWT+zxNhbek3cxaPlyYsXVWSSHT25rxC3o+OWK6aDn7sZ3r79ZNY28w45Esxuhw5RjmVvEQPlIwgR8bOiE7VdrPaA2+TeGEEhFbhtAEmG5pzk5WqqbWTPv7jC8sLpgxNSRWZrUeWTAgor7EY9ytTiURvzg8GskGU5xxKkc33yDcX1yc7x3ijLxF+zZgoEljgCrSiXOWIG/WGrjifHxl1V9iyeKwW1lHNo5SKmDmcYinivwhjVpkor55sQj9+/D4MO9bpLW8RN6zJzMvbPDUkHaecE368N1+IUUJfIm5hPf1w2kTedlm/LgntmqEWEQGT3ScJYUh2NIxiiWupSUFasor1VgzXvPATfv6BC3Roq0E9MLqAXKQcAe1rqi/dv+q3DwQUw6djY6tiAaG1jLEw7nAn64WhcStPqZqpA6chap8aage077GwbQcJDx8Awq3T3DHlbeijUHWwytHFuuizCTergdQ+YocxLRHVPNcESRAJxqo60nbSvExvvvWx23MCVvucDyRt5hitwDRHHG09pZiaT7MlSUdUhtQGZttYRdwA4WnFQjFnDA4LX7UdIlgMYpaouBgGMnuBKVN/ZhgBRCMVynNAHOfRm777q4UcrW3EZxcEnD/kclYlpVaFKFIZrIRtluvdls/G9InnLZ9fpLXoJjwZAzZkDJ5mjkIj8HTCKETH9oD0eoikMSDQ5cTrLrUg4QoaFlxUH5MdYy6yAFAaYBHed6ODkMPOkMcFZggZKa0SkaL/jMeDpq5D1Vez9693V/wNUg1jQRY8yLX8BcSba8AaOgyBOdqtQBz7DNj8lZCeNY9SN6aiD3bTOc89s2iliDVvKa3uGxf6doQAxYE2oBbm0HQPG5IxqKhOg9ZpSSQj+pDU+jv5t7913spV5c70GcqLJwgMGw6ZJUuBLbgHPW0D4rgQdewDvnAllN58B0D918AvzVBn3jWi/p4Hq2/s+et1URgBRlVRMGVvBtITfwyuyYPAoIRmWSIrEqjZW1Ml/qN7dtRWzptfBzXDoaeri6TicWhes8Zsg9iMOaAyU0D3fw4qdSEkrryquP77xx+HZCwG3T09HEZfCBUXTxh125H9VZ9SHp1OfZF4aEWI9MM1AhmiVCmaIwV6a2F5ge2q8s7OBB8ytPiOZduw6pFHYOS4cUUQGsNWXj4MVLYdaGU9UAQ0o2H8eHh49WpAITReKqdmGC0PsvF2JB4Gu+i5RqKg5JSi82mOnu9GYGEhwbFjSOXadJII7Pa6Ed3hwU8igAU8lU7D/ffdZ1pFEUT19YI+sR9oZgLIjo8h6usDu2oIzJpxOc4ZphKQtoqFxw6LzxIV/RMxkabSUPAJRz3A5oc50x9T7Lf3xkR0R0xGSS+IRIFQOUUUkqvGXdR5tGXnLmjbYXI0OLCJykIBvFe2ABVHgCQqgMpjkH9xE9IY7cSgGd0w+8mOVjiy68DOh+sauusiwSM8F11nlhCm39/SvP7ux4qNZVfba/0TJ183Is9opWtxEXe5E/cC+Y5bf+CilmczqaC/JigEOjjYTrwtzwB8tAn4kJFGMIEmy0B98gb4B7tAYimHncd19ObLrP25rW0/rb76pQqsoKTEkKJgoT64biCObVx35xvGGz67qYW3Nl0RWYH/ftxmo7pyfpSoKFFjEiLxhE73jXaueHXlGw+PZ68rS8pQ01QlodUjTqcAfcQo8qGjQB36EwQfbFAuF8wjZbmNtStefZ4nC0uibKIHez92AeZEUln5wocGuLGxyUbg2cVEFp5a9pFz11MH/ZCP6M0V8gmbxWZL35K2paFmUmjDgCXAMQkjqv8wgFMGBFVSCw8g1wWsrB5IBrTDAvB0eaAkhVHCeGzSQDUm3bE9/1hs/d7dBhy5aSqAaNNWN6Mvdn9+e0KGfl8hZCd6vBwqABmISKSkCgkqr/a6QMWrwLpsKaYWhfrwi1ikfWBNvQmUhXItAlznICMlcopFFNXcEA25wBw/EIms2L4O1onZs5u46abFUsILDWhAc/OKo7H+/OtuEFqaUcsmIE8CR47zEMsSuJvRQcceODVmOqR/uAHKftAC6R+9AKcmzgVxci9qexwLTIDZ34+MR6FVErXECXw7kc+3/G7j8gPG0dbWJmQnum1+zDj3U2rJ0rWzvFRynu/YskMTb5vetmwI7xyeg7R0g072ynEGwa0PwZTRDbDn0GGI1j0Ii2pCKPCyqJTl+eei9tOl5Kr1eU2seuG5ZMBv2fjUIMkQymAWC6jouQE3jdlYZa43PLnsLbcn++eYVwi6FCQktTCEmO3QAx2rhOllAl6bOwsahg2FDTMvhRklWVSUMkxcWEyHJFbUqyCW9AtRSV//K18AF4XmbOWeBTegCF78ujTXf3hm+XvTeo49G8/67Sg+A0a0OGc6CDzIlFbDL3+8GPYuuxLWP7AYysprIQx9YNjdzAglyVkD3qGvd3dsWvv0infM2qBj53zr49rZsJsNZwa2WeTTFxtP3L1oe1VCzh3AWqOM2FJJsFBwbMuCUAgQyAqGrVVJ7Zdwyz2RZS/X/GbrguJ5eNYgyhfnncH5v+DmYcft18Y1T5S7fl9jPMN+4aM6IpeQPmgxThNA5AnuJFhIeI2tHafiNqEUW1XQL+8NrfRznENP1drNuTOA5/5/KezmAZ4zaJBSdVaUvQk5PsNTeqfrMsKQOui5LGKibBAjmKgSRk/RIMlc8BiWCLbI95Dx05jybrMkfsh+xfgPf+hH0AC4OlsAAAAASUVORK5CYII="/>
-        <text id="leftText" x="435" y="140" transform="scale(.1)" textLength="470"></text>
-        <text id="rightText" x="995" y="140" transform="scale(.1)" textLength="470"></text>
-        <text id="revisionText" x="1550" y="140" font-family="monospace" transform="scale(.1)" font-size="110" display="none"></text>
-    </g>
-</svg>

assets/builtin-policy.csv

@@ -7,21 +7,14 @@
 # p, <user/group>, <resource>, <action>, <object>
 
 p, role:readonly, applications, get, */*, allow
-p, role:readonly, certificates, get, *, allow
 p, role:readonly, clusters, get, *, allow
 p, role:readonly, repositories, get, *, allow
 p, role:readonly, projects, get, *, allow
-p, role:readonly, accounts, get, *, allow
 
 p, role:admin, applications, create, */*, allow
 p, role:admin, applications, update, */*, allow
 p, role:admin, applications, delete, */*, allow
 p, role:admin, applications, sync, */*, allow
-p, role:admin, applications, override, */*, allow
-p, role:admin, applications, action/*, */*, allow
-p, role:admin, certificates, create, *, allow
-p, role:admin, certificates, update, *, allow
-p, role:admin, certificates, delete, *, allow
 p, role:admin, clusters, create, *, allow
 p, role:admin, clusters, update, *, allow
 p, role:admin, clusters, delete, *, allow
@@ -31,7 +24,6 @@ p, role:admin, repositories, delete, *, allow
 p, role:admin, projects, create, *, allow
 p, role:admin, projects, update, *, allow
 p, role:admin, projects, delete, *, allow
-p, role:admin, accounts, update, *, allow
 
 g, role:admin, role:readonly
 g, admin, role:admin

cmd/argocd-application-controller/main.go

@@ -6,8 +6,6 @@ import (
 	"os"
 	"time"
 
-	"github.com/argoproj/pkg/stats"
-	"github.com/go-redis/redis"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"k8s.io/client-go/kubernetes"
@@ -18,18 +16,16 @@ import (
 	// load the oidc plugin (required to authenticate with OpenID Connect).
 	_ "k8s.io/client-go/plugin/pkg/client/auth/oidc"
 
+	argocd "github.com/argoproj/argo-cd"
 	"github.com/argoproj/argo-cd/common"
 	"github.com/argoproj/argo-cd/controller"
 	"github.com/argoproj/argo-cd/errors"
-	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
 	appclientset "github.com/argoproj/argo-cd/pkg/client/clientset/versioned"
-	"github.com/argoproj/argo-cd/reposerver/apiclient"
-	cacheutil "github.com/argoproj/argo-cd/util/cache"
-	appstatecache "github.com/argoproj/argo-cd/util/cache/appstate"
+	"github.com/argoproj/argo-cd/reposerver"
+	"github.com/argoproj/argo-cd/util/cache"
 	"github.com/argoproj/argo-cd/util/cli"
-	"github.com/argoproj/argo-cd/util/diff"
-	"github.com/argoproj/argo-cd/util/kube"
 	"github.com/argoproj/argo-cd/util/settings"
+	"github.com/argoproj/argo-cd/util/stats"
 )
 
 const (
@@ -45,15 +41,11 @@ func newCommand() *cobra.Command {
 		appResyncPeriod          int64
 		repoServerAddress        string
 		repoServerTimeoutSeconds int
-		selfHealTimeoutSeconds   int
 		statusProcessors         int
 		operationProcessors      int
 		logLevel                 string
 		glogLevel                int
-		metricsPort              int
-		kubectlParallelismLimit  int64
-		cacheSrc                 func() (*appstatecache.Cache, error)
-		redisClient              *redis.Client
+		cacheSrc                 func() (*cache.Cache, error)
 	)
 	var command = cobra.Command{
 		Use:   cliName,
@@ -63,8 +55,9 @@ func newCommand() *cobra.Command {
 			cli.SetGLogLevel(glogLevel)
 
 			config, err := clientConfig.ClientConfig()
+			config.QPS = common.K8sClientConfigQPS
+			config.Burst = common.K8sClientConfigBurst
 			errors.CheckError(err)
-			errors.CheckError(v1alpha1.SetK8SConfigDefaults(config))
 
 			kubeClient := kubernetes.NewForConfigOrDie(config)
 			appClient := appclientset.NewForConfigOrDie(config)
@@ -73,7 +66,7 @@ func newCommand() *cobra.Command {
 			errors.CheckError(err)
 
 			resyncDuration := time.Duration(appResyncPeriod) * time.Second
-			repoClientset := apiclient.NewRepoServerClientset(repoServerAddress, repoServerTimeoutSeconds)
+			repoClientset := reposerver.NewRepoServerClientset(repoServerAddress, repoServerTimeoutSeconds)
 			ctx, cancel := context.WithCancel(context.Background())
 			defer cancel()
 
@@ -81,9 +74,6 @@ func newCommand() *cobra.Command {
 			errors.CheckError(err)
 
 			settingsMgr := settings.NewSettingsManager(ctx, kubeClient, namespace)
-			kubectl := &kube.KubectlCmd{}
-			legacyDiffDisabled := os.Getenv("ARGOCD_ENABLE_LEGACY_DIFF") == "false"
-			diff.SetPopulateLegacyDiff(!legacyDiffDisabled)
 			appController, err := controller.NewApplicationController(
 				namespace,
 				settingsMgr,
@@ -91,16 +81,10 @@ func newCommand() *cobra.Command {
 				appClient,
 				repoClientset,
 				cache,
-				kubectl,
-				resyncDuration,
-				time.Duration(selfHealTimeoutSeconds)*time.Second,
-				metricsPort,
-				kubectlParallelismLimit)
+				resyncDuration)
 			errors.CheckError(err)
-			cacheutil.CollectMetrics(redisClient, appController.GetMetricsServer())
 
-			vers := common.GetVersion()
-			log.Infof("Application Controller (version: %s, built: %s) starting (namespace: %s)", vers.Version, vers.BuildDate, namespace)
+			log.Infof("Application Controller (version: %s) starting (namespace: %s)", argocd.GetVersion(), namespace)
 			stats.RegisterStackDumper()
 			stats.StartStatsTicker(10 * time.Minute)
 			stats.RegisterHeapDumper("memprofile")
@@ -120,12 +104,7 @@ func newCommand() *cobra.Command {
 	command.Flags().IntVar(&operationProcessors, "operation-processors", 1, "Number of application operation processors")
 	command.Flags().StringVar(&logLevel, "loglevel", "info", "Set the logging level. One of: debug|info|warn|error")
 	command.Flags().IntVar(&glogLevel, "gloglevel", 0, "Set the glog logging level")
-	command.Flags().IntVar(&metricsPort, "metrics-port", common.DefaultPortArgoCDMetrics, "Start metrics server on given port")
-	command.Flags().IntVar(&selfHealTimeoutSeconds, "self-heal-timeout-seconds", 5, "Specifies timeout between application self heal attempts")
-	command.Flags().Int64Var(&kubectlParallelismLimit, "kubectl-parallelism-limit", 20, "Number of allowed concurrent kubectl fork/execs. Any value less the 1 means no limit.")
-	cacheSrc = appstatecache.AddCacheFlagsToCmd(&command, func(client *redis.Client) {
-		redisClient = client
-	})
+	cacheSrc = cache.AddCacheFlagsToCmd(&command)
 	return &command
 }
 

cmd/argocd-repo-server/main.go

@@ -7,18 +7,18 @@ import (
 	"os"
 	"time"
 
-	"github.com/argoproj/pkg/stats"
-	"github.com/go-redis/redis"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 
+	argocd "github.com/argoproj/argo-cd"
 	"github.com/argoproj/argo-cd/common"
 	"github.com/argoproj/argo-cd/errors"
 	"github.com/argoproj/argo-cd/reposerver"
-	reposervercache "github.com/argoproj/argo-cd/reposerver/cache"
-	"github.com/argoproj/argo-cd/reposerver/metrics"
-	cacheutil "github.com/argoproj/argo-cd/util/cache"
+	"github.com/argoproj/argo-cd/util/cache"
 	"github.com/argoproj/argo-cd/util/cli"
+	"github.com/argoproj/argo-cd/util/git"
+	"github.com/argoproj/argo-cd/util/stats"
 	"github.com/argoproj/argo-cd/util/tls"
 )
 
@@ -31,11 +31,8 @@ func newCommand() *cobra.Command {
 	var (
 		logLevel               string
 		parallelismLimit       int64
-		listenPort             int
-		metricsPort            int
-		cacheSrc               func() (*reposervercache.Cache, error)
+		cacheSrc               func() (*cache.Cache, error)
 		tlsConfigCustomizerSrc func() (tls.ConfigCustomizer, error)
-		redisClient            *redis.Client
 	)
 	var command = cobra.Command{
 		Use:   cliName,
@@ -49,19 +46,16 @@ func newCommand() *cobra.Command {
 			cache, err := cacheSrc()
 			errors.CheckError(err)
 
-			metricsServer := metrics.NewMetricsServer()
-			cacheutil.CollectMetrics(redisClient, metricsServer)
-			server, err := reposerver.NewServer(metricsServer, cache, tlsConfigCustomizer, parallelismLimit)
+			server, err := reposerver.NewServer(git.NewFactory(), cache, tlsConfigCustomizer, parallelismLimit)
 			errors.CheckError(err)
-
 			grpc := server.CreateGRPC()
-			listener, err := net.Listen("tcp", fmt.Sprintf(":%d", listenPort))
+			listener, err := net.Listen("tcp", fmt.Sprintf(":%d", common.PortRepoServer))
 			errors.CheckError(err)
 
-			http.Handle("/metrics", metricsServer.GetHandler())
-			go func() { errors.CheckError(http.ListenAndServe(fmt.Sprintf(":%d", metricsPort), nil)) }()
+			http.Handle("/metrics", promhttp.Handler())
+			go func() { errors.CheckError(http.ListenAndServe(fmt.Sprintf(":%d", common.PortRepoServerMetrics), nil)) }()
 
-			log.Infof("argocd-repo-server %s serving on %s", common.GetVersion(), listener.Addr())
+			log.Infof("argocd-repo-server %s serving on %s", argocd.GetVersion(), listener.Addr())
 			stats.RegisterStackDumper()
 			stats.StartStatsTicker(10 * time.Minute)
 			stats.RegisterHeapDumper("memprofile")
@@ -73,12 +67,8 @@ func newCommand() *cobra.Command {
 
 	command.Flags().StringVar(&logLevel, "loglevel", "info", "Set the logging level. One of: debug|info|warn|error")
 	command.Flags().Int64Var(&parallelismLimit, "parallelismlimit", 0, "Limit on number of concurrent manifests generate requests. Any value less the 1 means no limit.")
-	command.Flags().IntVar(&listenPort, "port", common.DefaultPortRepoServer, "Listen on given port for incoming connections")
-	command.Flags().IntVar(&metricsPort, "metrics-port", common.DefaultPortRepoServerMetrics, "Start metrics server on given port")
 	tlsConfigCustomizerSrc = tls.AddTLSFlagsToCmd(&command)
-	cacheSrc = reposervercache.AddCacheFlagsToCmd(&command, func(client *redis.Client) {
-		redisClient = client
-	})
+	cacheSrc = cache.AddCacheFlagsToCmd(&command)
 	return &command
 }
 

cmd/argocd-server/commands/root.go

@@ -4,44 +4,35 @@ import (
 	"context"
 	"time"
 
-	"github.com/argoproj/pkg/stats"
-	"github.com/go-redis/redis"
 	"github.com/spf13/cobra"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/tools/clientcmd"
 
 	"github.com/argoproj/argo-cd/common"
 	"github.com/argoproj/argo-cd/errors"
-	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
 	appclientset "github.com/argoproj/argo-cd/pkg/client/clientset/versioned"
-	"github.com/argoproj/argo-cd/reposerver/apiclient"
+	"github.com/argoproj/argo-cd/reposerver"
 	"github.com/argoproj/argo-cd/server"
-	servercache "github.com/argoproj/argo-cd/server/cache"
+	"github.com/argoproj/argo-cd/util/cache"
 	"github.com/argoproj/argo-cd/util/cli"
+	"github.com/argoproj/argo-cd/util/stats"
 	"github.com/argoproj/argo-cd/util/tls"
-	log "github.com/sirupsen/logrus"
 )
 
 // NewCommand returns a new instance of an argocd command
 func NewCommand() *cobra.Command {
 	var (
-		redisClient              *redis.Client
-		insecure                 bool
-		listenPort               int
-		metricsPort              int
-		logLevel                 string
-		glogLevel                int
-		clientConfig             clientcmd.ClientConfig
-		repoServerTimeoutSeconds int
-		staticAssetsDir          string
-		baseHRef                 string
-		rootPath                 string
-		repoServerAddress        string
-		dexServerAddress         string
-		disableAuth              bool
-		tlsConfigCustomizerSrc   func() (tls.ConfigCustomizer, error)
-		cacheSrc                 func() (*servercache.Cache, error)
-		frameOptions             string
+		insecure               bool
+		logLevel               string
+		glogLevel              int
+		clientConfig           clientcmd.ClientConfig
+		staticAssetsDir        string
+		baseHRef               string
+		repoServerAddress      string
+		dexServerAddress       string
+		disableAuth            bool
+		tlsConfigCustomizerSrc func() (tls.ConfigCustomizer, error)
+		cacheSrc               func() (*cache.Cache, error)
 	)
 	var command = &cobra.Command{
 		Use:   cliName,
@@ -53,7 +44,8 @@ func NewCommand() *cobra.Command {
 
 			config, err := clientConfig.ClientConfig()
 			errors.CheckError(err)
-			errors.CheckError(v1alpha1.SetK8SConfigDefaults(config))
+			config.QPS = common.K8sClientConfigQPS
+			config.Burst = common.K8sClientConfigBurst
 
 			namespace, _, err := clientConfig.Namespace()
 			errors.CheckError(err)
@@ -65,23 +57,13 @@ func NewCommand() *cobra.Command {
 
 			kubeclientset := kubernetes.NewForConfigOrDie(config)
 			appclientset := appclientset.NewForConfigOrDie(config)
-			repoclientset := apiclient.NewRepoServerClientset(repoServerAddress, repoServerTimeoutSeconds)
-
-			if rootPath != "" {
-				if baseHRef != "" && baseHRef != rootPath {
-					log.Warnf("--basehref and --rootpath had conflict: basehref: %s rootpath: %s", baseHRef, rootPath)
-				}
-				baseHRef = rootPath
-			}
+			repoclientset := reposerver.NewRepoServerClientset(repoServerAddress, 0)
 
 			argoCDOpts := server.ArgoCDServerOpts{
 				Insecure:            insecure,
-				ListenPort:          listenPort,
-				MetricsPort:         metricsPort,
 				Namespace:           namespace,
 				StaticAssetsDir:     staticAssetsDir,
 				BaseHRef:            baseHRef,
-				RootPath:            rootPath,
 				KubeClientset:       kubeclientset,
 				AppClientset:        appclientset,
 				RepoClientset:       repoclientset,
@@ -89,8 +71,6 @@ func NewCommand() *cobra.Command {
 				DisableAuth:         disableAuth,
 				TLSConfigCustomizer: tlsConfigCustomizer,
 				Cache:               cache,
-				XFrameOptions:       frameOptions,
-				RedisClient:         redisClient,
 			}
 
 			stats.RegisterStackDumper()
@@ -101,7 +81,7 @@ func NewCommand() *cobra.Command {
 				ctx := context.Background()
 				ctx, cancel := context.WithCancel(ctx)
 				argocd := server.NewServer(ctx, argoCDOpts)
-				argocd.Run(ctx, listenPort, metricsPort)
+				argocd.Run(ctx, common.PortAPIServer)
 				cancel()
 			}
 		},
@@ -111,20 +91,13 @@ func NewCommand() *cobra.Command {
 	command.Flags().BoolVar(&insecure, "insecure", false, "Run server without TLS")
 	command.Flags().StringVar(&staticAssetsDir, "staticassets", "", "Static assets directory path")
 	command.Flags().StringVar(&baseHRef, "basehref", "/", "Value for base href in index.html. Used if Argo CD is running behind reverse proxy under subpath different from /")
-	command.Flags().StringVar(&rootPath, "rootpath", "", "Used if Argo CD is running behind reverse proxy under subpath different from /")
 	command.Flags().StringVar(&logLevel, "loglevel", "info", "Set the logging level. One of: debug|info|warn|error")
 	command.Flags().IntVar(&glogLevel, "gloglevel", 0, "Set the glog logging level")
 	command.Flags().StringVar(&repoServerAddress, "repo-server", common.DefaultRepoServerAddr, "Repo server address")
 	command.Flags().StringVar(&dexServerAddress, "dex-server", common.DefaultDexServerAddr, "Dex server address")
 	command.Flags().BoolVar(&disableAuth, "disable-auth", false, "Disable client authentication")
 	command.AddCommand(cli.NewVersionCmd(cliName))
-	command.Flags().IntVar(&listenPort, "port", common.DefaultPortAPIServer, "Listen on given port")
-	command.Flags().IntVar(&metricsPort, "metrics-port", common.DefaultPortArgoCDAPIServerMetrics, "Start metrics on given port")
-	command.Flags().IntVar(&repoServerTimeoutSeconds, "repo-server-timeout-seconds", 60, "Repo server RPC call timeout seconds.")
-	command.Flags().StringVar(&frameOptions, "x-frame-options", "sameorigin", "Set X-Frame-Options header in HTTP responses to `value`. To disable, set to \"\".")
 	tlsConfigCustomizerSrc = tls.AddTLSFlagsToCmd(command)
-	cacheSrc = servercache.AddCacheFlagsToCmd(command, func(client *redis.Client) {
-		redisClient = client
-	})
+	cacheSrc = cache.AddCacheFlagsToCmd(command)
 	return command
 }

cmd/argocd-util/commands/projects.go

@@ -1,192 +0,0 @@
-package commands
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/argoproj/argo-cd/errors"
-	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	appclientset "github.com/argoproj/argo-cd/pkg/client/clientset/versioned"
-	appclient "github.com/argoproj/argo-cd/pkg/client/clientset/versioned/typed/application/v1alpha1"
-	"github.com/argoproj/argo-cd/util/cli"
-	"github.com/argoproj/argo-cd/util/diff"
-	"github.com/argoproj/argo-cd/util/kube"
-
-	"github.com/spf13/cobra"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/client-go/tools/clientcmd"
-)
-
-func NewProjectsCommand() *cobra.Command {
-	var command = &cobra.Command{
-		Use: "projects",
-		Run: func(c *cobra.Command, args []string) {
-			c.HelpFunc()(c, args)
-		},
-	}
-
-	command.AddCommand(NewUpdatePolicyRuleCommand())
-	return command
-}
-
-func globMatch(pattern string, val string) bool {
-	if pattern == "*" {
-		return true
-	}
-	if ok, err := filepath.Match(pattern, val); ok && err == nil {
-		return true
-	}
-	return false
-}
-
-func getModification(modification string, resource string, scope string, permission string) (func(string, string) string, error) {
-	switch modification {
-	case "set":
-		if scope == "" {
-			return nil, fmt.Errorf("Flag --group cannot be empty if permission should be set in role")
-		}
-		if permission == "" {
-			return nil, fmt.Errorf("Flag --permission cannot be empty if permission should be set in role")
-		}
-		return func(proj string, action string) string {
-			return fmt.Sprintf("%s, %s, %s/%s, %s", resource, action, proj, scope, permission)
-		}, nil
-	case "remove":
-		return func(proj string, action string) string {
-			return ""
-		}, nil
-	}
-	return nil, fmt.Errorf("modification %s is not supported", modification)
-}
-
-func saveProject(updated v1alpha1.AppProject, orig v1alpha1.AppProject, projectsIf appclient.AppProjectInterface, dryRun bool) error {
-	fmt.Printf("===== %s ======\n", updated.Name)
-	target, err := kube.ToUnstructured(&updated)
-	errors.CheckError(err)
-	live, err := kube.ToUnstructured(&orig)
-	if err != nil {
-		return err
-	}
-	_ = diff.PrintDiff(updated.Name, target, live)
-	if !dryRun {
-		_, err = projectsIf.Update(&updated)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func formatPolicy(proj string, role string, permission string) string {
-	return fmt.Sprintf("p, proj:%s:%s, %s", proj, role, permission)
-}
-
-func split(input string, delimiter string) []string {
-	parts := strings.Split(input, delimiter)
-	for i := range parts {
-		parts[i] = strings.TrimSpace(parts[i])
-	}
-	return parts
-}
-
-func NewUpdatePolicyRuleCommand() *cobra.Command {
-	var (
-		clientConfig clientcmd.ClientConfig
-		resource     string
-		scope        string
-		rolePattern  string
-		permission   string
-		dryRun       bool
-	)
-	var command = &cobra.Command{
-		Use:   "update-role-policy PROJECT_GLOB MODIFICATION ACTION",
-		Short: "Implement bulk project role update. Useful to back-fill existing project policies or remove obsolete actions.",
-		Example: `  # Add policy that allows executing any action (action/*) to roles which name matches to *deployer* in all projects  
-  argocd-util projects update-role-policy '*' set 'action/*' --role '*deployer*' --resource applications --scope '*' --permission allow
-
-  # Remove policy that which manages running (action/*) from all roles which name matches *deployer* in all projects
-  argocd-util projects update-role-policy '*' remove override --role '*deployer*'
-`,
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) != 3 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-			projectGlob := args[0]
-			modificationType := args[1]
-			action := args[2]
-
-			config, err := clientConfig.ClientConfig()
-			errors.CheckError(err)
-			config.QPS = 100
-			config.Burst = 50
-
-			namespace, _, err := clientConfig.Namespace()
-			errors.CheckError(err)
-			appclients := appclientset.NewForConfigOrDie(config)
-
-			modification, err := getModification(modificationType, resource, scope, permission)
-			errors.CheckError(err)
-			projIf := appclients.ArgoprojV1alpha1().AppProjects(namespace)
-
-			err = updateProjects(projIf, projectGlob, rolePattern, action, modification, dryRun)
-			errors.CheckError(err)
-		},
-	}
-	command.Flags().StringVar(&resource, "resource", "", "Resource e.g. 'applications'")
-	command.Flags().StringVar(&scope, "scope", "", "Resource scope e.g. '*'")
-	command.Flags().StringVar(&rolePattern, "role", "*", "Role name pattern e.g. '*deployer*'")
-	command.Flags().StringVar(&permission, "permission", "", "Action permission")
-	command.Flags().BoolVar(&dryRun, "dry-run", true, "Dry run")
-	clientConfig = cli.AddKubectlFlagsToCmd(command)
-	return command
-}
-
-func updateProjects(projIf appclient.AppProjectInterface, projectGlob string, rolePattern string, action string, modification func(string, string) string, dryRun bool) error {
-	projects, err := projIf.List(v1.ListOptions{})
-	if err != nil {
-		return err
-	}
-	for _, proj := range projects.Items {
-		if !globMatch(projectGlob, proj.Name) {
-			continue
-		}
-		origProj := proj.DeepCopy()
-		updated := false
-		for i, role := range proj.Spec.Roles {
-			if !globMatch(rolePattern, role.Name) {
-				continue
-			}
-			actionPolicyIndex := -1
-			for i := range role.Policies {
-				parts := split(role.Policies[i], ",")
-				if len(parts) != 6 || parts[3] != action {
-					continue
-				}
-				actionPolicyIndex = i
-				break
-			}
-			policyPermission := modification(proj.Name, action)
-			if actionPolicyIndex == -1 && policyPermission != "" {
-				updated = true
-				role.Policies = append(role.Policies, formatPolicy(proj.Name, role.Name, policyPermission))
-			} else if actionPolicyIndex > -1 && policyPermission == "" {
-				updated = true
-				role.Policies = append(role.Policies[:actionPolicyIndex], role.Policies[actionPolicyIndex+1:]...)
-			} else if actionPolicyIndex > -1 && policyPermission != "" {
-				updated = true
-				role.Policies[actionPolicyIndex] = formatPolicy(proj.Name, role.Name, policyPermission)
-			}
-			proj.Spec.Roles[i] = role
-		}
-		if updated {
-			err = saveProject(proj, *origProj, projIf, dryRun)
-			if err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}

cmd/argocd-util/commands/projects_test.go

@@ -1,78 +0,0 @@
-package commands
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	"github.com/argoproj/argo-cd/pkg/client/clientset/versioned/fake"
-)
-
-const (
-	namespace = "default"
-)
-
-func newProj(name string, roleNames ...string) *v1alpha1.AppProject {
-	var roles []v1alpha1.ProjectRole
-	for i := range roleNames {
-		roles = append(roles, v1alpha1.ProjectRole{Name: roleNames[i]})
-	}
-	return &v1alpha1.AppProject{ObjectMeta: v1.ObjectMeta{
-		Name:      name,
-		Namespace: namespace,
-	}, Spec: v1alpha1.AppProjectSpec{
-		Roles: roles,
-	}}
-}
-
-func TestUpdateProjects_FindMatchingProject(t *testing.T) {
-	clientset := fake.NewSimpleClientset(newProj("foo", "test"), newProj("bar", "test"))
-
-	modification, err := getModification("set", "*", "*", "allow")
-	assert.NoError(t, err)
-	err = updateProjects(clientset.ArgoprojV1alpha1().AppProjects(namespace), "ba*", "*", "set", modification, false)
-	assert.NoError(t, err)
-
-	fooProj, err := clientset.ArgoprojV1alpha1().AppProjects(namespace).Get("foo", v1.GetOptions{})
-	assert.NoError(t, err)
-	assert.Len(t, fooProj.Spec.Roles[0].Policies, 0)
-
-	barProj, err := clientset.ArgoprojV1alpha1().AppProjects(namespace).Get("bar", v1.GetOptions{})
-	assert.NoError(t, err)
-	assert.EqualValues(t, barProj.Spec.Roles[0].Policies, []string{"p, proj:bar:test, *, set, bar/*, allow"})
-}
-
-func TestUpdateProjects_FindMatchingRole(t *testing.T) {
-	clientset := fake.NewSimpleClientset(newProj("proj", "foo", "bar"))
-
-	modification, err := getModification("set", "*", "*", "allow")
-	assert.NoError(t, err)
-	err = updateProjects(clientset.ArgoprojV1alpha1().AppProjects(namespace), "*", "fo*", "set", modification, false)
-	assert.NoError(t, err)
-
-	proj, err := clientset.ArgoprojV1alpha1().AppProjects(namespace).Get("proj", v1.GetOptions{})
-	assert.NoError(t, err)
-	assert.EqualValues(t, proj.Spec.Roles[0].Policies, []string{"p, proj:proj:foo, *, set, proj/*, allow"})
-	assert.Len(t, proj.Spec.Roles[1].Policies, 0)
-}
-
-func TestGetModification_SetPolicy(t *testing.T) {
-	modification, err := getModification("set", "*", "*", "allow")
-	assert.NoError(t, err)
-	policy := modification("proj", "myaction")
-	assert.Equal(t, "*, myaction, proj/*, allow", policy)
-}
-
-func TestGetModification_RemovePolicy(t *testing.T) {
-	modification, err := getModification("remove", "*", "*", "allow")
-	assert.NoError(t, err)
-	policy := modification("proj", "myaction")
-	assert.Equal(t, "", policy)
-}
-
-func TestGetModification_NotSupported(t *testing.T) {
-	_, err := getModification("bar", "*", "*", "allow")
-	assert.Errorf(t, err, "modification bar is not supported")
-}

cmd/argocd-util/commands/settings.go

@@ -1,501 +0,0 @@
-package commands
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"reflect"
-	"sort"
-	"strings"
-
-	"k8s.io/client-go/kubernetes/fake"
-
-	"github.com/ghodss/yaml"
-	log "github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-	corev1 "k8s.io/api/core/v1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/client-go/kubernetes"
-	"k8s.io/client-go/tools/clientcmd"
-
-	"github.com/argoproj/argo-cd/common"
-	"github.com/argoproj/argo-cd/errors"
-	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	"github.com/argoproj/argo-cd/util/argo/normalizers"
-	"github.com/argoproj/argo-cd/util/cli"
-	"github.com/argoproj/argo-cd/util/diff"
-	"github.com/argoproj/argo-cd/util/health"
-	"github.com/argoproj/argo-cd/util/lua"
-	"github.com/argoproj/argo-cd/util/settings"
-)
-
-type settingsOpts struct {
-	argocdCMPath        string
-	argocdSecretPath    string
-	loadClusterSettings bool
-	clientConfig        clientcmd.ClientConfig
-}
-
-type commandContext interface {
-	createSettingsManager() (*settings.SettingsManager, error)
-}
-
-func collectLogs(callback func()) string {
-	log.SetLevel(log.DebugLevel)
-	out := bytes.Buffer{}
-	log.SetOutput(&out)
-	defer log.SetLevel(log.FatalLevel)
-	callback()
-	return out.String()
-}
-
-func setSettingsMeta(obj v1.Object) {
-	obj.SetNamespace("default")
-	labels := obj.GetLabels()
-	if labels == nil {
-		labels = make(map[string]string)
-	}
-	labels["app.kubernetes.io/part-of"] = "argocd"
-	obj.SetLabels(labels)
-}
-
-func (opts *settingsOpts) createSettingsManager() (*settings.SettingsManager, error) {
-	var argocdCM *corev1.ConfigMap
-	if opts.argocdCMPath == "" && !opts.loadClusterSettings {
-		return nil, fmt.Errorf("either --argocd-cm-path must be provided or --load-cluster-settings must be set to true")
-	} else if opts.argocdCMPath == "" {
-		realClientset, ns, err := opts.getK8sClient()
-		if err != nil {
-			return nil, err
-		}
-
-		argocdCM, err = realClientset.CoreV1().ConfigMaps(ns).Get(common.ArgoCDConfigMapName, v1.GetOptions{})
-		if err != nil {
-			return nil, err
-		}
-	} else {
-		data, err := ioutil.ReadFile(opts.argocdCMPath)
-		if err != nil {
-			return nil, err
-		}
-		err = yaml.Unmarshal(data, &argocdCM)
-		if err != nil {
-			return nil, err
-		}
-	}
-	setSettingsMeta(argocdCM)
-
-	var argocdSecret *corev1.Secret
-	if opts.argocdSecretPath != "" {
-		data, err := ioutil.ReadFile(opts.argocdSecretPath)
-		if err != nil {
-			return nil, err
-		}
-		err = yaml.Unmarshal(data, &argocdSecret)
-		if err != nil {
-			return nil, err
-		}
-		setSettingsMeta(argocdSecret)
-	} else if opts.loadClusterSettings {
-		realClientset, ns, err := opts.getK8sClient()
-		if err != nil {
-			return nil, err
-		}
-		argocdSecret, err = realClientset.CoreV1().Secrets(ns).Get(common.ArgoCDSecretName, v1.GetOptions{})
-		if err != nil {
-			return nil, err
-		}
-	} else {
-		argocdSecret = &corev1.Secret{
-			ObjectMeta: v1.ObjectMeta{
-				Name: common.ArgoCDSecretName,
-			},
-			Data: map[string][]byte{
-				"admin.password":   []byte("test"),
-				"server.secretkey": []byte("test"),
-			},
-		}
-	}
-	setSettingsMeta(argocdSecret)
-	clientset := fake.NewSimpleClientset(argocdSecret, argocdCM)
-
-	manager := settings.NewSettingsManager(context.Background(), clientset, "default")
-	errors.CheckError(manager.ResyncInformers())
-
-	return manager, nil
-}
-
-func (opts *settingsOpts) getK8sClient() (*kubernetes.Clientset, string, error) {
-	namespace, _, err := opts.clientConfig.Namespace()
-	if err != nil {
-		return nil, "", err
-	}
-
-	restConfig, err := opts.clientConfig.ClientConfig()
-	if err != nil {
-		return nil, "", err
-	}
-
-	realClientset, err := kubernetes.NewForConfig(restConfig)
-	if err != nil {
-		return nil, "", err
-	}
-	return realClientset, namespace, nil
-}
-
-func NewSettingsCommand() *cobra.Command {
-	var (
-		opts settingsOpts
-	)
-
-	var command = &cobra.Command{
-		Use:   "settings",
-		Short: "Provides set of commands for settings validation and troubleshooting",
-		Run: func(c *cobra.Command, args []string) {
-			c.HelpFunc()(c, args)
-		},
-	}
-	log.SetLevel(log.FatalLevel)
-
-	command.AddCommand(NewValidateSettingsCommand(&opts))
-	command.AddCommand(NewResourceOverridesCommand(&opts))
-
-	opts.clientConfig = cli.AddKubectlFlagsToCmd(command)
-	command.PersistentFlags().StringVar(&opts.argocdCMPath, "argocd-cm-path", "", "Path to local argocd-cm.yaml file")
-	command.PersistentFlags().StringVar(&opts.argocdSecretPath, "argocd-secret-path", "", "Path to local argocd-secret.yaml file")
-	command.PersistentFlags().BoolVar(&opts.loadClusterSettings, "load-cluster-settings", false,
-		"Indicates that config map and secret should be loaded from cluster unless local file path is provided")
-	return command
-}
-
-type settingValidator func(manager *settings.SettingsManager) (string, error)
-
-func joinValidators(validators ...settingValidator) settingValidator {
-	return func(manager *settings.SettingsManager) (string, error) {
-		var errorStrs []string
-		var summaries []string
-		for i := range validators {
-			summary, err := validators[i](manager)
-			if err != nil {
-				errorStrs = append(errorStrs, err.Error())
-			}
-			if summary != "" {
-				summaries = append(summaries, summary)
-			}
-		}
-		if len(errorStrs) > 0 {
-			return "", fmt.Errorf("%s", strings.Join(errorStrs, "\n"))
-		}
-		return strings.Join(summaries, "\n"), nil
-	}
-}
-
-var validatorsByGroup = map[string]settingValidator{
-	"general": joinValidators(func(manager *settings.SettingsManager) (string, error) {
-		general, err := manager.GetSettings()
-		if err != nil {
-			return "", err
-		}
-		ssoProvider := ""
-		if general.DexConfig != "" {
-			if _, err := settings.UnmarshalDexConfig(general.DexConfig); err != nil {
-				return "", fmt.Errorf("invalid dex.config: %v", err)
-			}
-			ssoProvider = "Dex"
-		} else if general.OIDCConfigRAW != "" {
-			if _, err := settings.UnmarshalOIDCConfig(general.OIDCConfigRAW); err != nil {
-				return "", fmt.Errorf("invalid oidc.config: %v", err)
-			}
-			ssoProvider = "OIDC"
-		}
-		var summary string
-		if ssoProvider != "" {
-			summary = fmt.Sprintf("%s is configured", ssoProvider)
-			if general.URL == "" {
-				summary = summary + " ('url' field is missing)"
-			}
-		} else if ssoProvider != "" && general.URL != "" {
-
-		} else {
-			summary = "SSO is not configured"
-		}
-		return summary, nil
-	}, func(manager *settings.SettingsManager) (string, error) {
-		_, err := manager.GetAppInstanceLabelKey()
-		return "", err
-	}, func(manager *settings.SettingsManager) (string, error) {
-		_, err := manager.GetHelp()
-		return "", err
-	}, func(manager *settings.SettingsManager) (string, error) {
-		_, err := manager.GetGoogleAnalytics()
-		return "", err
-	}),
-	"plugins": func(manager *settings.SettingsManager) (string, error) {
-		plugins, err := manager.GetConfigManagementPlugins()
-		if err != nil {
-			return "", err
-		}
-		return fmt.Sprintf("%d plugins", len(plugins)), nil
-	},
-	"kustomize": func(manager *settings.SettingsManager) (string, error) {
-		opts, err := manager.GetKustomizeSettings()
-		if err != nil {
-			return "", err
-		}
-		summary := "default options"
-		if opts.BuildOptions != "" {
-			summary = opts.BuildOptions
-		}
-		if len(opts.Versions) > 0 {
-			summary = fmt.Sprintf("%s (%d versions)", summary, len(opts.Versions))
-		}
-		return summary, err
-	},
-	"repositories": joinValidators(func(manager *settings.SettingsManager) (string, error) {
-		repos, err := manager.GetRepositories()
-		if err != nil {
-			return "", err
-		}
-		return fmt.Sprintf("%d repositories", len(repos)), nil
-	}, func(manager *settings.SettingsManager) (string, error) {
-		creds, err := manager.GetRepositoryCredentials()
-		if err != nil {
-			return "", err
-		}
-		return fmt.Sprintf("%d repository credentials", len(creds)), nil
-	}),
-	"accounts": func(manager *settings.SettingsManager) (string, error) {
-		accounts, err := manager.GetAccounts()
-		if err != nil {
-			return "", err
-		}
-		return fmt.Sprintf("%d accounts", len(accounts)), nil
-	},
-	"resource-overrides": func(manager *settings.SettingsManager) (string, error) {
-		overrides, err := manager.GetResourceOverrides()
-		if err != nil {
-			return "", err
-		}
-		return fmt.Sprintf("%d resource overrides", len(overrides)), nil
-	},
-}
-
-func NewValidateSettingsCommand(cmdCtx commandContext) *cobra.Command {
-	var (
-		groups []string
-	)
-
-	var allGroups []string
-	for k := range validatorsByGroup {
-		allGroups = append(allGroups, k)
-	}
-	sort.Slice(allGroups, func(i, j int) bool {
-		return allGroups[i] < allGroups[j]
-	})
-
-	var command = &cobra.Command{
-		Use:   "validate",
-		Short: "Validate settings",
-		Long:  "Validates settings specified in 'argocd-cm' ConfigMap and 'argocd-secret' Secret",
-		Example: `
-#Validates all settings in the specified YAML file
-argocd-util settings validate --argocd-cm-path ./argocd-cm.yaml
-
-#Validates accounts and plugins settings in Kubernetes cluster of current kubeconfig context
-argocd-util settings validate --group accounts --group plugins --load-cluster-settings`,
-		Run: func(c *cobra.Command, args []string) {
-			settingsManager, err := cmdCtx.createSettingsManager()
-			errors.CheckError(err)
-
-			if len(groups) == 0 {
-				groups = allGroups
-			}
-			for i, group := range groups {
-				validator := validatorsByGroup[group]
-
-				logs := collectLogs(func() {
-					summary, err := validator(settingsManager)
-
-					if err != nil {
-						_, _ = fmt.Fprintf(os.Stdout, "❌ %s\n", group)
-						_, _ = fmt.Fprintf(os.Stdout, "%s\n", err.Error())
-					} else {
-						_, _ = fmt.Fprintf(os.Stdout, "✅ %s\n", group)
-						if summary != "" {
-							_, _ = fmt.Fprintf(os.Stdout, "%s\n", summary)
-						}
-					}
-				})
-				if logs != "" {
-					_, _ = fmt.Fprintf(os.Stdout, "%s\n", logs)
-				}
-				if i != len(groups)-1 {
-					_, _ = fmt.Fprintf(os.Stdout, "\n")
-				}
-			}
-		},
-	}
-
-	command.Flags().StringArrayVar(&groups, "group", nil, fmt.Sprintf(
-		"Optional list of setting groups that have to be validated ( one of: %s)", strings.Join(allGroups, ", ")))
-
-	return command
-}
-
-func NewResourceOverridesCommand(cmdCtx commandContext) *cobra.Command {
-	var command = &cobra.Command{
-		Use:   "resource-overrides",
-		Short: "Troubleshoot resource overrides",
-		Run: func(c *cobra.Command, args []string) {
-			c.HelpFunc()(c, args)
-		},
-	}
-	command.AddCommand(NewResourceIgnoreDifferencesCommand(cmdCtx))
-	command.AddCommand(NewResourceActionCommand(cmdCtx))
-	command.AddCommand(NewResourceHealthCommand(cmdCtx))
-	return command
-}
-
-func executeResourceOverrideCommand(cmdCtx commandContext, args []string, callback func(res unstructured.Unstructured, override v1alpha1.ResourceOverride, overrides map[string]v1alpha1.ResourceOverride)) {
-	data, err := ioutil.ReadFile(args[0])
-	errors.CheckError(err)
-
-	res := unstructured.Unstructured{}
-	errors.CheckError(yaml.Unmarshal(data, &res))
-
-	settingsManager, err := cmdCtx.createSettingsManager()
-	errors.CheckError(err)
-
-	overrides, err := settingsManager.GetResourceOverrides()
-	errors.CheckError(err)
-	gvk := res.GroupVersionKind()
-	key := gvk.Kind
-	if gvk.Group != "" {
-		key = fmt.Sprintf("%s/%s", gvk.Group, gvk.Kind)
-	}
-	override, hasOverride := overrides[key]
-	if !hasOverride {
-		_, _ = fmt.Printf("No overrides configured for '%s/%s'\n", gvk.Group, gvk.Kind)
-		return
-	}
-	callback(res, override, overrides)
-}
-
-func NewResourceIgnoreDifferencesCommand(cmdCtx commandContext) *cobra.Command {
-	var command = &cobra.Command{
-		Use:   "ignore-differences RESOURCE_YAML_PATH",
-		Short: "Renders fields excluded from diffing",
-		Long:  "Renders ignored fields using the 'ignoreDifferences' setting specified in the 'resource.customizations' field of 'argocd-cm' ConfigMap",
-		Example: `
-argocd-util settings resource-overrides ignore-differences ./deploy.yaml --argocd-cm-path ./argocd-cm.yaml`,
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) < 1 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-
-			executeResourceOverrideCommand(cmdCtx, args, func(res unstructured.Unstructured, override v1alpha1.ResourceOverride, overrides map[string]v1alpha1.ResourceOverride) {
-				gvk := res.GroupVersionKind()
-				if override.IgnoreDifferences == "" {
-					_, _ = fmt.Printf("Ignore differences are not configured for '%s/%s'\n", gvk.Group, gvk.Kind)
-					return
-				}
-
-				normalizer, err := normalizers.NewIgnoreNormalizer(nil, overrides)
-				errors.CheckError(err)
-
-				normalizedRes := res.DeepCopy()
-				logs := collectLogs(func() {
-					errors.CheckError(normalizer.Normalize(normalizedRes))
-				})
-				if logs != "" {
-					_, _ = fmt.Println(logs)
-				}
-
-				if reflect.DeepEqual(&res, normalizedRes) {
-					_, _ = fmt.Printf("No fields are ignored by ignoreDifferences settings: \n%s\n", override.IgnoreDifferences)
-					return
-				}
-
-				_, _ = fmt.Printf("Following fields are ignored:\n\n")
-				_ = diff.PrintDiff(res.GetName(), &res, normalizedRes)
-			})
-		},
-	}
-	return command
-}
-
-func NewResourceHealthCommand(cmdCtx commandContext) *cobra.Command {
-	var command = &cobra.Command{
-		Use:   "health RESOURCE_YAML_PATH",
-		Short: "Assess resource health",
-		Long:  "Assess resource health using the lua script configured in the 'resource.customizations' field of 'argocd-cm' ConfigMap",
-		Example: `
-argocd-util settings resource-overrides health ./deploy.yaml --argocd-cm-path ./argocd-cm.yaml`,
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) < 1 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-
-			executeResourceOverrideCommand(cmdCtx, args, func(res unstructured.Unstructured, override v1alpha1.ResourceOverride, overrides map[string]v1alpha1.ResourceOverride) {
-				gvk := res.GroupVersionKind()
-				if override.HealthLua == "" {
-					_, _ = fmt.Printf("Health script is not configured for '%s/%s'\n", gvk.Group, gvk.Kind)
-					return
-				}
-
-				resHealth, err := health.GetResourceHealth(&res, overrides)
-				errors.CheckError(err)
-
-				_, _ = fmt.Printf("STATUS: %s\n", resHealth.Status)
-				_, _ = fmt.Printf("MESSAGE: %s\n", resHealth.Message)
-			})
-		},
-	}
-	return command
-}
-
-func NewResourceActionCommand(cmdCtx commandContext) *cobra.Command {
-	var command = &cobra.Command{
-		Use:   "action RESOURCE_YAML_PATH ACTION",
-		Short: "Executes resource action",
-		Long:  "Executes resource action using the lua script configured in the 'resource.customizations' field of 'argocd-cm' ConfigMap and outputs updated fields",
-		Example: `
-argocd-util settings resource-overrides action /tmp/deploy.yaml restart --argocd-cm-path ./argocd-cm.yaml`,
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) < 2 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-			action := args[1]
-
-			executeResourceOverrideCommand(cmdCtx, args, func(res unstructured.Unstructured, override v1alpha1.ResourceOverride, overrides map[string]v1alpha1.ResourceOverride) {
-				gvk := res.GroupVersionKind()
-				if override.Actions == "" {
-					_, _ = fmt.Printf("Actions are not configured for '%s/%s'\n", gvk.Group, gvk.Kind)
-					return
-				}
-
-				luaVM := lua.VM{ResourceOverrides: overrides}
-				action, err := luaVM.GetResourceAction(&res, action)
-				errors.CheckError(err)
-
-				modifiedRes, err := luaVM.ExecuteResourceAction(&res, action.ActionLua)
-				errors.CheckError(err)
-
-				if reflect.DeepEqual(&res, modifiedRes) {
-					_, _ = fmt.Printf("No fields had been changed by action: \n%s\n", action.Name)
-					return
-				}
-
-				_, _ = fmt.Printf("Following fields have been changed:\n\n")
-				_ = diff.PrintDiff(res.GetName(), &res, modifiedRes)
-			})
-		},
-	}
-	return command
-}

cmd/argocd-util/commands/settings_test.go

@@ -1,367 +0,0 @@
-package commands
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"os"
-	"testing"
-
-	"github.com/argoproj/argo-cd/common"
-	"github.com/argoproj/argo-cd/util"
-	"github.com/argoproj/argo-cd/util/settings"
-
-	"github.com/stretchr/testify/assert"
-	v1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/client-go/kubernetes/fake"
-)
-
-func captureStdout(callback func()) (string, error) {
-	oldStdout := os.Stdout
-	oldStderr := os.Stderr
-	r, w, err := os.Pipe()
-	if err != nil {
-		return "", err
-	}
-	os.Stdout = w
-	defer func() {
-		os.Stdout = oldStdout
-		os.Stderr = oldStderr
-	}()
-
-	callback()
-	util.Close(w)
-
-	data, err := ioutil.ReadAll(r)
-
-	if err != nil {
-		return "", err
-	}
-	return string(data), err
-}
-
-func newSettingsManager(data map[string]string) *settings.SettingsManager {
-	clientset := fake.NewSimpleClientset(&v1.ConfigMap{
-		ObjectMeta: metav1.ObjectMeta{
-			Namespace: "default",
-			Name:      common.ArgoCDConfigMapName,
-			Labels: map[string]string{
-				"app.kubernetes.io/part-of": "argocd",
-			},
-		},
-		Data: data,
-	}, &v1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Namespace: "default",
-			Name:      common.ArgoCDSecretName,
-		},
-		Data: map[string][]byte{
-			"admin.password":   []byte("test"),
-			"server.secretkey": []byte("test"),
-		},
-	})
-	return settings.NewSettingsManager(context.Background(), clientset, "default")
-}
-
-type fakeCmdContext struct {
-	mgr *settings.SettingsManager
-	// nolint:unused,structcheck
-	out bytes.Buffer
-}
-
-func newCmdContext(data map[string]string) *fakeCmdContext {
-	return &fakeCmdContext{mgr: newSettingsManager(data)}
-}
-
-func (ctx *fakeCmdContext) createSettingsManager() (*settings.SettingsManager, error) {
-	return ctx.mgr, nil
-}
-
-type validatorTestCase struct {
-	validator       string
-	data            map[string]string
-	containsSummary string
-	containsError   string
-}
-
-func TestCreateSettingsManager(t *testing.T) {
-	f, closer, err := tempFile(`apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-cm
-data:
-  url: https://myargocd.com`)
-	if !assert.NoError(t, err) {
-		return
-	}
-	defer util.Close(closer)
-
-	opts := settingsOpts{argocdCMPath: f}
-	settingsManager, err := opts.createSettingsManager()
-
-	if !assert.NoError(t, err) {
-		return
-	}
-
-	argoCDSettings, err := settingsManager.GetSettings()
-	if !assert.NoError(t, err) {
-		return
-	}
-
-	assert.Equal(t, "https://myargocd.com", argoCDSettings.URL)
-}
-
-func TestValidator(t *testing.T) {
-	testCases := map[string]validatorTestCase{
-		"General_SSOIsNotConfigured": {
-			validator: "general", containsSummary: "SSO is not configured",
-		},
-		"General_DexInvalidConfig": {
-			validator:     "general",
-			data:          map[string]string{"dex.config": "abcdefg"},
-			containsError: "invalid dex.config",
-		},
-		"General_OIDCConfigured": {
-			validator: "general",
-			data: map[string]string{
-				"url": "https://myargocd.com",
-				"oidc.config": `
-name: Okta
-issuer: https://dev-123456.oktapreview.com
-clientID: aaaabbbbccccddddeee
-clientSecret: aaaabbbbccccddddeee`,
-			},
-			containsSummary: "OIDC is configured",
-		},
-		"General_DexConfiguredMissingURL": {
-			validator: "general",
-			data: map[string]string{
-				"dex.config": `connectors:
-- type: github
-  name: GitHub
-  config:
-    clientID: aabbccddeeff00112233
-    clientSecret: aabbccddeeff00112233`,
-			},
-			containsSummary: "Dex is configured ('url' field is missing)",
-		},
-		"Plugins_ValidConfig": {
-			validator: "plugins",
-			data: map[string]string{
-				"configManagementPlugins": `[{"name": "test1"}, {"name": "test2"}]`,
-			},
-			containsSummary: "2 plugins",
-		},
-		"Kustomize_ModifiedOptions": {
-			validator:       "kustomize",
-			containsSummary: "default options",
-		},
-		"Kustomize_DefaultOptions": {
-			validator: "kustomize",
-			data: map[string]string{
-				"kustomize.buildOptions":  "updated-options (2 versions)",
-				"kustomize.versions.v123": "binary-123",
-				"kustomize.versions.v321": "binary-321",
-			},
-			containsSummary: "updated-options",
-		},
-		"Repositories": {
-			validator: "repositories",
-			data: map[string]string{
-				"repositories": `
-- url: https://github.com/argoproj/my-private-repository1
-- url: https://github.com/argoproj/my-private-repository2`,
-			},
-			containsSummary: "2 repositories",
-		},
-		"Accounts": {
-			validator: "accounts",
-			data: map[string]string{
-				"accounts.user1": "apiKey, login",
-				"accounts.user2": "login",
-				"accounts.user3": "apiKey",
-			},
-			containsSummary: "4 accounts",
-		},
-		"ResourceOverrides": {
-			validator: "resource-overrides",
-			data: map[string]string{
-				"resource.customizations": `
-admissionregistration.k8s.io/MutatingWebhookConfiguration:
-  ignoreDifferences: |
-  jsonPointers:
-  - /webhooks/0/clientConfig/caBundle`,
-			},
-			containsSummary: "1 resource overrides",
-		},
-	}
-	for name := range testCases {
-		tc := testCases[name]
-		t.Run(name, func(t *testing.T) {
-			validator, ok := validatorsByGroup[tc.validator]
-			if !assert.True(t, ok) {
-				return
-			}
-			summary, err := validator(newSettingsManager(tc.data))
-			if tc.containsSummary != "" {
-				assert.NoError(t, err)
-				assert.Contains(t, summary, tc.containsSummary)
-			} else if tc.containsError != "" {
-				if assert.Error(t, err) {
-					assert.Contains(t, err.Error(), tc.containsError)
-				}
-			}
-		})
-	}
-}
-
-const (
-	testDeploymentYAML = `apiVersion: v1
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nginx-deployment
-  labels:
-    app: nginx
-spec:
-  replicas: 0`
-)
-
-func tempFile(content string) (string, io.Closer, error) {
-	f, err := ioutil.TempFile("", "*.yaml")
-	if err != nil {
-		return "", nil, err
-	}
-	_, err = f.Write([]byte(content))
-	if err != nil {
-		_ = os.Remove(f.Name())
-		return "", nil, err
-	}
-	return f.Name(), util.NewCloser(func() error {
-		return os.Remove(f.Name())
-	}), nil
-}
-
-func TestValidateSettingsCommand_NoErrors(t *testing.T) {
-	cmd := NewValidateSettingsCommand(newCmdContext(map[string]string{}))
-	out, err := captureStdout(func() {
-		err := cmd.Execute()
-		assert.NoError(t, err)
-	})
-
-	assert.NoError(t, err)
-	for k := range validatorsByGroup {
-		assert.Contains(t, out, fmt.Sprintf("✅ %s", k))
-	}
-}
-
-func TestResourceOverrideIgnoreDifferences(t *testing.T) {
-	f, closer, err := tempFile(testDeploymentYAML)
-	if !assert.NoError(t, err) {
-		return
-	}
-	defer util.Close(closer)
-
-	t.Run("NoOverridesConfigured", func(t *testing.T) {
-		cmd := NewResourceOverridesCommand(newCmdContext(map[string]string{}))
-		out, err := captureStdout(func() {
-			cmd.SetArgs([]string{"ignore-differences", f})
-			err := cmd.Execute()
-			assert.NoError(t, err)
-		})
-		assert.NoError(t, err)
-		assert.Contains(t, out, "No overrides configured")
-	})
-
-	t.Run("DataIgnored", func(t *testing.T) {
-		cmd := NewResourceOverridesCommand(newCmdContext(map[string]string{
-			"resource.customizations": `apps/Deployment:
-  ignoreDifferences: |
-    jsonPointers:
-    - /spec`}))
-		out, err := captureStdout(func() {
-			cmd.SetArgs([]string{"ignore-differences", f})
-			err := cmd.Execute()
-			assert.NoError(t, err)
-		})
-		assert.NoError(t, err)
-		assert.Contains(t, out, "< spec:")
-	})
-}
-
-func TestResourceOverrideHealth(t *testing.T) {
-	f, closer, err := tempFile(testDeploymentYAML)
-	if !assert.NoError(t, err) {
-		return
-	}
-	defer util.Close(closer)
-
-	t.Run("NoHealthAssessment", func(t *testing.T) {
-		cmd := NewResourceOverridesCommand(newCmdContext(map[string]string{
-			"resource.customizations": `apps/Deployment: {}`}))
-		out, err := captureStdout(func() {
-			cmd.SetArgs([]string{"health", f})
-			err := cmd.Execute()
-			assert.NoError(t, err)
-		})
-		assert.NoError(t, err)
-		assert.Contains(t, out, "Health script is not configured")
-	})
-
-	t.Run("HealthAssessmentConfigured", func(t *testing.T) {
-		cmd := NewResourceOverridesCommand(newCmdContext(map[string]string{
-			"resource.customizations": `apps/Deployment:
-  health.lua: |
-    return { status = "Progressing" }
-`}))
-		out, err := captureStdout(func() {
-			cmd.SetArgs([]string{"health", f})
-			err := cmd.Execute()
-			assert.NoError(t, err)
-		})
-		assert.NoError(t, err)
-		assert.Contains(t, out, "Progressing")
-	})
-}
-
-func TestResourceOverrideAction(t *testing.T) {
-	f, closer, err := tempFile(testDeploymentYAML)
-	if !assert.NoError(t, err) {
-		return
-	}
-	defer util.Close(closer)
-
-	t.Run("NoActions", func(t *testing.T) {
-		cmd := NewResourceOverridesCommand(newCmdContext(map[string]string{
-			"resource.customizations": `apps/Deployment: {}`}))
-		out, err := captureStdout(func() {
-			cmd.SetArgs([]string{"action", f, "test"})
-			err := cmd.Execute()
-			assert.NoError(t, err)
-		})
-		assert.NoError(t, err)
-		assert.Contains(t, out, "Actions are not configured")
-	})
-
-	t.Run("HealthAssessmentConfigured", func(t *testing.T) {
-		cmd := NewResourceOverridesCommand(newCmdContext(map[string]string{
-			"resource.customizations": `apps/Deployment:
-  actions: |
-    definitions:
-    - name: test
-      action.lua: |
-        obj.metadata.labels["test"] = 'updated'
-        return obj
-`}))
-		out, err := captureStdout(func() {
-			cmd.SetArgs([]string{"action", f, "test"})
-			err := cmd.Execute()
-			assert.NoError(t, err)
-		})
-		assert.NoError(t, err)
-		assert.Contains(t, out, "test: updated")
-	})
-}

cmd/argocd-util/main.go

@@ -8,9 +8,10 @@ import (
 	"io/ioutil"
 	"os"
 	"os/exec"
-	"reflect"
 	"syscall"
 
+	"github.com/argoproj/argo-cd/common"
+	"github.com/argoproj/argo-cd/util"
 	"github.com/ghodss/yaml"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -24,8 +25,6 @@ import (
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/clientcmd"
 
-	"github.com/argoproj/argo-cd/cmd/argocd-util/commands"
-	"github.com/argoproj/argo-cd/common"
 	"github.com/argoproj/argo-cd/errors"
 	"github.com/argoproj/argo-cd/util/cli"
 	"github.com/argoproj/argo-cd/util/db"
@@ -73,8 +72,6 @@ func NewCommand() *cobra.Command {
 	command.AddCommand(NewImportCommand())
 	command.AddCommand(NewExportCommand())
 	command.AddCommand(NewClusterConfig())
-	command.AddCommand(commands.NewProjectsCommand())
-	command.AddCommand(commands.NewSettingsCommand())
 
 	command.Flags().StringVar(&logLevel, "loglevel", "info", "Set the logging level. One of: debug|info|warn|error")
 	return command
@@ -110,7 +107,7 @@ func NewRunDexCommand() *cobra.Command {
 				} else {
 					err = ioutil.WriteFile("/tmp/dex.yaml", dexCfgBytes, 0644)
 					errors.CheckError(err)
-					log.Debug(redactor(string(dexCfgBytes)))
+					log.Info(string(dexCfgBytes))
 					cmd = exec.Command("dex", "serve", "/tmp/dex.yaml")
 					cmd.Stdout = os.Stdout
 					cmd.Stderr = os.Stderr
@@ -191,7 +188,7 @@ func NewGenDexConfigCommand() *cobra.Command {
 				errors.CheckError(err)
 				maskedDexCfgBytes, err := yaml.Marshal(dexCfg)
 				errors.CheckError(err)
-				fmt.Print(string(maskedDexCfgBytes))
+				fmt.Printf(string(maskedDexCfgBytes))
 			} else {
 				err = ioutil.WriteFile(out, dexCfgBytes, 0644)
 				errors.CheckError(err)
@@ -221,7 +218,6 @@ func NewImportCommand() *cobra.Command {
 				os.Exit(1)
 			}
 			config, err := clientConfig.ClientConfig()
-			errors.CheckError(err)
 			config.QPS = 100
 			config.Burst = 50
 			errors.CheckError(err)
@@ -244,49 +240,43 @@ func NewImportCommand() *cobra.Command {
 			// pruneObjects tracks live objects and it's current resource version. any remaining
 			// items in this map indicates the resource should be pruned since it no longer appears
 			// in the backup
-			pruneObjects := make(map[kube.ResourceKey]unstructured.Unstructured)
+			pruneObjects := make(map[kube.ResourceKey]string)
 			configMaps, err := acdClients.configMaps.List(metav1.ListOptions{})
 			errors.CheckError(err)
-			// referencedSecrets holds any secrets referenced in the argocd-cm configmap. These
-			// secrets need to be imported too
-			var referencedSecrets map[string]bool
 			for _, cm := range configMaps.Items {
-				if isArgoCDConfigMap(cm.GetName()) {
-					pruneObjects[kube.ResourceKey{Group: "", Kind: "ConfigMap", Name: cm.GetName()}] = cm
-				}
-				if cm.GetName() == common.ArgoCDConfigMapName {
-					referencedSecrets = getReferencedSecrets(cm)
+				cmName := cm.GetName()
+				if cmName == common.ArgoCDConfigMapName || cmName == common.ArgoCDRBACConfigMapName {
+					pruneObjects[kube.ResourceKey{Group: "", Kind: "ConfigMap", Name: cm.GetName()}] = cm.GetResourceVersion()
 				}
 			}
-
 			secrets, err := acdClients.secrets.List(metav1.ListOptions{})
 			errors.CheckError(err)
 			for _, secret := range secrets.Items {
-				if isArgoCDSecret(referencedSecrets, secret) {
-					pruneObjects[kube.ResourceKey{Group: "", Kind: "Secret", Name: secret.GetName()}] = secret
+				if isArgoCDSecret(nil, secret) {
+					pruneObjects[kube.ResourceKey{Group: "", Kind: "Secret", Name: secret.GetName()}] = secret.GetResourceVersion()
 				}
 			}
 			applications, err := acdClients.applications.List(metav1.ListOptions{})
 			errors.CheckError(err)
 			for _, app := range applications.Items {
-				pruneObjects[kube.ResourceKey{Group: "argoproj.io", Kind: "Application", Name: app.GetName()}] = app
+				pruneObjects[kube.ResourceKey{Group: "argoproj.io", Kind: "Application", Name: app.GetName()}] = app.GetResourceVersion()
 			}
 			projects, err := acdClients.projects.List(metav1.ListOptions{})
 			errors.CheckError(err)
 			for _, proj := range projects.Items {
-				pruneObjects[kube.ResourceKey{Group: "argoproj.io", Kind: "AppProject", Name: proj.GetName()}] = proj
+				pruneObjects[kube.ResourceKey{Group: "argoproj.io", Kind: "AppProject", Name: proj.GetName()}] = proj.GetResourceVersion()
 			}
 
 			// Create or replace existing object
-			backupObjects, err := kube.SplitYAML(string(input))
+			objs, err := kube.SplitYAML(string(input))
 			errors.CheckError(err)
-			for _, bakObj := range backupObjects {
-				gvk := bakObj.GroupVersionKind()
-				key := kube.ResourceKey{Group: gvk.Group, Kind: gvk.Kind, Name: bakObj.GetName()}
-				liveObj, exists := pruneObjects[key]
+			for _, obj := range objs {
+				gvk := obj.GroupVersionKind()
+				key := kube.ResourceKey{Group: gvk.Group, Kind: gvk.Kind, Name: obj.GetName()}
+				resourceVersion, exists := pruneObjects[key]
 				delete(pruneObjects, key)
 				var dynClient dynamic.ResourceInterface
-				switch bakObj.GetKind() {
+				switch obj.GetKind() {
 				case "Secret":
 					dynClient = acdClients.secrets
 				case "ConfigMap":
@@ -298,19 +288,17 @@ func NewImportCommand() *cobra.Command {
 				}
 				if !exists {
 					if !dryRun {
-						_, err = dynClient.Create(bakObj, metav1.CreateOptions{})
+						_, err = dynClient.Create(obj, metav1.CreateOptions{})
 						errors.CheckError(err)
 					}
-					fmt.Printf("%s/%s %s created%s\n", gvk.Group, gvk.Kind, bakObj.GetName(), dryRunMsg)
-				} else if specsEqual(*bakObj, liveObj) {
-					fmt.Printf("%s/%s %s unchanged%s\n", gvk.Group, gvk.Kind, bakObj.GetName(), dryRunMsg)
+					fmt.Printf("%s/%s %s created%s\n", gvk.Group, gvk.Kind, obj.GetName(), dryRunMsg)
 				} else {
 					if !dryRun {
-						newLive := updateLive(bakObj, &liveObj)
-						_, err = dynClient.Update(newLive, metav1.UpdateOptions{})
+						obj.SetResourceVersion(resourceVersion)
+						_, err = dynClient.Update(obj, metav1.UpdateOptions{})
 						errors.CheckError(err)
 					}
-					fmt.Printf("%s/%s %s updated%s\n", gvk.Group, gvk.Kind, bakObj.GetName(), dryRunMsg)
+					fmt.Printf("%s/%s %s replaced%s\n", gvk.Group, gvk.Kind, obj.GetName(), dryRunMsg)
 				}
 			}
 
@@ -386,14 +374,8 @@ func NewExportCommand() *cobra.Command {
 			} else {
 				f, err := os.Create(out)
 				errors.CheckError(err)
-				bw := bufio.NewWriter(f)
-				writer = bw
-				defer func() {
-					err = bw.Flush()
-					errors.CheckError(err)
-					err = f.Close()
-					errors.CheckError(err)
-				}()
+				defer util.Close(f)
+				writer = bufio.NewWriter(f)
 			}
 
 			acdClients := newArgoCDClientsets(config, namespace)
@@ -403,12 +385,6 @@ func NewExportCommand() *cobra.Command {
 			acdRBACConfigMap, err := acdClients.configMaps.Get(common.ArgoCDRBACConfigMapName, metav1.GetOptions{})
 			errors.CheckError(err)
 			export(writer, *acdRBACConfigMap)
-			acdKnownHostsConfigMap, err := acdClients.configMaps.Get(common.ArgoCDKnownHostsConfigMapName, metav1.GetOptions{})
-			errors.CheckError(err)
-			export(writer, *acdKnownHostsConfigMap)
-			acdTLSCertsConfigMap, err := acdClients.configMaps.Get(common.ArgoCDTLSCertsConfigMapName, metav1.GetOptions{})
-			errors.CheckError(err)
-			export(writer, *acdTLSCertsConfigMap)
 
 			referencedSecrets := getReferencedSecrets(*acdConfigMap)
 			secrets, err := acdClients.secrets.List(metav1.ListOptions{})
@@ -444,13 +420,11 @@ func getReferencedSecrets(un unstructured.Unstructured) map[string]bool {
 	err := runtime.DefaultUnstructuredConverter.FromUnstructured(un.Object, &cm)
 	errors.CheckError(err)
 	referencedSecrets := make(map[string]bool)
-
-	// Referenced repository secrets
 	if reposRAW, ok := cm.Data["repositories"]; ok {
-		repos := make([]settings.Repository, 0)
-		err := yaml.Unmarshal([]byte(reposRAW), &repos)
+		repoCreds := make([]settings.RepoCredentials, 0)
+		err := yaml.Unmarshal([]byte(reposRAW), &repoCreds)
 		errors.CheckError(err)
-		for _, cred := range repos {
+		for _, cred := range repoCreds {
 			if cred.PasswordSecret != nil {
 				referencedSecrets[cred.PasswordSecret.Name] = true
 			}
@@ -460,35 +434,27 @@ func getReferencedSecrets(un unstructured.Unstructured) map[string]bool {
 			if cred.UsernameSecret != nil {
 				referencedSecrets[cred.UsernameSecret.Name] = true
 			}
-			if cred.TLSClientCertDataSecret != nil {
-				referencedSecrets[cred.TLSClientCertDataSecret.Name] = true
-			}
-			if cred.TLSClientCertKeySecret != nil {
-				referencedSecrets[cred.TLSClientCertKeySecret.Name] = true
-			}
 		}
 	}
-
-	// Referenced repository credentials secrets
-	if reposRAW, ok := cm.Data["repository.credentials"]; ok {
-		creds := make([]settings.RepositoryCredentials, 0)
-		err := yaml.Unmarshal([]byte(reposRAW), &creds)
+	if helmReposRAW, ok := cm.Data["helm.repositories"]; ok {
+		helmRepoCreds := make([]settings.HelmRepoCredentials, 0)
+		err := yaml.Unmarshal([]byte(helmReposRAW), &helmRepoCreds)
 		errors.CheckError(err)
-		for _, cred := range creds {
-			if cred.PasswordSecret != nil {
-				referencedSecrets[cred.PasswordSecret.Name] = true
+		for _, cred := range helmRepoCreds {
+			if cred.CASecret != nil {
+				referencedSecrets[cred.CASecret.Name] = true
 			}
-			if cred.SSHPrivateKeySecret != nil {
-				referencedSecrets[cred.SSHPrivateKeySecret.Name] = true
+			if cred.CertSecret != nil {
+				referencedSecrets[cred.CertSecret.Name] = true
+			}
+			if cred.KeySecret != nil {
+				referencedSecrets[cred.KeySecret.Name] = true
 			}
 			if cred.UsernameSecret != nil {
 				referencedSecrets[cred.UsernameSecret.Name] = true
 			}
-			if cred.TLSClientCertDataSecret != nil {
-				referencedSecrets[cred.TLSClientCertDataSecret.Name] = true
-			}
-			if cred.TLSClientCertKeySecret != nil {
-				referencedSecrets[cred.TLSClientCertKeySecret.Name] = true
+			if cred.PasswordSecret != nil {
+				referencedSecrets[cred.PasswordSecret.Name] = true
 			}
 		}
 	}
@@ -520,73 +486,6 @@ func isArgoCDSecret(repoSecretRefs map[string]bool, un unstructured.Unstructured
 	return false
 }
 
-// isArgoCDConfigMap returns true if the configmap name is one of argo cd's well known configmaps
-func isArgoCDConfigMap(name string) bool {
-	switch name {
-	case common.ArgoCDConfigMapName, common.ArgoCDRBACConfigMapName, common.ArgoCDKnownHostsConfigMapName, common.ArgoCDTLSCertsConfigMapName:
-		return true
-	}
-	return false
-
-}
-
-// specsEqual returns if the spec, data, labels, annotations, and finalizers of the two
-// supplied objects are equal, indicating that no update is necessary during importing
-func specsEqual(left, right unstructured.Unstructured) bool {
-	if !reflect.DeepEqual(left.GetAnnotations(), right.GetAnnotations()) {
-		return false
-	}
-	if !reflect.DeepEqual(left.GetLabels(), right.GetLabels()) {
-		return false
-	}
-	if !reflect.DeepEqual(left.GetFinalizers(), right.GetFinalizers()) {
-		return false
-	}
-	switch left.GetKind() {
-	case "Secret", "ConfigMap":
-		leftData, _, _ := unstructured.NestedMap(left.Object, "data")
-		rightData, _, _ := unstructured.NestedMap(right.Object, "data")
-		return reflect.DeepEqual(leftData, rightData)
-	case "AppProject":
-		leftSpec, _, _ := unstructured.NestedMap(left.Object, "spec")
-		rightSpec, _, _ := unstructured.NestedMap(right.Object, "spec")
-		return reflect.DeepEqual(leftSpec, rightSpec)
-	case "Application":
-		leftSpec, _, _ := unstructured.NestedMap(left.Object, "spec")
-		rightSpec, _, _ := unstructured.NestedMap(right.Object, "spec")
-		leftStatus, _, _ := unstructured.NestedMap(left.Object, "status")
-		rightStatus, _, _ := unstructured.NestedMap(right.Object, "status")
-		// reconciledAt and observedAt are constantly changing and we ignore any diff there
-		delete(leftStatus, "reconciledAt")
-		delete(rightStatus, "reconciledAt")
-		delete(leftStatus, "observedAt")
-		delete(rightStatus, "observedAt")
-		return reflect.DeepEqual(leftSpec, rightSpec) && reflect.DeepEqual(leftStatus, rightStatus)
-	}
-	return false
-}
-
-// updateLive replaces the live object's finalizers, spec, annotations, labels, and data from the
-// backup object but leaves all other fields intact (status, other metadata, etc...)
-func updateLive(bak, live *unstructured.Unstructured) *unstructured.Unstructured {
-	newLive := live.DeepCopy()
-	newLive.SetAnnotations(bak.GetAnnotations())
-	newLive.SetLabels(bak.GetLabels())
-	newLive.SetFinalizers(bak.GetFinalizers())
-	switch live.GetKind() {
-	case "Secret", "ConfigMap":
-		newLive.Object["data"] = bak.Object["data"]
-	case "AppProject":
-		newLive.Object["spec"] = bak.Object["spec"]
-	case "Application":
-		newLive.Object["spec"] = bak.Object["spec"]
-		if _, ok := bak.Object["status"]; ok {
-			newLive.Object["status"] = bak.Object["status"]
-		}
-	}
-	return newLive
-}
-
 // export writes the unstructured object and removes extraneous cruft from output before writing
 func export(w io.Writer, un unstructured.Unstructured) {
 	name := un.GetName()
@@ -634,7 +533,7 @@ func NewClusterConfig() *cobra.Command {
 
 			cluster, err := db.NewDB(namespace, settings.NewSettingsManager(context.Background(), kubeclientset, namespace), kubeclientset).GetCluster(context.Background(), serverUrl)
 			errors.CheckError(err)
-			err = kube.WriteKubeConfig(cluster.RawRestConfig(), namespace, output)
+			err = kube.WriteKubeConfig(cluster.RESTConfig(), namespace, output)
 			errors.CheckError(err)
 		},
 	}
@@ -642,38 +541,6 @@ func NewClusterConfig() *cobra.Command {
 	return command
 }
 
-func iterateStringFields(obj interface{}, callback func(name string, val string) string) {
-	if mapField, ok := obj.(map[string]interface{}); ok {
-		for field, val := range mapField {
-			if strVal, ok := val.(string); ok {
-				mapField[field] = callback(field, strVal)
-			} else {
-				iterateStringFields(val, callback)
-			}
-		}
-	} else if arrayField, ok := obj.([]interface{}); ok {
-		for i := range arrayField {
-			iterateStringFields(arrayField[i], callback)
-		}
-	}
-}
-
-func redactor(dirtyString string) string {
-	config := make(map[string]interface{})
-	err := yaml.Unmarshal([]byte(dirtyString), &config)
-	errors.CheckError(err)
-	iterateStringFields(config, func(name string, val string) string {
-		if name == "clientSecret" || name == "secret" || name == "bindPW" {
-			return "********"
-		} else {
-			return val
-		}
-	})
-	data, err := yaml.Marshal(config)
-	errors.CheckError(err)
-	return string(data)
-}
-
 func main() {
 	if err := NewCommand().Execute(); err != nil {
 		fmt.Println(err)

cmd/argocd-util/main_test.go

@@ -1,94 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-var textToRedact = `
-connectors:
-- config:
-    clientID: aabbccddeeff00112233
-    clientSecret: |
-      theSecret
-    orgs:
-    - name: your-github-org
-    redirectURI: https://argocd.example.com/api/dex/callback
-  id: github
-  name: GitHub
-  type: github
-- config:
-    bindDN: uid=serviceaccount,cn=users,dc=example,dc=com
-    bindPW: theSecret
-    host: ldap.example.com:636
-  id: ldap
-  name: LDAP
-  type: ldap
-grpc:
-  addr: 0.0.0.0:5557
-telemetry:
-  http: 0.0.0.0:5558
-issuer: https://argocd.example.com/api/dex
-oauth2:
-  skipApprovalScreen: true
-staticClients:
-- id: argo-cd
-  name: Argo CD
-  redirectURIs:
-  - https://argocd.example.com/auth/callback
-  secret: Dis9M-GA11oTwZVQQWdDklPQw-sWXZkWJFyyEhMs
-- id: argo-cd-cli
-  name: Argo CD CLI
-  public: true
-  redirectURIs:
-  - http://localhost
-storage:
-  type: memory
-web:
-  http: 0.0.0.0:5556`
-
-var expectedRedaction = `connectors:
-- config:
-    clientID: aabbccddeeff00112233
-    clientSecret: '********'
-    orgs:
-    - name: your-github-org
-    redirectURI: https://argocd.example.com/api/dex/callback
-  id: github
-  name: GitHub
-  type: github
-- config:
-    bindDN: uid=serviceaccount,cn=users,dc=example,dc=com
-    bindPW: '********'
-    host: ldap.example.com:636
-  id: ldap
-  name: LDAP
-  type: ldap
-grpc:
-  addr: 0.0.0.0:5557
-issuer: https://argocd.example.com/api/dex
-oauth2:
-  skipApprovalScreen: true
-staticClients:
-- id: argo-cd
-  name: Argo CD
-  redirectURIs:
-  - https://argocd.example.com/auth/callback
-  secret: '********'
-- id: argo-cd-cli
-  name: Argo CD CLI
-  public: true
-  redirectURIs:
-  - http://localhost
-storage:
-  type: memory
-telemetry:
-  http: 0.0.0.0:5558
-web:
-  http: 0.0.0.0:5556
-`
-
-func TestSecretsRedactor(t *testing.T) {
-	assert.Equal(t, expectedRedaction, redactor(textToRedact))
-}

cmd/argocd/commands/account.go

@@ -2,29 +2,19 @@ package commands
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
 	"os"
-	"strconv"
-	"strings"
-	"text/tabwriter"
-	"time"
+	"syscall"
 
-	timeutil "github.com/argoproj/pkg/time"
-	"github.com/ghodss/yaml"
-	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"golang.org/x/crypto/ssh/terminal"
 
 	"github.com/argoproj/argo-cd/errors"
 	argocdclient "github.com/argoproj/argo-cd/pkg/apiclient"
-	accountpkg "github.com/argoproj/argo-cd/pkg/apiclient/account"
-	"github.com/argoproj/argo-cd/pkg/apiclient/session"
-	"github.com/argoproj/argo-cd/server/rbacpolicy"
+	"github.com/argoproj/argo-cd/server/account"
 	"github.com/argoproj/argo-cd/util"
 	"github.com/argoproj/argo-cd/util/cli"
 	"github.com/argoproj/argo-cd/util/localconfig"
-	sessionutil "github.com/argoproj/argo-cd/util/session"
 )
 
 func NewAccountCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
@@ -37,18 +27,11 @@ func NewAccountCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 		},
 	}
 	command.AddCommand(NewAccountUpdatePasswordCommand(clientOpts))
-	command.AddCommand(NewAccountGetUserInfoCommand(clientOpts))
-	command.AddCommand(NewAccountCanICommand(clientOpts))
-	command.AddCommand(NewAccountListCommand(clientOpts))
-	command.AddCommand(NewAccountGenerateTokenCommand(clientOpts))
-	command.AddCommand(NewAccountGetCommand(clientOpts))
-	command.AddCommand(NewAccountDeleteTokenCommand(clientOpts))
 	return command
 }
 
 func NewAccountUpdatePasswordCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	var (
-		account         string
 		currentPassword string
 		newPassword     string
 	)
@@ -60,341 +43,53 @@ func NewAccountUpdatePasswordCommand(clientOpts *argocdclient.ClientOptions) *co
 				c.HelpFunc()(c, args)
 				os.Exit(1)
 			}
-			acdClient := argocdclient.NewClientOrDie(clientOpts)
-			conn, usrIf := acdClient.NewAccountClientOrDie()
-			defer util.Close(conn)
 
-			userInfo := getCurrentAccount(acdClient)
-
-			if userInfo.Iss == sessionutil.SessionManagerClaimsIssuer && currentPassword == "" {
+			if currentPassword == "" {
 				fmt.Print("*** Enter current password: ")
-				password, err := terminal.ReadPassword(int(os.Stdin.Fd()))
+				password, err := terminal.ReadPassword(syscall.Stdin)
 				errors.CheckError(err)
 				currentPassword = string(password)
 				fmt.Print("\n")
 			}
-
 			if newPassword == "" {
 				var err error
 				newPassword, err = cli.ReadAndConfirmPassword()
 				errors.CheckError(err)
 			}
 
-			updatePasswordRequest := accountpkg.UpdatePasswordRequest{
+			updatePasswordRequest := account.UpdatePasswordRequest{
 				NewPassword:     newPassword,
 				CurrentPassword: currentPassword,
-				Name:            account,
 			}
 
+			acdClient := argocdclient.NewClientOrDie(clientOpts)
+			conn, usrIf := acdClient.NewAccountClientOrDie()
+			defer util.Close(conn)
+
 			ctx := context.Background()
 			_, err := usrIf.UpdatePassword(ctx, &updatePasswordRequest)
 			errors.CheckError(err)
 			fmt.Printf("Password updated\n")
 
-			if account == "" || account == userInfo.Username {
-				// Get a new JWT token after updating the password
-				localCfg, err := localconfig.ReadLocalConfig(clientOpts.ConfigPath)
-				errors.CheckError(err)
-				configCtx, err := localCfg.ResolveContext(clientOpts.Context)
-				errors.CheckError(err)
-				claims, err := configCtx.User.Claims()
-				errors.CheckError(err)
-				tokenString := passwordLogin(acdClient, claims.Subject, newPassword)
-				localCfg.UpsertUser(localconfig.User{
-					Name:      localCfg.CurrentContext,
-					AuthToken: tokenString,
-				})
-				err = localconfig.WriteLocalConfig(*localCfg, clientOpts.ConfigPath)
-				errors.CheckError(err)
-				fmt.Printf("Context '%s' updated\n", localCfg.CurrentContext)
-			}
+			// Get a new JWT token after updating the password
+			localCfg, err := localconfig.ReadLocalConfig(clientOpts.ConfigPath)
+			errors.CheckError(err)
+			configCtx, err := localCfg.ResolveContext(clientOpts.Context)
+			errors.CheckError(err)
+			claims, err := configCtx.User.Claims()
+			errors.CheckError(err)
+			tokenString := passwordLogin(acdClient, claims.Subject, newPassword)
+			localCfg.UpsertUser(localconfig.User{
+				Name:      localCfg.CurrentContext,
+				AuthToken: tokenString,
+			})
+			err = localconfig.WriteLocalConfig(*localCfg, clientOpts.ConfigPath)
+			errors.CheckError(err)
+			fmt.Printf("Context '%s' updated\n", localCfg.CurrentContext)
 		},
 	}
 
 	command.Flags().StringVar(&currentPassword, "current-password", "", "current password you wish to change")
 	command.Flags().StringVar(&newPassword, "new-password", "", "new password you want to update to")
-	command.Flags().StringVar(&account, "account", "", "an account name that should be updated. Defaults to current user account")
 	return command
 }
-
-func NewAccountGetUserInfoCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		output string
-	)
-	var command = &cobra.Command{
-		Use:   "get-user-info",
-		Short: "Get user info",
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) != 0 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-
-			conn, client := argocdclient.NewClientOrDie(clientOpts).NewSessionClientOrDie()
-			defer util.Close(conn)
-
-			ctx := context.Background()
-			response, err := client.GetUserInfo(ctx, &session.GetUserInfoRequest{})
-			errors.CheckError(err)
-
-			switch output {
-			case "yaml":
-				yamlBytes, err := yaml.Marshal(response)
-				errors.CheckError(err)
-				fmt.Println(string(yamlBytes))
-			case "json":
-				jsonBytes, err := json.MarshalIndent(response, "", "  ")
-				errors.CheckError(err)
-				fmt.Println(string(jsonBytes))
-			case "":
-				fmt.Printf("Logged In: %v\n", response.LoggedIn)
-				if response.LoggedIn {
-					fmt.Printf("Username: %s\n", response.Username)
-					fmt.Printf("Issuer: %s\n", response.Iss)
-					fmt.Printf("Groups: %v\n", strings.Join(response.Groups, ","))
-				}
-			default:
-				log.Fatalf("Unknown output format: %s", output)
-			}
-		},
-	}
-	command.Flags().StringVarP(&output, "output", "o", "", "Output format. One of: yaml, json")
-	return command
-}
-
-func NewAccountCanICommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	return &cobra.Command{
-		Use:   "can-i ACTION RESOURCE SUBRESOURCE",
-		Short: "Can I",
-		Example: fmt.Sprintf(`
-# Can I sync any app?
-argocd account can-i sync applications '*'
-
-# Can I update a project?
-argocd account can-i update projects 'default'
-
-# Can I create a cluster?
-argocd account can-i create clusters '*'
-
-Actions: %v
-Resources: %v
-`, rbacpolicy.Resources, rbacpolicy.Actions),
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) != 3 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-
-			conn, client := argocdclient.NewClientOrDie(clientOpts).NewAccountClientOrDie()
-			defer util.Close(conn)
-
-			ctx := context.Background()
-			response, err := client.CanI(ctx, &accountpkg.CanIRequest{
-				Action:      args[0],
-				Resource:    args[1],
-				Subresource: args[2],
-			})
-			errors.CheckError(err)
-			fmt.Println(response.Value)
-		},
-	}
-}
-
-func printAccountNames(accounts []*accountpkg.Account) {
-	for _, p := range accounts {
-		fmt.Println(p.Name)
-	}
-}
-
-func printAccountsTable(items []*accountpkg.Account) {
-	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
-	fmt.Fprintf(w, "NAME\tENABLED\tCAPABILITIES\n")
-	for _, a := range items {
-		fmt.Fprintf(w, "%s\t%v\t%s\n", a.Name, a.Enabled, strings.Join(a.Capabilities, ", "))
-	}
-	_ = w.Flush()
-}
-
-func NewAccountListCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		output string
-	)
-	cmd := &cobra.Command{
-		Use:     "list",
-		Short:   "List accounts",
-		Example: "argocd account list",
-		Run: func(c *cobra.Command, args []string) {
-
-			conn, client := argocdclient.NewClientOrDie(clientOpts).NewAccountClientOrDie()
-			defer util.Close(conn)
-
-			ctx := context.Background()
-			response, err := client.ListAccounts(ctx, &accountpkg.ListAccountRequest{})
-
-			errors.CheckError(err)
-			switch output {
-			case "yaml", "json":
-				err := PrintResourceList(response.Items, output, false)
-				errors.CheckError(err)
-			case "name":
-				printAccountNames(response.Items)
-			case "wide", "":
-				printAccountsTable(response.Items)
-			default:
-				errors.CheckError(fmt.Errorf("unknown output format: %s", output))
-			}
-		},
-	}
-	cmd.Flags().StringVarP(&output, "output", "o", "wide", "Output format. One of: json|yaml|wide|name")
-	return cmd
-}
-
-func getCurrentAccount(clientset argocdclient.Client) session.GetUserInfoResponse {
-	conn, client := clientset.NewSessionClientOrDie()
-	defer util.Close(conn)
-	userInfo, err := client.GetUserInfo(context.Background(), &session.GetUserInfoRequest{})
-	errors.CheckError(err)
-	return *userInfo
-}
-
-func NewAccountGetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		output  string
-		account string
-	)
-	cmd := &cobra.Command{
-		Use:   "get",
-		Short: "Get account details",
-		Example: `# Get the currently logged in account details
-argocd account get
-
-# Get details for an account by name
-argocd account get --account <account-name>`,
-		Run: func(c *cobra.Command, args []string) {
-			clientset := argocdclient.NewClientOrDie(clientOpts)
-
-			if account == "" {
-				account = getCurrentAccount(clientset).Username
-			}
-
-			conn, client := clientset.NewAccountClientOrDie()
-			defer util.Close(conn)
-
-			acc, err := client.GetAccount(context.Background(), &accountpkg.GetAccountRequest{Name: account})
-
-			errors.CheckError(err)
-			switch output {
-			case "yaml", "json":
-				err := PrintResourceList(acc, output, true)
-				errors.CheckError(err)
-			case "name":
-				fmt.Println(acc.Name)
-			case "wide", "":
-				printAccountDetails(acc)
-			default:
-				errors.CheckError(fmt.Errorf("unknown output format: %s", output))
-			}
-		},
-	}
-	cmd.Flags().StringVarP(&output, "output", "o", "wide", "Output format. One of: json|yaml|wide|name")
-	cmd.Flags().StringVarP(&account, "account", "a", "", "Account name. Defaults to the current account.")
-	return cmd
-}
-
-func printAccountDetails(acc *accountpkg.Account) {
-	fmt.Printf(printOpFmtStr, "Name:", acc.Name)
-	fmt.Printf(printOpFmtStr, "Enabled:", strconv.FormatBool(acc.Enabled))
-	fmt.Printf(printOpFmtStr, "Capabilities:", strings.Join(acc.Capabilities, ", "))
-	fmt.Println("\nTokens:")
-	if len(acc.Tokens) == 0 {
-		fmt.Println("NONE")
-	} else {
-		w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
-		fmt.Fprintf(w, "ID\tISSUED AT\tEXPIRING AT\n")
-		for _, t := range acc.Tokens {
-			expiresAtFormatted := "never"
-			if t.ExpiresAt > 0 {
-				expiresAt := time.Unix(t.ExpiresAt, 0)
-				expiresAtFormatted = expiresAt.Format(time.RFC3339)
-				if expiresAt.Before(time.Now()) {
-					expiresAtFormatted = fmt.Sprintf("%s (expired)", expiresAtFormatted)
-				}
-			}
-
-			fmt.Fprintf(w, "%s\t%s\t%s\n", t.Id, time.Unix(t.IssuedAt, 0).Format(time.RFC3339), expiresAtFormatted)
-		}
-		_ = w.Flush()
-	}
-}
-
-func NewAccountGenerateTokenCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		account   string
-		expiresIn string
-		id        string
-	)
-	cmd := &cobra.Command{
-		Use:   "generate-token",
-		Short: "Generate account token",
-		Example: `# Generate token for the currently logged in account
-argocd account generate-token
-
-# Generate token for the account with the specified name
-argocd account generate-token --account <account-name>`,
-		Run: func(c *cobra.Command, args []string) {
-
-			clientset := argocdclient.NewClientOrDie(clientOpts)
-			conn, client := clientset.NewAccountClientOrDie()
-			defer util.Close(conn)
-			if account == "" {
-				account = getCurrentAccount(clientset).Username
-			}
-			expiresIn, err := timeutil.ParseDuration(expiresIn)
-			errors.CheckError(err)
-			response, err := client.CreateToken(context.Background(), &accountpkg.CreateTokenRequest{
-				Name:      account,
-				ExpiresIn: int64(expiresIn.Seconds()),
-				Id:        id,
-			})
-			errors.CheckError(err)
-			fmt.Println(response.Token)
-		},
-	}
-	cmd.Flags().StringVarP(&account, "account", "a", "", "Account name. Defaults to the current account.")
-	cmd.Flags().StringVarP(&expiresIn, "expires-in", "e", "0s", "Duration before the token will expire. (Default: No expiration)")
-	cmd.Flags().StringVar(&id, "id", "", "Optional token id. Fallback to uuid if not value specified.")
-	return cmd
-}
-
-func NewAccountDeleteTokenCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		account string
-	)
-	cmd := &cobra.Command{
-		Use:   "delete-token",
-		Short: "Deletes account token",
-		Example: `# Delete token of the currently logged in account
-argocd account delete-token ID
-
-# Delete token of the account with the specified name
-argocd account generate-token --account <account-name>`,
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) != 1 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-			id := args[0]
-
-			clientset := argocdclient.NewClientOrDie(clientOpts)
-			conn, client := clientset.NewAccountClientOrDie()
-			defer util.Close(conn)
-			if account == "" {
-				account = getCurrentAccount(clientset).Username
-			}
-			_, err := client.DeleteToken(context.Background(), &accountpkg.DeleteTokenRequest{Name: account, Id: id})
-			errors.CheckError(err)
-		},
-	}
-	cmd.Flags().StringVarP(&account, "account", "a", "", "Account name. Defaults to the current account.")
-	return cmd
-}

cmd/argocd/commands/app_actions.go

@@ -1,175 +0,0 @@
-package commands
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"log"
-	"os"
-	"strconv"
-	"text/tabwriter"
-
-	"github.com/ghodss/yaml"
-	"github.com/spf13/cobra"
-
-	"github.com/argoproj/argo-cd/errors"
-	argocdclient "github.com/argoproj/argo-cd/pkg/apiclient"
-	applicationpkg "github.com/argoproj/argo-cd/pkg/apiclient/application"
-	"github.com/argoproj/argo-cd/util"
-)
-
-type DisplayedAction struct {
-	Group    string
-	Kind     string
-	Name     string
-	Action   string
-	Disabled bool
-}
-
-// NewApplicationResourceActionsCommand returns a new instance of an `argocd app actions` command
-func NewApplicationResourceActionsCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var command = &cobra.Command{
-		Use:   "actions",
-		Short: "Manage Resource actions",
-		Run: func(c *cobra.Command, args []string) {
-			c.HelpFunc()(c, args)
-			os.Exit(1)
-		},
-	}
-	command.AddCommand(NewApplicationResourceActionsListCommand(clientOpts))
-	command.AddCommand(NewApplicationResourceActionsRunCommand(clientOpts))
-	return command
-}
-
-// NewApplicationResourceActionsListCommand returns a new instance of an `argocd app actions list` command
-func NewApplicationResourceActionsListCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var namespace string
-	var kind string
-	var group string
-	var resourceName string
-	var output string
-	var command = &cobra.Command{
-		Use:   "list APPNAME",
-		Short: "Lists available actions on a resource",
-	}
-	command.Run = func(c *cobra.Command, args []string) {
-		if len(args) != 1 {
-			c.HelpFunc()(c, args)
-			os.Exit(1)
-		}
-		appName := args[0]
-		conn, appIf := argocdclient.NewClientOrDie(clientOpts).NewApplicationClientOrDie()
-		defer util.Close(conn)
-		ctx := context.Background()
-		resources, err := appIf.ManagedResources(ctx, &applicationpkg.ResourcesQuery{ApplicationName: &appName})
-		errors.CheckError(err)
-		filteredObjects := filterResources(command, resources.Items, group, kind, namespace, resourceName, true)
-		var availableActions []DisplayedAction
-		for i := range filteredObjects {
-			obj := filteredObjects[i]
-			gvk := obj.GroupVersionKind()
-			availActionsForResource, err := appIf.ListResourceActions(ctx, &applicationpkg.ApplicationResourceRequest{
-				Name:         &appName,
-				Namespace:    obj.GetNamespace(),
-				ResourceName: obj.GetName(),
-				Group:        gvk.Group,
-				Kind:         gvk.Kind,
-			})
-			errors.CheckError(err)
-			for _, action := range availActionsForResource.Actions {
-				displayAction := DisplayedAction{
-					Group:    gvk.Group,
-					Kind:     gvk.Kind,
-					Name:     obj.GetName(),
-					Action:   action.Name,
-					Disabled: action.Disabled,
-				}
-				availableActions = append(availableActions, displayAction)
-			}
-		}
-
-		switch output {
-		case "yaml":
-			yamlBytes, err := yaml.Marshal(availableActions)
-			errors.CheckError(err)
-			fmt.Println(string(yamlBytes))
-		case "json":
-			jsonBytes, err := json.MarshalIndent(availableActions, "", "  ")
-			errors.CheckError(err)
-			fmt.Println(string(jsonBytes))
-		case "":
-			w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
-			fmt.Fprintf(w, "GROUP\tKIND\tNAME\tACTION\tDISABLED\n")
-			fmt.Println()
-			for _, action := range availableActions {
-				fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n", action.Group, action.Kind, action.Name, action.Action, strconv.FormatBool(action.Disabled))
-			}
-			_ = w.Flush()
-		}
-	}
-	command.Flags().StringVar(&resourceName, "resource-name", "", "Name of resource")
-	command.Flags().StringVar(&kind, "kind", "", "Kind")
-	command.Flags().StringVar(&group, "group", "", "Group")
-	command.Flags().StringVar(&namespace, "namespace", "", "Namespace")
-	command.Flags().StringVarP(&output, "out", "o", "", "Output format. One of: yaml, json")
-
-	return command
-}
-
-// NewApplicationResourceActionsRunCommand returns a new instance of an `argocd app actions run` command
-func NewApplicationResourceActionsRunCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var namespace string
-	var resourceName string
-	var kind string
-	var group string
-	var all bool
-	var command = &cobra.Command{
-		Use:   "run APPNAME ACTION",
-		Short: "Runs an available action on resource(s)",
-	}
-
-	command.Flags().StringVar(&resourceName, "resource-name", "", "Name of resource")
-	command.Flags().StringVar(&namespace, "namespace", "", "Namespace")
-	command.Flags().StringVar(&kind, "kind", "", "Kind")
-	command.Flags().StringVar(&group, "group", "", "Group")
-	errors.CheckError(command.MarkFlagRequired("kind"))
-	command.Flags().BoolVar(&all, "all", false, "Indicates whether to run the action on multiple matching resources")
-
-	command.Run = func(c *cobra.Command, args []string) {
-		if len(args) != 2 {
-			c.HelpFunc()(c, args)
-			os.Exit(1)
-		}
-		appName := args[0]
-		actionName := args[1]
-
-		conn, appIf := argocdclient.NewClientOrDie(clientOpts).NewApplicationClientOrDie()
-		defer util.Close(conn)
-		ctx := context.Background()
-		resources, err := appIf.ManagedResources(ctx, &applicationpkg.ResourcesQuery{ApplicationName: &appName})
-		errors.CheckError(err)
-		filteredObjects := filterResources(command, resources.Items, group, kind, namespace, resourceName, all)
-		var resGroup = filteredObjects[0].GroupVersionKind().Group
-		for i := range filteredObjects[1:] {
-			if filteredObjects[i].GroupVersionKind().Group != resGroup {
-				log.Fatal("Ambiguous resource group. Use flag --group to specify resource group explicitly.")
-			}
-		}
-
-		for i := range filteredObjects {
-			obj := filteredObjects[i]
-			gvk := obj.GroupVersionKind()
-			objResourceName := obj.GetName()
-			_, err := appIf.RunResourceAction(context.Background(), &applicationpkg.ResourceActionRunRequest{
-				Name:         &appName,
-				Namespace:    obj.GetNamespace(),
-				ResourceName: objResourceName,
-				Group:        gvk.Group,
-				Kind:         gvk.Kind,
-				Action:       actionName,
-			})
-			errors.CheckError(err)
-		}
-	}
-	return command
-}

cmd/argocd/commands/app_test.go

@@ -1,104 +0,0 @@
-package commands
-
-import (
-	"testing"
-
-	"github.com/spf13/cobra"
-	"github.com/stretchr/testify/assert"
-
-	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-)
-
-func Test_setHelmOpt(t *testing.T) {
-	t.Run("Zero", func(t *testing.T) {
-		src := v1alpha1.ApplicationSource{}
-		setHelmOpt(&src, helmOpts{})
-		assert.Nil(t, src.Helm)
-	})
-	t.Run("ValueFiles", func(t *testing.T) {
-		src := v1alpha1.ApplicationSource{}
-		setHelmOpt(&src, helmOpts{valueFiles: []string{"foo"}})
-		assert.Equal(t, []string{"foo"}, src.Helm.ValueFiles)
-	})
-	t.Run("ReleaseName", func(t *testing.T) {
-		src := v1alpha1.ApplicationSource{}
-		setHelmOpt(&src, helmOpts{releaseName: "foo"})
-		assert.Equal(t, "foo", src.Helm.ReleaseName)
-	})
-	t.Run("HelmSets", func(t *testing.T) {
-		src := v1alpha1.ApplicationSource{}
-		setHelmOpt(&src, helmOpts{helmSets: []string{"foo=bar"}})
-		assert.Equal(t, []v1alpha1.HelmParameter{{Name: "foo", Value: "bar"}}, src.Helm.Parameters)
-	})
-	t.Run("HelmSetStrings", func(t *testing.T) {
-		src := v1alpha1.ApplicationSource{}
-		setHelmOpt(&src, helmOpts{helmSetStrings: []string{"foo=bar"}})
-		assert.Equal(t, []v1alpha1.HelmParameter{{Name: "foo", Value: "bar", ForceString: true}}, src.Helm.Parameters)
-	})
-	t.Run("HelmSetFiles", func(t *testing.T) {
-		src := v1alpha1.ApplicationSource{}
-		setHelmOpt(&src, helmOpts{helmSetFiles: []string{"foo=bar"}})
-		assert.Equal(t, []v1alpha1.HelmFileParameter{{Name: "foo", Path: "bar"}}, src.Helm.FileParameters)
-	})
-}
-
-func Test_setJsonnetOpt(t *testing.T) {
-	t.Run("TlaSets", func(t *testing.T) {
-		src := v1alpha1.ApplicationSource{}
-		setJsonnetOpt(&src, []string{"foo=bar"}, false)
-		assert.Equal(t, []v1alpha1.JsonnetVar{{Name: "foo", Value: "bar"}}, src.Directory.Jsonnet.TLAs)
-		setJsonnetOpt(&src, []string{"bar=baz"}, false)
-		assert.Equal(t, []v1alpha1.JsonnetVar{{Name: "foo", Value: "bar"}, {Name: "bar", Value: "baz"}}, src.Directory.Jsonnet.TLAs)
-	})
-	t.Run("ExtSets", func(t *testing.T) {
-		src := v1alpha1.ApplicationSource{}
-		setJsonnetOptExtVar(&src, []string{"foo=bar"}, false)
-		assert.Equal(t, []v1alpha1.JsonnetVar{{Name: "foo", Value: "bar"}}, src.Directory.Jsonnet.ExtVars)
-		setJsonnetOptExtVar(&src, []string{"bar=baz"}, false)
-		assert.Equal(t, []v1alpha1.JsonnetVar{{Name: "foo", Value: "bar"}, {Name: "bar", Value: "baz"}}, src.Directory.Jsonnet.ExtVars)
-	})
-}
-
-type appOptionsFixture struct {
-	spec    *v1alpha1.ApplicationSpec
-	command *cobra.Command
-	options *appOptions
-}
-
-func (f *appOptionsFixture) SetFlag(key, value string) error {
-	err := f.command.Flags().Set(key, value)
-	if err != nil {
-		return err
-	}
-	_ = setAppSpecOptions(f.command.Flags(), f.spec, f.options)
-	return err
-}
-
-func newAppOptionsFixture() *appOptionsFixture {
-	fixture := &appOptionsFixture{
-		spec:    &v1alpha1.ApplicationSpec{},
-		command: &cobra.Command{},
-		options: &appOptions{},
-	}
-	addAppFlags(fixture.command, fixture.options)
-	return fixture
-}
-
-func Test_setAppSpecOptions(t *testing.T) {
-	f := newAppOptionsFixture()
-	t.Run("SyncPolicy", func(t *testing.T) {
-		assert.NoError(t, f.SetFlag("sync-policy", "automated"))
-		assert.NotNil(t, f.spec.SyncPolicy.Automated)
-
-		assert.NoError(t, f.SetFlag("sync-policy", "none"))
-		assert.Nil(t, f.spec.SyncPolicy)
-	})
-	t.Run("SyncOptions", func(t *testing.T) {
-		assert.NoError(t, f.SetFlag("sync-option", "a=1"))
-		assert.True(t, f.spec.SyncPolicy.SyncOptions.HasOption("a=1"))
-
-		// remove the options using !
-		assert.NoError(t, f.SetFlag("sync-option", "!a=1"))
-		assert.Nil(t, f.spec.SyncPolicy)
-	})
-}

cmd/argocd/commands/cert.go

@@ -1,322 +0,0 @@
-package commands
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"sort"
-	"strings"
-	"text/tabwriter"
-
-	"github.com/spf13/cobra"
-
-	"github.com/argoproj/argo-cd/errors"
-	argocdclient "github.com/argoproj/argo-cd/pkg/apiclient"
-	certificatepkg "github.com/argoproj/argo-cd/pkg/apiclient/certificate"
-	appsv1 "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	"github.com/argoproj/argo-cd/util"
-	certutil "github.com/argoproj/argo-cd/util/cert"
-
-	"crypto/x509"
-)
-
-// NewCertCommand returns a new instance of an `argocd repo` command
-func NewCertCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var command = &cobra.Command{
-		Use:   "cert",
-		Short: "Manage repository certificates and SSH known hosts entries",
-		Run: func(c *cobra.Command, args []string) {
-			c.HelpFunc()(c, args)
-			os.Exit(1)
-		},
-		Example: `  # Add a TLS certificate for cd.example.com to ArgoCD cert store from a file
-  argocd cert add-tls --from ~/mycert.pem cd.example.com
-
-  # Add a TLS certificate for cd.example.com to ArgoCD via stdin
-  cat ~/mycert.pem | argocd cert add-tls cd.example.com
-
-  # Add SSH known host entries for cd.example.com to ArgoCD by scanning host
-  ssh-keyscan cd.example.com | argocd cert add-ssh --batch
-
-  # List all known TLS certificates
-  argocd cert list --cert-type https
-
-  # Remove all TLS certificates for cd.example.com
-  argocd cert rm --cert-type https cd.example.com
-
-  # Remove all certificates and SSH known host entries for cd.example.com
-  argocd cert rm cd.example.com
-`,
-	}
-
-	command.AddCommand(NewCertAddSSHCommand(clientOpts))
-	command.AddCommand(NewCertAddTLSCommand(clientOpts))
-	command.AddCommand(NewCertListCommand(clientOpts))
-	command.AddCommand(NewCertRemoveCommand(clientOpts))
-	return command
-}
-
-func NewCertAddTLSCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		fromFile string
-		upsert   bool
-	)
-	var command = &cobra.Command{
-		Use:   "add-tls SERVERNAME",
-		Short: "Add TLS certificate data for connecting to repository server SERVERNAME",
-		Run: func(c *cobra.Command, args []string) {
-			conn, certIf := argocdclient.NewClientOrDie(clientOpts).NewCertClientOrDie()
-			defer util.Close(conn)
-
-			if len(args) != 1 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-
-			var certificateArray []string
-			var err error
-
-			if fromFile != "" {
-				fmt.Printf("Reading TLS certificate data in PEM format from '%s'\n", fromFile)
-				certificateArray, err = certutil.ParseTLSCertificatesFromPath(fromFile)
-			} else {
-				fmt.Println("Enter TLS certificate data in PEM format. Press CTRL-D when finished.")
-				certificateArray, err = certutil.ParseTLSCertificatesFromStream(os.Stdin)
-			}
-
-			errors.CheckError(err)
-
-			certificateList := make([]appsv1.RepositoryCertificate, 0)
-
-			subjectMap := make(map[string]*x509.Certificate)
-
-			for _, entry := range certificateArray {
-				// We want to make sure to only send valid certificate data to the
-				// server, so we decode the certificate into X509 structure before
-				// further processing it.
-				x509cert, err := certutil.DecodePEMCertificateToX509(entry)
-				errors.CheckError(err)
-
-				// TODO: We need a better way to detect duplicates sent in the stream,
-				// maybe by using fingerprints? For now, no two certs with the same
-				// subject may be sent.
-				if subjectMap[x509cert.Subject.String()] != nil {
-					fmt.Printf("ERROR: Cert with subject '%s' already seen in the input stream.\n", x509cert.Subject.String())
-					continue
-				} else {
-					subjectMap[x509cert.Subject.String()] = x509cert
-				}
-			}
-
-			serverName := args[0]
-
-			if len(certificateArray) > 0 {
-				certificateList = append(certificateList, appsv1.RepositoryCertificate{
-					ServerName: serverName,
-					CertType:   "https",
-					CertData:   []byte(strings.Join(certificateArray, "\n")),
-				})
-				certificates, err := certIf.CreateCertificate(context.Background(), &certificatepkg.RepositoryCertificateCreateRequest{
-					Certificates: &appsv1.RepositoryCertificateList{
-						Items: certificateList,
-					},
-					Upsert: upsert,
-				})
-				errors.CheckError(err)
-				fmt.Printf("Created entry with %d PEM certificates for repository server %s\n", len(certificates.Items), serverName)
-			} else {
-				fmt.Printf("No valid certificates have been detected in the stream.\n")
-			}
-		},
-	}
-	command.Flags().StringVar(&fromFile, "from", "", "read TLS certificate data from file (default is to read from stdin)")
-	command.Flags().BoolVar(&upsert, "upsert", false, "Replace existing TLS certificate if certificate is different in input")
-	return command
-}
-
-// NewCertAddCommand returns a new instance of an `argocd cert add` command
-func NewCertAddSSHCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		fromFile     string
-		batchProcess bool
-		upsert       bool
-		certificates []appsv1.RepositoryCertificate
-	)
-
-	var command = &cobra.Command{
-		Use:   "add-ssh --batch",
-		Short: "Add SSH known host entries for repository servers",
-		Run: func(c *cobra.Command, args []string) {
-
-			conn, certIf := argocdclient.NewClientOrDie(clientOpts).NewCertClientOrDie()
-			defer util.Close(conn)
-
-			var sshKnownHostsLists []string
-			var err error
-
-			// --batch is a flag, but it is mandatory for now.
-			if batchProcess {
-				if fromFile != "" {
-					fmt.Printf("Reading SSH known hosts entries from file '%s'\n", fromFile)
-					sshKnownHostsLists, err = certutil.ParseSSHKnownHostsFromPath(fromFile)
-				} else {
-					fmt.Println("Enter SSH known hosts entries, one per line. Press CTRL-D when finished.")
-					sshKnownHostsLists, err = certutil.ParseSSHKnownHostsFromStream(os.Stdin)
-				}
-			} else {
-				err = fmt.Errorf("You need to specify --batch or specify --help for usage instructions")
-			}
-
-			errors.CheckError(err)
-
-			if len(sshKnownHostsLists) == 0 {
-				errors.CheckError(fmt.Errorf("No valid SSH known hosts data found."))
-			}
-
-			for _, knownHostsEntry := range sshKnownHostsLists {
-				_, certSubType, certData, err := certutil.TokenizeSSHKnownHostsEntry(knownHostsEntry)
-				errors.CheckError(err)
-				hostnameList, _, err := certutil.KnownHostsLineToPublicKey(knownHostsEntry)
-				errors.CheckError(err)
-				// Each key could be valid for multiple hostnames
-				for _, hostname := range hostnameList {
-					certificate := appsv1.RepositoryCertificate{
-						ServerName:  hostname,
-						CertType:    "ssh",
-						CertSubType: certSubType,
-						CertData:    certData,
-					}
-					certificates = append(certificates, certificate)
-				}
-			}
-
-			certList := &appsv1.RepositoryCertificateList{Items: certificates}
-			response, err := certIf.CreateCertificate(context.Background(), &certificatepkg.RepositoryCertificateCreateRequest{
-				Certificates: certList,
-				Upsert:       upsert,
-			})
-			errors.CheckError(err)
-			fmt.Printf("Successfully created %d SSH known host entries\n", len(response.Items))
-		},
-	}
-	command.Flags().StringVar(&fromFile, "from", "", "Read SSH known hosts data from file (default is to read from stdin)")
-	command.Flags().BoolVar(&batchProcess, "batch", false, "Perform batch processing by reading in SSH known hosts data (mandatory flag)")
-	command.Flags().BoolVar(&upsert, "upsert", false, "Replace existing SSH server public host keys if key is different in input")
-	return command
-}
-
-// NewCertRemoveCommand returns a new instance of an `argocd cert rm` command
-func NewCertRemoveCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		certType    string
-		certSubType string
-		certQuery   certificatepkg.RepositoryCertificateQuery
-	)
-	var command = &cobra.Command{
-		Use:   "rm REPOSERVER",
-		Short: "Remove certificate of TYPE for REPOSERVER",
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) < 1 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-			conn, certIf := argocdclient.NewClientOrDie(clientOpts).NewCertClientOrDie()
-			defer util.Close(conn)
-			hostNamePattern := args[0]
-
-			// Prevent the user from specifying a wildcard as hostname as precaution
-			// measure -- the user could still use "?*" or any other pattern to
-			// remove all certificates, but it's less likely that it happens by
-			// accident.
-			if hostNamePattern == "*" {
-				err := fmt.Errorf("A single wildcard is not allowed as REPOSERVER name.")
-				errors.CheckError(err)
-			}
-			certQuery = certificatepkg.RepositoryCertificateQuery{
-				HostNamePattern: hostNamePattern,
-				CertType:        certType,
-				CertSubType:     certSubType,
-			}
-			removed, err := certIf.DeleteCertificate(context.Background(), &certQuery)
-			errors.CheckError(err)
-			if len(removed.Items) > 0 {
-				for _, cert := range removed.Items {
-					fmt.Printf("Removed cert for '%s' of type '%s' (subtype '%s')\n", cert.ServerName, cert.CertType, cert.CertSubType)
-				}
-			} else {
-				fmt.Println("No certificates were removed (none matched the given patterns)")
-			}
-		},
-	}
-	command.Flags().StringVar(&certType, "cert-type", "", "Only remove certs of given type (ssh, https)")
-	command.Flags().StringVar(&certSubType, "cert-sub-type", "", "Only remove certs of given sub-type (only for ssh)")
-	return command
-}
-
-// NewCertListCommand returns a new instance of an `argocd cert rm` command
-func NewCertListCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		certType        string
-		hostNamePattern string
-		sortOrder       string
-		output          string
-	)
-	var command = &cobra.Command{
-		Use:   "list",
-		Short: "List configured certificates",
-		Run: func(c *cobra.Command, args []string) {
-			if certType != "" {
-				switch certType {
-				case "ssh":
-				case "https":
-				default:
-					fmt.Println("cert-type must be either ssh or https")
-					os.Exit(1)
-				}
-			}
-
-			conn, certIf := argocdclient.NewClientOrDie(clientOpts).NewCertClientOrDie()
-			defer util.Close(conn)
-			certificates, err := certIf.ListCertificates(context.Background(), &certificatepkg.RepositoryCertificateQuery{HostNamePattern: hostNamePattern, CertType: certType})
-			errors.CheckError(err)
-
-			switch output {
-			case "yaml", "json":
-				err := PrintResourceList(certificates.Items, output, false)
-				errors.CheckError(err)
-			case "wide", "":
-				printCertTable(certificates.Items, sortOrder)
-			default:
-				errors.CheckError(fmt.Errorf("unknown output format: %s", output))
-			}
-
-		},
-	}
-
-	command.Flags().StringVarP(&output, "output", "o", "wide", "Output format. One of: json|yaml|wide")
-	command.Flags().StringVar(&sortOrder, "sort", "", "set display sort order for output format wide. One of: hostname|type")
-	command.Flags().StringVar(&certType, "cert-type", "", "only list certificates of given type, valid: 'ssh','https'")
-	command.Flags().StringVar(&hostNamePattern, "hostname-pattern", "", "only list certificates for hosts matching given glob-pattern")
-	return command
-}
-
-// Print table of certificate info
-func printCertTable(certs []appsv1.RepositoryCertificate, sortOrder string) {
-	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
-	fmt.Fprintf(w, "HOSTNAME\tTYPE\tSUBTYPE\tINFO\n")
-
-	if sortOrder == "hostname" || sortOrder == "" {
-		sort.Slice(certs, func(i, j int) bool {
-			return certs[i].ServerName < certs[j].ServerName
-		})
-	} else if sortOrder == "type" {
-		sort.Slice(certs, func(i, j int) bool {
-			return certs[i].CertType < certs[j].CertType
-		})
-	}
-
-	for _, c := range certs {
-		fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", c.ServerName, c.CertType, c.CertSubType, c.CertInfo)
-	}
-	_ = w.Flush()
-}

cmd/argocd/commands/cluster.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 	"text/tabwriter"
 
+	"github.com/ghodss/yaml"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"k8s.io/client-go/kubernetes"
@@ -18,10 +19,9 @@ import (
 	"github.com/argoproj/argo-cd/common"
 	"github.com/argoproj/argo-cd/errors"
 	argocdclient "github.com/argoproj/argo-cd/pkg/apiclient"
-	clusterpkg "github.com/argoproj/argo-cd/pkg/apiclient/cluster"
 	argoappv1 "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
+	"github.com/argoproj/argo-cd/server/cluster"
 	"github.com/argoproj/argo-cd/util"
-	"github.com/argoproj/argo-cd/util/clusterauth"
 )
 
 // NewClusterCommand returns a new instance of an `argocd cluster` command
@@ -33,41 +33,25 @@ func NewClusterCommand(clientOpts *argocdclient.ClientOptions, pathOpts *clientc
 			c.HelpFunc()(c, args)
 			os.Exit(1)
 		},
-		Example: `  # List all known clusters in JSON format:
-  argocd cluster list -o json
-
-  # Add a target cluster configuration to ArgoCD. The context must exist in your kubectl config:
-  argocd cluster add example-cluster
-
-  # Get specific details about a cluster in plain text (wide) format:
-  argocd cluster get example-cluster -o wide
-
-  #	Remove a target cluster context from ArgoCD
-  argocd cluster rm example-cluster
-`,
 	}
 
 	command.AddCommand(NewClusterAddCommand(clientOpts, pathOpts))
 	command.AddCommand(NewClusterGetCommand(clientOpts))
 	command.AddCommand(NewClusterListCommand(clientOpts))
 	command.AddCommand(NewClusterRemoveCommand(clientOpts))
-	command.AddCommand(NewClusterRotateAuthCommand(clientOpts))
 	return command
 }
 
 // NewClusterAddCommand returns a new instance of an `argocd cluster add` command
 func NewClusterAddCommand(clientOpts *argocdclient.ClientOptions, pathOpts *clientcmd.PathOptions) *cobra.Command {
 	var (
-		inCluster       bool
-		upsert          bool
-		serviceAccount  string
-		awsRoleArn      string
-		awsClusterName  string
-		systemNamespace string
-		namespaces      []string
+		inCluster      bool
+		upsert         bool
+		awsRoleArn     string
+		awsClusterName string
 	)
 	var command = &cobra.Command{
-		Use:   "add CONTEXT",
+		Use:   "add",
 		Short: fmt.Sprintf("%s cluster add CONTEXT", cliName),
 		Run: func(c *cobra.Command, args []string) {
 			var configAccess clientcmd.ConfigAccess = pathOpts
@@ -78,10 +62,9 @@ func NewClusterAddCommand(clientOpts *argocdclient.ClientOptions, pathOpts *clie
 			}
 			config, err := configAccess.GetStartingConfig()
 			errors.CheckError(err)
-			contextName := args[0]
-			clstContext := config.Contexts[contextName]
+			clstContext := config.Contexts[args[0]]
 			if clstContext == nil {
-				log.Fatalf("Context %s does not exist in kubeconfig", contextName)
+				log.Fatalf("Context %s does not exist in kubeconfig", args[0])
 			}
 
 			overrides := clientcmd.ConfigOverrides{
@@ -102,36 +85,29 @@ func NewClusterAddCommand(clientOpts *argocdclient.ClientOptions, pathOpts *clie
 				// Install RBAC resources for managing the cluster
 				clientset, err := kubernetes.NewForConfig(conf)
 				errors.CheckError(err)
-				if serviceAccount != "" {
-					managerBearerToken, err = clusterauth.GetServiceAccountBearerToken(clientset, systemNamespace, serviceAccount)
-				} else {
-					managerBearerToken, err = clusterauth.InstallClusterManagerRBAC(clientset, systemNamespace, namespaces)
-				}
+				managerBearerToken, err = common.InstallClusterManagerRBAC(clientset)
 				errors.CheckError(err)
 			}
 			conn, clusterIf := argocdclient.NewClientOrDie(clientOpts).NewClusterClientOrDie()
 			defer util.Close(conn)
-			clst := newCluster(contextName, namespaces, conf, managerBearerToken, awsAuthConf)
+			clst := NewCluster(args[0], conf, managerBearerToken, awsAuthConf)
 			if inCluster {
 				clst.Server = common.KubernetesInternalAPIServerAddr
 			}
-			clstCreateReq := clusterpkg.ClusterCreateRequest{
+			clstCreateReq := cluster.ClusterCreateRequest{
 				Cluster: clst,
 				Upsert:  upsert,
 			}
-			_, err = clusterIf.Create(context.Background(), &clstCreateReq)
+			clst, err = clusterIf.Create(context.Background(), &clstCreateReq)
 			errors.CheckError(err)
-			fmt.Printf("Cluster '%s' added\n", clst.Server)
+			fmt.Printf("Cluster '%s' added\n", clst.Name)
 		},
 	}
 	command.PersistentFlags().StringVar(&pathOpts.LoadingRules.ExplicitPath, pathOpts.ExplicitFileFlag, pathOpts.LoadingRules.ExplicitPath, "use a particular kubeconfig file")
 	command.Flags().BoolVar(&inCluster, "in-cluster", false, "Indicates Argo CD resides inside this cluster and should connect using the internal k8s hostname (kubernetes.default.svc)")
 	command.Flags().BoolVar(&upsert, "upsert", false, "Override an existing cluster with the same name even if the spec differs")
-	command.Flags().StringVar(&serviceAccount, "service-account", "", fmt.Sprintf("System namespace service account to use for kubernetes resource management. If not set then default \"%s\" SA will be created", clusterauth.ArgoCDManagerServiceAccount))
-	command.Flags().StringVar(&awsClusterName, "aws-cluster-name", "", "AWS Cluster name if set then aws cli eks token command will be used to access cluster")
+	command.Flags().StringVar(&awsClusterName, "aws-cluster-name", "", "AWS Cluster name if set then aws-iam-authenticator will be used to access cluster")
 	command.Flags().StringVar(&awsRoleArn, "aws-role-arn", "", "Optional AWS role arn. If set then AWS IAM Authenticator assume a role to perform cluster operations instead of the default AWS credential provider chain.")
-	command.Flags().StringVar(&systemNamespace, "system-namespace", common.DefaultSystemNamespace, "Use different system namespace")
-	command.Flags().StringArrayVar(&namespaces, "namespace", nil, "List of namespaces which are allowed to manage")
 	return command
 }
 
@@ -174,21 +150,32 @@ func printKubeContexts(ca clientcmd.ConfigAccess) {
 	}
 }
 
-func newCluster(name string, namespaces []string, conf *rest.Config, managerBearerToken string, awsAuthConf *argoappv1.AWSAuthConfig) *argoappv1.Cluster {
+func NewCluster(name string, conf *rest.Config, managerBearerToken string, awsAuthConf *argoappv1.AWSAuthConfig) *argoappv1.Cluster {
 	tlsClientConfig := argoappv1.TLSClientConfig{
 		Insecure:   conf.TLSClientConfig.Insecure,
 		ServerName: conf.TLSClientConfig.ServerName,
+		CertData:   conf.TLSClientConfig.CertData,
+		KeyData:    conf.TLSClientConfig.KeyData,
 		CAData:     conf.TLSClientConfig.CAData,
 	}
+	if len(conf.TLSClientConfig.CertData) == 0 && conf.TLSClientConfig.CertFile != "" {
+		data, err := ioutil.ReadFile(conf.TLSClientConfig.CertFile)
+		errors.CheckError(err)
+		tlsClientConfig.CertData = data
+	}
+	if len(conf.TLSClientConfig.KeyData) == 0 && conf.TLSClientConfig.KeyFile != "" {
+		data, err := ioutil.ReadFile(conf.TLSClientConfig.KeyFile)
+		errors.CheckError(err)
+		tlsClientConfig.KeyData = data
+	}
 	if len(conf.TLSClientConfig.CAData) == 0 && conf.TLSClientConfig.CAFile != "" {
 		data, err := ioutil.ReadFile(conf.TLSClientConfig.CAFile)
 		errors.CheckError(err)
 		tlsClientConfig.CAData = data
 	}
 	clst := argoappv1.Cluster{
-		Server:     conf.Host,
-		Name:       name,
-		Namespaces: namespaces,
+		Server: conf.Host,
+		Name:   name,
 		Config: argoappv1.ClusterConfig{
 			BearerToken:     managerBearerToken,
 			TLSClientConfig: tlsClientConfig,
@@ -200,13 +187,9 @@ func newCluster(name string, namespaces []string, conf *rest.Config, managerBear
 
 // NewClusterGetCommand returns a new instance of an `argocd cluster get` command
 func NewClusterGetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		output string
-	)
 	var command = &cobra.Command{
-		Use:     "get SERVER",
-		Short:   "Get cluster information",
-		Example: `argocd cluster get https://12.34.567.89`,
+		Use:   "get",
+		Short: "Get cluster information",
 		Run: func(c *cobra.Command, args []string) {
 			if len(args) == 0 {
 				c.HelpFunc()(c, args)
@@ -214,68 +197,23 @@ func NewClusterGetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command
 			}
 			conn, clusterIf := argocdclient.NewClientOrDie(clientOpts).NewClusterClientOrDie()
 			defer util.Close(conn)
-			clusters := make([]argoappv1.Cluster, 0)
 			for _, clusterName := range args {
-				clst, err := clusterIf.Get(context.Background(), &clusterpkg.ClusterQuery{Server: clusterName})
+				clst, err := clusterIf.Get(context.Background(), &cluster.ClusterQuery{Server: clusterName})
 				errors.CheckError(err)
-				clusters = append(clusters, *clst)
-			}
-			switch output {
-			case "yaml", "json":
-				err := PrintResourceList(clusters, output, true)
+				yamlBytes, err := yaml.Marshal(clst)
 				errors.CheckError(err)
-			case "wide", "":
-				printClusterDetails(clusters)
-			case "server":
-				printClusterServers(clusters)
-			default:
-				errors.CheckError(fmt.Errorf("unknown output format: %s", output))
+				fmt.Printf("%v", string(yamlBytes))
 			}
 		},
 	}
-	// we have yaml as default to not break backwards-compatibility
-	command.Flags().StringVarP(&output, "output", "o", "yaml", "Output format. One of: json|yaml|wide|server")
 	return command
 }
 
-func strWithDefault(value string, def string) string {
-	if value == "" {
-		return def
-	}
-	return value
-}
-
-func formatNamespaces(cluster argoappv1.Cluster) string {
-	if len(cluster.Namespaces) == 0 {
-		return "all namespaces"
-	}
-	return strings.Join(cluster.Namespaces, ", ")
-}
-
-func printClusterDetails(clusters []argoappv1.Cluster) {
-	for _, cluster := range clusters {
-		fmt.Printf("Cluster information\n\n")
-		fmt.Printf("  Server URL:            %s\n", cluster.Server)
-		fmt.Printf("  Server Name:           %s\n", strWithDefault(cluster.Name, "-"))
-		fmt.Printf("  Server Version:        %s\n", cluster.ServerVersion)
-		fmt.Printf("  Namespaces:        	 %s\n", formatNamespaces(cluster))
-		fmt.Printf("\nTLS configuration\n\n")
-		fmt.Printf("  Client cert:           %v\n", string(cluster.Config.TLSClientConfig.CertData) != "")
-		fmt.Printf("  Cert validation:       %v\n", !cluster.Config.TLSClientConfig.Insecure)
-		fmt.Printf("\nAuthentication\n\n")
-		fmt.Printf("  Basic authentication:  %v\n", cluster.Config.Username != "")
-		fmt.Printf("  oAuth authentication:  %v\n", cluster.Config.BearerToken != "")
-		fmt.Printf("  AWS authentication:    %v\n", cluster.Config.AWSAuthConfig != nil)
-		fmt.Println()
-	}
-}
-
 // NewClusterRemoveCommand returns a new instance of an `argocd cluster list` command
 func NewClusterRemoveCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	var command = &cobra.Command{
-		Use:     "rm SERVER",
-		Short:   "Remove cluster credentials",
-		Example: `argocd cluster rm https://12.34.567.89`,
+		Use:   "rm",
+		Short: "Remove cluster credentials",
 		Run: func(c *cobra.Command, args []string) {
 			if len(args) == 0 {
 				c.HelpFunc()(c, args)
@@ -289,9 +227,9 @@ func NewClusterRemoveCommand(clientOpts *argocdclient.ClientOptions) *cobra.Comm
 
 			for _, clusterName := range args {
 				// TODO(jessesuen): find the right context and remove manager RBAC artifacts
-				// err := clusterauth.UninstallClusterManagerRBAC(clientset)
+				// err := common.UninstallClusterManagerRBAC(clientset)
 				// errors.CheckError(err)
-				_, err := clusterIf.Delete(context.Background(), &clusterpkg.ClusterQuery{Server: clusterName})
+				_, err := clusterIf.Delete(context.Background(), &cluster.ClusterQuery{Server: clusterName})
 				errors.CheckError(err)
 			}
 		},
@@ -299,76 +237,22 @@ func NewClusterRemoveCommand(clientOpts *argocdclient.ClientOptions) *cobra.Comm
 	return command
 }
 
-// Print table of cluster information
-func printClusterTable(clusters []argoappv1.Cluster) {
-	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
-	_, _ = fmt.Fprintf(w, "SERVER\tNAME\tVERSION\tSTATUS\tMESSAGE\n")
-	for _, c := range clusters {
-		server := c.Server
-		if len(c.Namespaces) > 0 {
-			server = fmt.Sprintf("%s (%d namespaces)", c.Server, len(c.Namespaces))
-		}
-		_, _ = fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n", server, c.Name, c.ServerVersion, c.ConnectionState.Status, c.ConnectionState.Message)
-	}
-	_ = w.Flush()
-}
-
-// Print list of cluster servers
-func printClusterServers(clusters []argoappv1.Cluster) {
-	for _, c := range clusters {
-		fmt.Println(c.Server)
-	}
-}
-
 // NewClusterListCommand returns a new instance of an `argocd cluster rm` command
 func NewClusterListCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		output string
-	)
 	var command = &cobra.Command{
 		Use:   "list",
 		Short: "List configured clusters",
 		Run: func(c *cobra.Command, args []string) {
 			conn, clusterIf := argocdclient.NewClientOrDie(clientOpts).NewClusterClientOrDie()
 			defer util.Close(conn)
-			clusters, err := clusterIf.List(context.Background(), &clusterpkg.ClusterQuery{})
+			clusters, err := clusterIf.List(context.Background(), &cluster.ClusterQuery{})
 			errors.CheckError(err)
-			switch output {
-			case "yaml", "json":
-				err := PrintResourceList(clusters.Items, output, false)
-				errors.CheckError(err)
-			case "server":
-				printClusterServers(clusters.Items)
-			case "wide", "":
-				printClusterTable(clusters.Items)
-			default:
-				errors.CheckError(fmt.Errorf("unknown output format: %s", output))
+			w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
+			fmt.Fprintf(w, "SERVER\tNAME\tSTATUS\tMESSAGE\n")
+			for _, c := range clusters.Items {
+				fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", c.Server, c.Name, c.ConnectionState.Status, c.ConnectionState.Message)
 			}
-		},
-	}
-	command.Flags().StringVarP(&output, "output", "o", "wide", "Output format. One of: json|yaml|wide|server")
-	return command
-}
-
-// NewClusterRotateAuthCommand returns a new instance of an `argocd cluster rotate-auth` command
-func NewClusterRotateAuthCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var command = &cobra.Command{
-		Use:     "rotate-auth SERVER",
-		Short:   fmt.Sprintf("%s cluster rotate-auth SERVER", cliName),
-		Example: fmt.Sprintf("%s cluster rotate-auth https://12.34.567.89", cliName),
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) != 1 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-			conn, clusterIf := argocdclient.NewClientOrDie(clientOpts).NewClusterClientOrDie()
-			defer util.Close(conn)
-			clusterQuery := clusterpkg.ClusterQuery{
-				Server: args[0],
-			}
-			_, err := clusterIf.RotateAuth(context.Background(), &clusterQuery)
-			errors.CheckError(err)
-			fmt.Printf("Cluster '%s' rotated auth\n", clusterQuery.Server)
+			_ = w.Flush()
 		},
 	}
 	return command

cmd/argocd/commands/cluster_test.go

@@ -1,31 +0,0 @@
-package commands
-
-import (
-	"testing"
-
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-)
-
-func Test_printClusterTable(t *testing.T) {
-	printClusterTable([]v1alpha1.Cluster{
-		{
-			Server: "my-server",
-			Name:   "my-name",
-			Config: v1alpha1.ClusterConfig{
-				Username:        "my-username",
-				Password:        "my-password",
-				BearerToken:     "my-bearer-token",
-				TLSClientConfig: v1alpha1.TLSClientConfig{},
-				AWSAuthConfig:   nil,
-			},
-			ConnectionState: v1alpha1.ConnectionState{
-				Status:     "my-status",
-				Message:    "my-message",
-				ModifiedAt: &metav1.Time{},
-			},
-			ServerVersion: "my-version",
-		},
-	})
-}

cmd/argocd/commands/common.go

@@ -1,13 +1,5 @@
 package commands
 
-import (
-	"encoding/json"
-	"fmt"
-	"reflect"
-
-	"github.com/ghodss/yaml"
-)
-
 const (
 	cliName = "argocd"
 
@@ -15,58 +7,3 @@ const (
 	// the OAuth2 login flow.
 	DefaultSSOLocalPort = 8085
 )
-
-// PrintResource prints a single resource in YAML or JSON format to stdout according to the output format
-func PrintResource(resource interface{}, output string) error {
-	switch output {
-	case "json":
-		jsonBytes, err := json.MarshalIndent(resource, "", "  ")
-		if err != nil {
-			return err
-		}
-		fmt.Println(string(jsonBytes))
-	case "yaml":
-		yamlBytes, err := yaml.Marshal(resource)
-		if err != nil {
-			return err
-		}
-		fmt.Print(string(yamlBytes))
-	default:
-		return fmt.Errorf("unknown output format: %s", output)
-	}
-	return nil
-}
-
-// PrintResourceList marshals & prints a list of resources to stdout according to the output format
-func PrintResourceList(resources interface{}, output string, single bool) error {
-	kt := reflect.ValueOf(resources)
-	// Sometimes, we want to marshal the first resource of a slice or array as single item
-	if kt.Kind() == reflect.Slice || kt.Kind() == reflect.Array {
-		if single && kt.Len() == 1 {
-			return PrintResource(kt.Index(0).Interface(), output)
-		}
-
-		// If we have a zero len list, prevent printing "null"
-		if kt.Len() == 0 {
-			return PrintResource([]string{}, output)
-		}
-	}
-
-	switch output {
-	case "json":
-		jsonBytes, err := json.MarshalIndent(resources, "", "  ")
-		if err != nil {
-			return err
-		}
-		fmt.Println(string(jsonBytes))
-	case "yaml":
-		yamlBytes, err := yaml.Marshal(resources)
-		if err != nil {
-			return err
-		}
-		fmt.Print(string(yamlBytes))
-	default:
-		return fmt.Errorf("unknown output format: %s", output)
-	}
-	return nil
-}

cmd/argocd/commands/common_test.go

@@ -1,142 +0,0 @@
-package commands
-
-import (
-	"io/ioutil"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// Be careful with tabs vs. spaces in the following expected formats. Indents
-// should all be spaces, no tabs.
-const expectYamlSingle = `bar: ""
-baz: foo
-foo: bar
-`
-
-const expectJsonSingle = `{
-  "bar": "",
-  "baz": "foo",
-  "foo": "bar"
-}
-`
-const expectYamlList = `one:
-  bar: ""
-  baz: foo
-  foo: bar
-two:
-  bar: ""
-  baz: foo
-  foo: bar
-`
-
-const expectJsonList = `{
-  "one": {
-    "bar": "",
-    "baz": "foo",
-    "foo": "bar"
-  },
-  "two": {
-    "bar": "",
-    "baz": "foo",
-    "foo": "bar"
-  }
-}
-`
-
-// Rather dirty hack to capture stdout from PrintResource() and PrintResourceList()
-func captureOutput(f func() error) (string, error) {
-	stdout := os.Stdout
-	r, w, err := os.Pipe()
-	if err != nil {
-		return "", err
-	}
-	os.Stdout = w
-	err = f()
-	w.Close()
-	if err != nil {
-		os.Stdout = stdout
-		return "", err
-	}
-	str, err := ioutil.ReadAll(r)
-	os.Stdout = stdout
-	if err != nil {
-		return "", err
-	}
-	return string(str), err
-}
-
-func Test_PrintResource(t *testing.T) {
-	testResource := map[string]string{
-		"foo": "bar",
-		"bar": "",
-		"baz": "foo",
-	}
-
-	str, err := captureOutput(func() error {
-		err := PrintResource(testResource, "yaml")
-		return err
-	})
-	assert.NoError(t, err)
-	assert.Equal(t, str, expectYamlSingle)
-
-	str, err = captureOutput(func() error {
-		err := PrintResource(testResource, "json")
-		return err
-	})
-	assert.NoError(t, err)
-	assert.Equal(t, str, expectJsonSingle)
-
-	err = PrintResource(testResource, "unknown")
-	assert.Error(t, err)
-}
-
-func Test_PrintResourceList(t *testing.T) {
-	testResource := map[string]map[string]string{
-		"one": {
-			"foo": "bar",
-			"bar": "",
-			"baz": "foo",
-		},
-		"two": {
-			"foo": "bar",
-			"bar": "",
-			"baz": "foo",
-		},
-	}
-
-	testResource2 := make([]map[string]string, 0)
-	testResource2 = append(testResource2, testResource["one"])
-
-	str, err := captureOutput(func() error {
-		err := PrintResourceList(testResource, "yaml", false)
-		return err
-	})
-	assert.NoError(t, err)
-	assert.Equal(t, str, expectYamlList)
-
-	str, err = captureOutput(func() error {
-		err := PrintResourceList(testResource, "json", false)
-		return err
-	})
-	assert.NoError(t, err)
-	assert.Equal(t, str, expectJsonList)
-
-	str, err = captureOutput(func() error {
-		err := PrintResourceList(testResource2, "yaml", true)
-		return err
-	})
-	assert.NoError(t, err)
-	assert.Equal(t, str, expectYamlSingle)
-
-	str, err = captureOutput(func() error {
-		err := PrintResourceList(testResource2, "json", true)
-		return err
-	})
-	assert.NoError(t, err)
-	assert.Equal(t, str, expectJsonSingle)
-
-	err = PrintResourceList(testResource, "unknown", false)
-	assert.Error(t, err)
-}

cmd/argocd/commands/completion.go

@@ -1,233 +0,0 @@
-package commands
-
-import (
-	"fmt"
-	"io"
-	"log"
-	"os"
-
-	"github.com/spf13/cobra"
-)
-
-const (
-	bashCompletionFunc = `
-__argocd_list_apps() {
-	local -a argocd_out
-	if argocd_out=($(argocd app list --output name 2>/dev/null)); then
-		COMPREPLY+=( $( compgen -W "${argocd_out[*]}" -- "$cur" ) )
-	fi
-}
-
-__argocd_list_app_history() {
-	local app=$1
-	local -a argocd_out
-	if argocd_out=($(argocd app history $app --output id 2>/dev/null)); then
-		COMPREPLY+=( $( compgen -W "${argocd_out[*]}" -- "$cur" ) )
-	fi
-}
-
-__argocd_app_rollback() {
-	local -a command
-	for comp_word in "${COMP_WORDS[@]}"; do
-		if [[ $comp_word =~ ^-.*$ ]]; then
-			continue
-		fi
-		command+=($comp_word)
-	done
-
-	# fourth arg is app (if present): e.g.- argocd app rollback guestbook
-	local app=${command[3]}
-	local id=${command[4]}
-	if [[ -z $app || $app == $cur ]]; then
-		__argocd_list_apps
-	elif [[ -z $id || $id == $cur ]]; then
-		__argocd_list_app_history $app
-	fi
-}
-
-__argocd_list_servers() {
-	local -a argocd_out
-	if argocd_out=($(argocd cluster list --output server 2>/dev/null)); then
-		COMPREPLY+=( $( compgen -W "${argocd_out[*]}" -- "$cur" ) )
-	fi
-}
-
-__argocd_list_repos() {
-	local -a argocd_out
-	if argocd_out=($(argocd repo list --output url 2>/dev/null)); then
-		COMPREPLY+=( $( compgen -W "${argocd_out[*]}" -- "$cur" ) )
-	fi
-}
-
-__argocd_list_projects() {
-	local -a argocd_out
-	if argocd_out=($(argocd proj list --output name 2>/dev/null)); then
-		COMPREPLY+=( $( compgen -W "${argocd_out[*]}" -- "$cur" ) )
-	fi
-}
-
-__argocd_list_namespaces() {
-	local -a argocd_out
-	if argocd_out=($(kubectl get namespaces --no-headers 2>/dev/null | cut -f1 -d' ' 2>/dev/null)); then
-		COMPREPLY+=( $( compgen -W "${argocd_out[*]}" -- "$cur" ) )
-	fi
-}
-
-__argocd_proj_server_namespace() {
-	local -a command
-	for comp_word in "${COMP_WORDS[@]}"; do
-		if [[ $comp_word =~ ^-.*$ ]]; then
-			continue
-		fi
-		command+=($comp_word)
-	done
-
-	# expect something like this: argocd proj add-destination PROJECT SERVER NAMESPACE
-	local project=${command[3]}
-	local server=${command[4]}
-	local namespace=${command[5]}
-	if [[ -z $project || $project == $cur ]]; then
-		__argocd_list_projects
-	elif [[ -z $server || $server == $cur ]]; then
-		__argocd_list_servers
-	elif [[ -z $namespace || $namespace == $cur ]]; then
-		__argocd_list_namespaces
-	fi
-}
-
-__argocd_list_project_role() {
-	local project="$1"
-	local -a argocd_out
-	if argocd_out=($(argocd proj role list "$project" --output=name 2>/dev/null)); then
-		COMPREPLY+=( $( compgen -W "${argocd_out[*]}" -- "$cur" ) )
-	fi
-}
-
-__argocd_proj_role(){
-	local -a command
-	for comp_word in "${COMP_WORDS[@]}"; do
-		if [[ $comp_word =~ ^-.*$ ]]; then
-			continue
-		fi
-		command+=($comp_word)
-	done
-
-	# expect something like this: argocd proj role add-policy PROJECT ROLE-NAME
-	local project=${command[4]}
-	local role=${command[5]}
-	if [[ -z $project || $project == $cur ]]; then
-		__argocd_list_projects
-	elif [[ -z $role || $role == $cur ]]; then
-		__argocd_list_project_role $project
-	fi
-}
-
-__argocd_custom_func() {
-	case ${last_command} in
-		argocd_app_delete | \
-		argocd_app_diff | \
-		argocd_app_edit | \
-		argocd_app_get | \
-		argocd_app_history | \
-		argocd_app_manifests | \
-		argocd_app_patch-resource | \
-		argocd_app_set | \
-		argocd_app_sync | \
-		argocd_app_terminate-op | \
-		argocd_app_unset | \
-		argocd_app_wait | \
-		argocd_app_create)
-			__argocd_list_apps
-			return
-			;;
-		argocd_app_rollback)
-			__argocd_app_rollback
-			return
-			;;
-		argocd_cluster_get | \
-		argocd_cluster_rm | \
-		argocd_login | \
-		argocd_cluster_add)
-			__argocd_list_servers
-			return
-			;;
-		argocd_repo_rm | \
-		argocd_repo_add)
-			__argocd_list_repos
-			return
-			;;
-		argocd_proj_add-destination | \
-		argocd_proj_remove-destination)
-			__argocd_proj_server_namespace
-			return
-			;;
-		argocd_proj_add-source | \
-		argocd_proj_remove-source | \
-		argocd_proj_allow-cluster-resource | \
-		argocd_proj_allow-namespace-resource | \
-		argocd_proj_deny-cluster-resource | \
-		argocd_proj_deny-namespace-resource | \
-		argocd_proj_delete | \
-		argocd_proj_edit | \
-		argocd_proj_get | \
-		argocd_proj_set | \
-		argocd_proj_role_list)
-			__argocd_list_projects
-			return
-			;;
-		argocd_proj_role_remove-policy | \
-		argocd_proj_role_add-policy | \
-		argocd_proj_role_create | \
-		argocd_proj_role_delete | \
-		argocd_proj_role_get | \
-		argocd_proj_role_create-token | \
-		argocd_proj_role_delete-token)
-			__argocd_proj_role
-			return
-			;;
-		*)
-			;;
-	esac
-}
-	`
-)
-
-func NewCompletionCommand() *cobra.Command {
-	var command = &cobra.Command{
-		Use:   "completion SHELL",
-		Short: "output shell completion code for the specified shell (bash or zsh)",
-		Long: `Write bash or zsh shell completion code to standard output.
-
-For bash, ensure you have bash completions installed and enabled.
-To access completions in your current shell, run
-$ source <(argocd completion bash)
-Alternatively, write it to a file and source in .bash_profile
-
-For zsh, output to a file in a directory referenced by the $fpath shell
-variable.
-`,
-		Run: func(cmd *cobra.Command, args []string) {
-			if len(args) != 1 {
-				cmd.HelpFunc()(cmd, args)
-				os.Exit(1)
-			}
-			shell := args[0]
-			rootCommand := NewCommand()
-			rootCommand.BashCompletionFunction = bashCompletionFunc
-			availableCompletions := map[string]func(io.Writer) error{
-				"bash": rootCommand.GenBashCompletion,
-				"zsh":  rootCommand.GenZshCompletion,
-			}
-			completion, ok := availableCompletions[shell]
-			if !ok {
-				fmt.Printf("Invalid shell '%s'. The supported shells are bash and zsh.\n", shell)
-				os.Exit(1)
-			}
-			if err := completion(os.Stdout); err != nil {
-				log.Fatal(err)
-			}
-		},
-	}
-
-	return command
-}

cmd/argocd/commands/context.go

@@ -18,33 +18,16 @@ import (
 
 // NewContextCommand returns a new instance of an `argocd ctx` command
 func NewContextCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var delete bool
 	var command = &cobra.Command{
-		Use:     "context [CONTEXT]",
+		Use:     "context",
 		Aliases: []string{"ctx"},
 		Short:   "Switch between contexts",
 		Run: func(c *cobra.Command, args []string) {
-
-			localCfg, err := localconfig.ReadLocalConfig(clientOpts.ConfigPath)
-			errors.CheckError(err)
-
-			if delete {
-				if len(args) == 0 {
-					c.HelpFunc()(c, args)
-					os.Exit(1)
-				}
-				err := deleteContext(args[0], clientOpts.ConfigPath)
-				errors.CheckError(err)
-				return
-			}
-
 			if len(args) == 0 {
 				printArgoCDContexts(clientOpts.ConfigPath)
 				return
 			}
-
 			ctxName := args[0]
-
 			argoCDDir, err := localconfig.DefaultConfigDir()
 			errors.CheckError(err)
 			prevCtxFile := path.Join(argoCDDir, ".prev-ctx")
@@ -54,6 +37,8 @@ func NewContextCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 				errors.CheckError(err)
 				ctxName = string(prevCtxBytes)
 			}
+			localCfg, err := localconfig.ReadLocalConfig(clientOpts.ConfigPath)
+			errors.CheckError(err)
 			if localCfg.CurrentContext == ctxName {
 				fmt.Printf("Already at context '%s'\n", localCfg.CurrentContext)
 				return
@@ -63,7 +48,6 @@ func NewContextCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 			}
 			prevCtx := localCfg.CurrentContext
 			localCfg.CurrentContext = ctxName
-
 			err = localconfig.WriteLocalConfig(*localCfg, clientOpts.ConfigPath)
 			errors.CheckError(err)
 			err = ioutil.WriteFile(prevCtxFile, []byte(prevCtx), 0644)
@@ -71,43 +55,9 @@ func NewContextCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 			fmt.Printf("Switched to context '%s'\n", localCfg.CurrentContext)
 		},
 	}
-	command.Flags().BoolVar(&delete, "delete", false, "Delete the context instead of switching to it")
 	return command
 }
 
-func deleteContext(context, configPath string) error {
-
-	localCfg, err := localconfig.ReadLocalConfig(configPath)
-	errors.CheckError(err)
-	if localCfg == nil {
-		return fmt.Errorf("Nothing to logout from")
-	}
-
-	serverName, ok := localCfg.RemoveContext(context)
-	if !ok {
-		return fmt.Errorf("Context %s does not exist", context)
-	}
-	_ = localCfg.RemoveUser(context)
-	_ = localCfg.RemoveServer(serverName)
-
-	if localCfg.IsEmpty() {
-		err = localconfig.DeleteLocalConfig(configPath)
-		errors.CheckError(err)
-	} else {
-		if localCfg.CurrentContext == context {
-			localCfg.CurrentContext = ""
-		}
-		err = localconfig.ValidateLocalConfig(*localCfg)
-		if err != nil {
-			return fmt.Errorf("Error in logging out")
-		}
-		err = localconfig.WriteLocalConfig(*localCfg, configPath)
-		errors.CheckError(err)
-	}
-	fmt.Printf("Context '%s' deleted\n", context)
-	return nil
-}
-
 func printArgoCDContexts(configPath string) {
 	localCfg, err := localconfig.ReadLocalConfig(configPath)
 	errors.CheckError(err)

cmd/argocd/commands/context_test.go

@@ -1,81 +0,0 @@
-package commands
-
-import (
-	"io/ioutil"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/argoproj/argo-cd/util/localconfig"
-)
-
-const testConfig = `contexts:
-- name: argocd1.example.com:443
-  server: argocd1.example.com:443
-  user: argocd1.example.com:443
-- name: argocd2.example.com:443
-  server: argocd2.example.com:443
-  user: argocd2.example.com:443
-- name: localhost:8080
-  server: localhost:8080
-  user: localhost:8080
-current-context: localhost:8080
-servers:
-- server: argocd1.example.com:443
-- server: argocd2.example.com:443
-- plain-text: true
-  server: localhost:8080
-users:
-- auth-token: vErrYS3c3tReFRe$hToken
-  name: argocd1.example.com:443
-  refresh-token: vErrYS3c3tReFRe$hToken
-- auth-token: vErrYS3c3tReFRe$hToken
-  name: argocd2.example.com:443
-  refresh-token: vErrYS3c3tReFRe$hToken
-- auth-token: vErrYS3c3tReFRe$hToken
-  name: localhost:8080`
-
-const testConfigFilePath = "./testdata/config"
-
-func TestContextDelete(t *testing.T) {
-
-	// Write the test config file
-	err := ioutil.WriteFile(testConfigFilePath, []byte(testConfig), os.ModePerm)
-	assert.NoError(t, err)
-
-	localConfig, err := localconfig.ReadLocalConfig(testConfigFilePath)
-	assert.NoError(t, err)
-	assert.Equal(t, localConfig.CurrentContext, "localhost:8080")
-	assert.Contains(t, localConfig.Contexts, localconfig.ContextRef{Name: "localhost:8080", Server: "localhost:8080", User: "localhost:8080"})
-
-	// Delete a non-current context
-	err = deleteContext("argocd1.example.com:443", testConfigFilePath)
-	assert.NoError(t, err)
-
-	localConfig, err = localconfig.ReadLocalConfig(testConfigFilePath)
-	assert.NoError(t, err)
-	assert.Equal(t, localConfig.CurrentContext, "localhost:8080")
-	assert.NotContains(t, localConfig.Contexts, localconfig.ContextRef{Name: "argocd1.example.com:443", Server: "argocd1.example.com:443", User: "argocd1.example.com:443"})
-	assert.NotContains(t, localConfig.Servers, localconfig.Server{Server: "argocd1.example.com:443"})
-	assert.NotContains(t, localConfig.Users, localconfig.User{AuthToken: "vErrYS3c3tReFRe$hToken", Name: "argocd1.example.com:443"})
-	assert.Contains(t, localConfig.Contexts, localconfig.ContextRef{Name: "argocd2.example.com:443", Server: "argocd2.example.com:443", User: "argocd2.example.com:443"})
-	assert.Contains(t, localConfig.Contexts, localconfig.ContextRef{Name: "localhost:8080", Server: "localhost:8080", User: "localhost:8080"})
-
-	// Delete the current context
-	err = deleteContext("localhost:8080", testConfigFilePath)
-	assert.NoError(t, err)
-
-	localConfig, err = localconfig.ReadLocalConfig(testConfigFilePath)
-	assert.NoError(t, err)
-	assert.Equal(t, localConfig.CurrentContext, "")
-	assert.NotContains(t, localConfig.Contexts, localconfig.ContextRef{Name: "localhost:8080", Server: "localhost:8080", User: "localhost:8080"})
-	assert.NotContains(t, localConfig.Servers, localconfig.Server{PlainText: true, Server: "localhost:8080"})
-	assert.NotContains(t, localConfig.Users, localconfig.User{AuthToken: "vErrYS3c3tReFRe$hToken", Name: "localhost:8080"})
-	assert.Contains(t, localConfig.Contexts, localconfig.ContextRef{Name: "argocd2.example.com:443", Server: "argocd2.example.com:443", User: "argocd2.example.com:443"})
-
-	// Write the file again so that no conflicts are made in git
-	err = ioutil.WriteFile(testConfigFilePath, []byte(testConfig), os.ModePerm)
-	assert.NoError(t, err)
-
-}

cmd/argocd/commands/login.go

@@ -6,11 +6,10 @@ import (
 	"net/http"
 	"os"
 	"strconv"
-	"strings"
 	"time"
 
-	"github.com/coreos/go-oidc"
-	"github.com/dgrijalva/jwt-go"
+	oidc "github.com/coreos/go-oidc"
+	jwt "github.com/dgrijalva/jwt-go"
 	log "github.com/sirupsen/logrus"
 	"github.com/skratchdot/open-golang/open"
 	"github.com/spf13/cobra"
@@ -18,8 +17,8 @@ import (
 
 	"github.com/argoproj/argo-cd/errors"
 	argocdclient "github.com/argoproj/argo-cd/pkg/apiclient"
-	sessionpkg "github.com/argoproj/argo-cd/pkg/apiclient/session"
-	settingspkg "github.com/argoproj/argo-cd/pkg/apiclient/settings"
+	"github.com/argoproj/argo-cd/server/session"
+	"github.com/argoproj/argo-cd/server/settings"
 	"github.com/argoproj/argo-cd/util"
 	"github.com/argoproj/argo-cd/util/cli"
 	grpc_util "github.com/argoproj/argo-cd/util/grpc"
@@ -65,12 +64,11 @@ func NewLoginCommand(globalClientOpts *argocdclient.ClientOptions) *cobra.Comman
 				}
 			}
 			clientOpts := argocdclient.ClientOptions{
-				ConfigPath:      "",
-				ServerAddr:      server,
-				Insecure:        globalClientOpts.Insecure,
-				PlainText:       globalClientOpts.PlainText,
-				GRPCWeb:         globalClientOpts.GRPCWeb,
-				GRPCWebRootPath: globalClientOpts.GRPCWebRootPath,
+				ConfigPath: "",
+				ServerAddr: server,
+				Insecure:   globalClientOpts.Insecure,
+				PlainText:  globalClientOpts.PlainText,
+				GRPCWeb:    globalClientOpts.GRPCWeb,
 			}
 			acdClient := argocdclient.NewClientOrDie(&clientOpts)
 			setConn, setIf := acdClient.NewSettingsClientOrDie()
@@ -78,10 +76,6 @@ func NewLoginCommand(globalClientOpts *argocdclient.ClientOptions) *cobra.Comman
 
 			if ctxName == "" {
 				ctxName = server
-				if globalClientOpts.GRPCWebRootPath != "" {
-					rootPath := strings.TrimRight(strings.TrimLeft(globalClientOpts.GRPCWebRootPath, "/"), "/")
-					ctxName = fmt.Sprintf("%s/%s", server, rootPath)
-				}
 			}
 
 			// Perform the login
@@ -94,11 +88,11 @@ func NewLoginCommand(globalClientOpts *argocdclient.ClientOptions) *cobra.Comman
 				httpClient, err := acdClient.HTTPClient()
 				errors.CheckError(err)
 				ctx = oidc.ClientContext(ctx, httpClient)
-				acdSet, err := setIf.Get(ctx, &settingspkg.SettingsQuery{})
+				acdSet, err := setIf.Get(ctx, &settings.SettingsQuery{})
 				errors.CheckError(err)
 				oauth2conf, provider, err := acdClient.OIDCConfig(ctx, acdSet)
 				errors.CheckError(err)
-				tokenString, refreshToken = oauth2Login(ctx, ssoPort, acdSet.GetOIDCConfig(), oauth2conf, provider)
+				tokenString, refreshToken = oauth2Login(ctx, ssoPort, oauth2conf, provider)
 			}
 
 			parser := &jwt.Parser{
@@ -116,11 +110,10 @@ func NewLoginCommand(globalClientOpts *argocdclient.ClientOptions) *cobra.Comman
 				localCfg = &localconfig.LocalConfig{}
 			}
 			localCfg.UpsertServer(localconfig.Server{
-				Server:          server,
-				PlainText:       globalClientOpts.PlainText,
-				Insecure:        globalClientOpts.Insecure,
-				GRPCWeb:         globalClientOpts.GRPCWeb,
-				GRPCWebRootPath: globalClientOpts.GRPCWebRootPath,
+				Server:    server,
+				PlainText: globalClientOpts.PlainText,
+				Insecure:  globalClientOpts.Insecure,
+				GRPCWeb:   globalClientOpts.GRPCWeb,
 			})
 			localCfg.UpsertUser(localconfig.User{
 				Name:         ctxName,
@@ -161,7 +154,7 @@ func userDisplayName(claims jwt.MapClaims) string {
 
 // oauth2Login opens a browser, runs a temporary HTTP server to delegate OAuth2 login flow and
 // returns the JWT token and a refresh token (if supported)
-func oauth2Login(ctx context.Context, port int, oidcSettings *settingspkg.OIDCConfig, oauth2conf *oauth2.Config, provider *oidc.Provider) (string, string) {
+func oauth2Login(ctx context.Context, port int, oauth2conf *oauth2.Config, provider *oidc.Provider) (string, string) {
 	oauth2conf.RedirectURL = fmt.Sprintf("http://localhost:%d/auth/callback", port)
 	oidcConf, err := oidcutil.ParseConfig(provider)
 	errors.CheckError(err)
@@ -240,7 +233,7 @@ func oauth2Login(ctx context.Context, port int, oidcSettings *settingspkg.OIDCCo
 		<p style="margin-top:20px; font-size:18; text-align:center">Authentication was successful, you can now return to CLI. This page will close automatically</p>
 		<script>window.onload=function(){setTimeout(this.close, 4000)}</script>
 		`
-		fmt.Fprint(w, successPage)
+		fmt.Fprintf(w, successPage)
 		completionChan <- ""
 	}
 	srv := &http.Server{Addr: "localhost:" + strconv.Itoa(port)}
@@ -250,28 +243,22 @@ func oauth2Login(ctx context.Context, port int, oidcSettings *settingspkg.OIDCCo
 	fmt.Printf("Opening browser for authentication\n")
 
 	var url string
-	grantType := oidcutil.InferGrantType(oidcConf)
-	opts := []oauth2.AuthCodeOption{oauth2.AccessTypeOffline}
-	if claimsRequested := oidcSettings.GetIDTokenClaims(); claimsRequested != nil {
-		opts = oidcutil.AppendClaimsAuthenticationRequestParameter(opts, claimsRequested)
-	}
-
+	grantType := oidcutil.InferGrantType(oauth2conf, oidcConf)
 	switch grantType {
 	case oidcutil.GrantTypeAuthorizationCode:
-		url = oauth2conf.AuthCodeURL(stateNonce, opts...)
+		url = oauth2conf.AuthCodeURL(stateNonce, oauth2.AccessTypeOffline)
 	case oidcutil.GrantTypeImplicit:
-		url = oidcutil.ImplicitFlowURL(oauth2conf, stateNonce, opts...)
+		url = oidcutil.ImplicitFlowURL(oauth2conf, stateNonce, oauth2.AccessTypeOffline)
 	default:
 		log.Fatalf("Unsupported grant type: %v", grantType)
 	}
 	fmt.Printf("Performing %s flow login: %s\n", grantType, url)
 	time.Sleep(1 * time.Second)
-	err = open.Start(url)
+	err = open.Run(url)
 	errors.CheckError(err)
 	go func() {
-		log.Debugf("Listen: %s", srv.Addr)
 		if err := srv.ListenAndServe(); err != http.ErrServerClosed {
-			log.Fatalf("Temporary HTTP server failed: %s", err)
+			log.Fatalf("listen: %s\n", err)
 		}
 	}()
 	errMsg := <-completionChan
@@ -291,7 +278,7 @@ func passwordLogin(acdClient argocdclient.Client, username, password string) str
 	username, password = cli.PromptCredentials(username, password)
 	sessConn, sessionIf := acdClient.NewSessionClientOrDie()
 	defer util.Close(sessConn)
-	sessionRequest := sessionpkg.SessionCreateRequest{
+	sessionRequest := session.SessionCreateRequest{
 		Username: username,
 		Password: password,
 	}

cmd/argocd/commands/logout.go

@@ -1,50 +0,0 @@
-package commands
-
-import (
-	"fmt"
-	"os"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-
-	"github.com/argoproj/argo-cd/errors"
-	argocdclient "github.com/argoproj/argo-cd/pkg/apiclient"
-	"github.com/argoproj/argo-cd/util/localconfig"
-)
-
-// NewLogoutCommand returns a new instance of `argocd logout` command
-func NewLogoutCommand(globalClientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var command = &cobra.Command{
-		Use:   "logout CONTEXT",
-		Short: "Log out from Argo CD",
-		Long:  "Log out from Argo CD",
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) == 0 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-			context := args[0]
-
-			localCfg, err := localconfig.ReadLocalConfig(globalClientOpts.ConfigPath)
-			errors.CheckError(err)
-			if localCfg == nil {
-				log.Fatalf("Nothing to logout from")
-			}
-
-			ok := localCfg.RemoveToken(context)
-			if !ok {
-				log.Fatalf("Context %s does not exist", context)
-			}
-
-			err = localconfig.ValidateLocalConfig(*localCfg)
-			if err != nil {
-				log.Fatalf("Error in logging out: %s", err)
-			}
-			err = localconfig.WriteLocalConfig(*localCfg, globalClientOpts.ConfigPath)
-			errors.CheckError(err)
-
-			fmt.Printf("Logged out from '%s'\n", context)
-		},
-	}
-	return command
-}

cmd/argocd/commands/logout_test.go

@@ -1,41 +0,0 @@
-package commands
-
-import (
-	"io/ioutil"
-	"os"
-	"testing"
-
-	"github.com/argoproj/argo-cd/pkg/apiclient"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/argoproj/argo-cd/util/localconfig"
-)
-
-func TestLogout(t *testing.T) {
-
-	// Write the test config file
-	err := ioutil.WriteFile(testConfigFilePath, []byte(testConfig), os.ModePerm)
-	assert.NoError(t, err)
-
-	localConfig, err := localconfig.ReadLocalConfig(testConfigFilePath)
-	assert.NoError(t, err)
-	assert.Equal(t, localConfig.CurrentContext, "localhost:8080")
-	assert.Contains(t, localConfig.Contexts, localconfig.ContextRef{Name: "localhost:8080", Server: "localhost:8080", User: "localhost:8080"})
-
-	command := NewLogoutCommand(&apiclient.ClientOptions{ConfigPath: testConfigFilePath})
-	command.Run(nil, []string{"localhost:8080"})
-
-	localConfig, err = localconfig.ReadLocalConfig(testConfigFilePath)
-	assert.NoError(t, err)
-	assert.Equal(t, localConfig.CurrentContext, "localhost:8080")
-	assert.NotContains(t, localConfig.Users, localconfig.User{AuthToken: "vErrYS3c3tReFRe$hToken", Name: "localhost:8080"})
-	assert.Contains(t, localConfig.Contexts, localconfig.ContextRef{Name: "argocd1.example.com:443", Server: "argocd1.example.com:443", User: "argocd1.example.com:443"})
-	assert.Contains(t, localConfig.Contexts, localconfig.ContextRef{Name: "argocd2.example.com:443", Server: "argocd2.example.com:443", User: "argocd2.example.com:443"})
-	assert.Contains(t, localConfig.Contexts, localconfig.ContextRef{Name: "localhost:8080", Server: "localhost:8080", User: "localhost:8080"})
-
-	// Write the file again so that no conflicts are made in git
-	err = ioutil.WriteFile(testConfigFilePath, []byte(testConfig), os.ModePerm)
-	assert.NoError(t, err)
-
-}

cmd/argocd/commands/project.go

@@ -1,12 +1,10 @@
 package commands
 
 import (
-	"bufio"
 	"context"
 	"encoding/json"
 	"fmt"
 	"io"
-	"net/url"
 	"os"
 	"strings"
 	"text/tabwriter"
@@ -18,24 +16,20 @@ import (
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/utils/pointer"
 
 	"github.com/argoproj/argo-cd/errors"
 	argocdclient "github.com/argoproj/argo-cd/pkg/apiclient"
-	projectpkg "github.com/argoproj/argo-cd/pkg/apiclient/project"
 	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
+	"github.com/argoproj/argo-cd/server/project"
 	"github.com/argoproj/argo-cd/util"
 	"github.com/argoproj/argo-cd/util/cli"
-	"github.com/argoproj/argo-cd/util/config"
 	"github.com/argoproj/argo-cd/util/git"
 )
 
 type projectOpts struct {
-	description              string
-	destinations             []string
-	sources                  []string
-	orphanedResourcesEnabled bool
-	orphanedResourcesWarn    bool
+	description  string
+	destinations []string
+	sources      []string
 }
 
 type policyOpts struct {
@@ -85,7 +79,6 @@ func NewProjectCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	command.AddCommand(NewProjectDenyClusterResourceCommand(clientOpts))
 	command.AddCommand(NewProjectAllowNamespaceResourceCommand(clientOpts))
 	command.AddCommand(NewProjectDenyNamespaceResourceCommand(clientOpts))
-	command.AddCommand(NewProjectWindowsCommand(clientOpts))
 	return command
 }
 
@@ -93,21 +86,7 @@ func addProjFlags(command *cobra.Command, opts *projectOpts) {
 	command.Flags().StringVarP(&opts.description, "description", "", "", "Project description")
 	command.Flags().StringArrayVarP(&opts.destinations, "dest", "d", []string{},
 		"Permitted destination server and namespace (e.g. https://192.168.99.100:8443,default)")
-	command.Flags().StringArrayVarP(&opts.sources, "src", "s", []string{}, "Permitted source repository URL")
-	command.Flags().BoolVar(&opts.orphanedResourcesEnabled, "orphaned-resources", false, "Enables orphaned resources monitoring")
-	command.Flags().BoolVar(&opts.orphanedResourcesWarn, "orphaned-resources-warn", false, "Specifies if applications should be a warning condition when orphaned resources detected")
-}
-
-func getOrphanedResourcesSettings(c *cobra.Command, opts projectOpts) *v1alpha1.OrphanedResourcesMonitorSettings {
-	warnChanged := c.Flag("orphaned-resources-warn").Changed
-	if opts.orphanedResourcesEnabled || warnChanged {
-		settings := v1alpha1.OrphanedResourcesMonitorSettings{}
-		if warnChanged {
-			settings.Warn = pointer.BoolPtr(opts.orphanedResourcesWarn)
-		}
-		return &settings
-	}
-	return nil
+	command.Flags().StringArrayVarP(&opts.sources, "src", "s", []string{}, "Permitted git source repository URL")
 }
 
 func addPolicyFlags(command *cobra.Command, opts *policyOpts) {
@@ -124,63 +103,32 @@ func humanizeTimestamp(epoch int64) string {
 // NewProjectCreateCommand returns a new instance of an `argocd proj create` command
 func NewProjectCreateCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	var (
-		opts    projectOpts
-		fileURL string
-		upsert  bool
+		opts projectOpts
 	)
 	var command = &cobra.Command{
 		Use:   "create PROJECT",
 		Short: "Create a project",
 		Run: func(c *cobra.Command, args []string) {
-			var proj v1alpha1.AppProject
-			if fileURL == "-" {
-				// read stdin
-				reader := bufio.NewReader(os.Stdin)
-				err := config.UnmarshalReader(reader, &proj)
-				if err != nil {
-					log.Fatalf("unable to read manifest from stdin: %v", err)
-				}
-			} else if fileURL != "" {
-				// read uri
-				parsedURL, err := url.ParseRequestURI(fileURL)
-				if err != nil || !(parsedURL.Scheme == "http" || parsedURL.Scheme == "https") {
-					err = config.UnmarshalLocalFile(fileURL, &proj)
-				} else {
-					err = config.UnmarshalRemoteFile(fileURL, &proj)
-				}
-				errors.CheckError(err)
-				if len(args) == 1 && args[0] != proj.Name {
-					log.Fatalf("project name '%s' does not match project spec metadata.name '%s'", args[0], proj.Name)
-				}
-			} else {
-				// read arguments
-				if len(args) == 0 {
-					c.HelpFunc()(c, args)
-					os.Exit(1)
-				}
-				projName := args[0]
-				proj = v1alpha1.AppProject{
-					ObjectMeta: v1.ObjectMeta{Name: projName},
-					Spec: v1alpha1.AppProjectSpec{
-						Description:       opts.description,
-						Destinations:      opts.GetDestinations(),
-						SourceRepos:       opts.sources,
-						OrphanedResources: getOrphanedResourcesSettings(c, opts),
-					},
-				}
+			if len(args) == 0 {
+				c.HelpFunc()(c, args)
+				os.Exit(1)
+			}
+			projName := args[0]
+			proj := v1alpha1.AppProject{
+				ObjectMeta: v1.ObjectMeta{Name: projName},
+				Spec: v1alpha1.AppProjectSpec{
+					Description:  opts.description,
+					Destinations: opts.GetDestinations(),
+					SourceRepos:  opts.sources,
+				},
 			}
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
-			_, err := projIf.Create(context.Background(), &projectpkg.ProjectCreateRequest{Project: &proj, Upsert: upsert})
+
+			_, err := projIf.Create(context.Background(), &project.ProjectCreateRequest{Project: &proj})
 			errors.CheckError(err)
 		},
 	}
-	command.Flags().BoolVar(&upsert, "upsert", false, "Allows to override a project with the same name even if supplied project spec is different from existing spec")
-	command.Flags().StringVarP(&fileURL, "file", "f", "", "Filename or URL to Kubernetes manifests for the project")
-	err := command.Flags().SetAnnotation("file", cobra.BashCompFilenameExt, []string{"json", "yaml", "yml"})
-	if err != nil {
-		log.Fatal(err)
-	}
 	addProjFlags(command, &opts)
 	return command
 }
@@ -202,7 +150,7 @@ func NewProjectSetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
 
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+			proj, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 			errors.CheckError(err)
 
 			visited := 0
@@ -215,8 +163,6 @@ func NewProjectSetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command
 					proj.Spec.Destinations = opts.GetDestinations()
 				case "src":
 					proj.Spec.SourceRepos = opts.sources
-				case "orphaned-resources", "orphaned-resources-warn":
-					proj.Spec.OrphanedResources = getOrphanedResourcesSettings(c, opts)
 				}
 			})
 			if visited == 0 {
@@ -225,7 +171,7 @@ func NewProjectSetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command
 				os.Exit(1)
 			}
 
-			_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
+			_, err = projIf.Update(context.Background(), &project.ProjectUpdateRequest{Project: proj})
 			errors.CheckError(err)
 		},
 	}
@@ -249,7 +195,7 @@ func NewProjectAddDestinationCommand(clientOpts *argocdclient.ClientOptions) *co
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
 
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+			proj, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 			errors.CheckError(err)
 
 			for _, dest := range proj.Spec.Destinations {
@@ -258,7 +204,7 @@ func NewProjectAddDestinationCommand(clientOpts *argocdclient.ClientOptions) *co
 				}
 			}
 			proj.Spec.Destinations = append(proj.Spec.Destinations, v1alpha1.ApplicationDestination{Server: server, Namespace: namespace})
-			_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
+			_, err = projIf.Update(context.Background(), &project.ProjectUpdateRequest{Project: proj})
 			errors.CheckError(err)
 		},
 	}
@@ -281,7 +227,7 @@ func NewProjectRemoveDestinationCommand(clientOpts *argocdclient.ClientOptions)
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
 
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+			proj, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 			errors.CheckError(err)
 
 			index := -1
@@ -295,7 +241,7 @@ func NewProjectRemoveDestinationCommand(clientOpts *argocdclient.ClientOptions)
 				log.Fatal("Specified destination does not exist in project")
 			} else {
 				proj.Spec.Destinations = append(proj.Spec.Destinations[:index], proj.Spec.Destinations[index+1:]...)
-				_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
+				_, err = projIf.Update(context.Background(), &project.ProjectUpdateRequest{Project: proj})
 				errors.CheckError(err)
 			}
 		},
@@ -319,7 +265,7 @@ func NewProjectAddSourceCommand(clientOpts *argocdclient.ClientOptions) *cobra.C
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
 
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+			proj, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 			errors.CheckError(err)
 
 			for _, item := range proj.Spec.SourceRepos {
@@ -333,19 +279,18 @@ func NewProjectAddSourceCommand(clientOpts *argocdclient.ClientOptions) *cobra.C
 				}
 			}
 			proj.Spec.SourceRepos = append(proj.Spec.SourceRepos, url)
-			_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
+			_, err = projIf.Update(context.Background(), &project.ProjectUpdateRequest{Project: proj})
 			errors.CheckError(err)
 		},
 	}
 	return command
 }
 
-func modifyClusterResourceCmd(cmdUse, cmdDesc string, clientOpts *argocdclient.ClientOptions, action func(proj *v1alpha1.AppProject, group string, kind string) bool) *cobra.Command {
+func modifyProjectResourceCmd(cmdUse, cmdDesc string, clientOpts *argocdclient.ClientOptions, action func(proj *v1alpha1.AppProject, group string, kind string) bool) *cobra.Command {
 	return &cobra.Command{
 		Use:   cmdUse,
 		Short: cmdDesc,
 		Run: func(c *cobra.Command, args []string) {
-
 			if len(args) != 3 {
 				c.HelpFunc()(c, args)
 				os.Exit(1)
@@ -354,66 +299,22 @@ func modifyClusterResourceCmd(cmdUse, cmdDesc string, clientOpts *argocdclient.C
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
 
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+			proj, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 			errors.CheckError(err)
 
 			if action(proj, group, kind) {
-				_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
+				_, err = projIf.Update(context.Background(), &project.ProjectUpdateRequest{Project: proj})
 				errors.CheckError(err)
 			}
 		},
 	}
 }
 
-func modifyNamespaceResourceCmd(cmdUse, cmdDesc string, clientOpts *argocdclient.ClientOptions, action func(proj *v1alpha1.AppProject, group string, kind string, useWhitelist bool) bool) *cobra.Command {
-	var (
-		list string
-	)
-	var command = &cobra.Command{
-		Use:   cmdUse,
-		Short: cmdDesc,
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) != 3 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-			projName, group, kind := args[0], args[1], args[2]
-			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
-			defer util.Close(conn)
-
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
-			errors.CheckError(err)
-			var useWhitelist = false
-			if list == "white" {
-				useWhitelist = true
-			}
-			if action(proj, group, kind, useWhitelist) {
-				_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
-				errors.CheckError(err)
-			}
-		},
-	}
-	command.Flags().StringVarP(&list, "list", "l", "black", "Use blacklist or whitelist. This can only be 'white' or 'black'")
-	return command
-}
-
 // NewProjectAllowNamespaceResourceCommand returns a new instance of an `deny-cluster-resources` command
 func NewProjectAllowNamespaceResourceCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	use := "allow-namespace-resource PROJECT GROUP KIND"
-	desc := "Removes a namespaced API resource from the blacklist or add a namespaced API resource to the whitelist"
-
-	return modifyNamespaceResourceCmd(use, desc, clientOpts, func(proj *v1alpha1.AppProject, group string, kind string, useWhitelist bool) bool {
-		if useWhitelist {
-			for _, item := range proj.Spec.NamespaceResourceWhitelist {
-				if item.Group == group && item.Kind == kind {
-					fmt.Printf("Group '%s' and kind '%s' already present in whitelisted namespaced resources\n", group, kind)
-					return false
-				}
-			}
-			proj.Spec.NamespaceResourceWhitelist = append(proj.Spec.NamespaceResourceWhitelist, v1.GroupKind{Group: group, Kind: kind})
-			fmt.Printf("Group '%s' and kind '%s' is added to whitelisted namespaced resources\n", group, kind)
-			return true
-		}
+	desc := "Removes a namespaced API resource from the blacklist"
+	return modifyProjectResourceCmd(use, desc, clientOpts, func(proj *v1alpha1.AppProject, group string, kind string) bool {
 		index := -1
 		for i, item := range proj.Spec.NamespaceResourceBlacklist {
 			if item.Group == group && item.Kind == kind {
@@ -426,7 +327,6 @@ func NewProjectAllowNamespaceResourceCommand(clientOpts *argocdclient.ClientOpti
 			return false
 		}
 		proj.Spec.NamespaceResourceBlacklist = append(proj.Spec.NamespaceResourceBlacklist[:index], proj.Spec.NamespaceResourceBlacklist[index+1:]...)
-		fmt.Printf("Group '%s' and kind '%s' is removed from blacklisted namespaced resources\n", group, kind)
 		return true
 	})
 }
@@ -434,25 +334,8 @@ func NewProjectAllowNamespaceResourceCommand(clientOpts *argocdclient.ClientOpti
 // NewProjectDenyNamespaceResourceCommand returns a new instance of an `argocd proj deny-namespace-resource` command
 func NewProjectDenyNamespaceResourceCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	use := "deny-namespace-resource PROJECT GROUP KIND"
-	desc := "Adds a namespaced API resource to the blacklist or removes a namespaced API resource from the whitelist"
-	return modifyNamespaceResourceCmd(use, desc, clientOpts, func(proj *v1alpha1.AppProject, group string, kind string, useWhitelist bool) bool {
-		if useWhitelist {
-			index := -1
-			for i, item := range proj.Spec.NamespaceResourceWhitelist {
-				if item.Group == group && item.Kind == kind {
-					index = i
-					break
-				}
-			}
-			if index == -1 {
-				fmt.Printf("Group '%s' and kind '%s' not in whitelisted namespaced resources\n", group, kind)
-				return false
-			}
-			proj.Spec.NamespaceResourceWhitelist = append(proj.Spec.NamespaceResourceWhitelist[:index], proj.Spec.NamespaceResourceWhitelist[index+1:]...)
-			fmt.Printf("Group '%s' and kind '%s' is removed from whitelisted namespaced resources\n", group, kind)
-			return true
-		}
-
+	desc := "Adds a namespaced API resource to the blacklist"
+	return modifyProjectResourceCmd(use, desc, clientOpts, func(proj *v1alpha1.AppProject, group string, kind string) bool {
 		for _, item := range proj.Spec.NamespaceResourceBlacklist {
 			if item.Group == group && item.Kind == kind {
 				fmt.Printf("Group '%s' and kind '%s' already present in blacklisted namespaced resources\n", group, kind)
@@ -460,7 +343,6 @@ func NewProjectDenyNamespaceResourceCommand(clientOpts *argocdclient.ClientOptio
 			}
 		}
 		proj.Spec.NamespaceResourceBlacklist = append(proj.Spec.NamespaceResourceBlacklist, v1.GroupKind{Group: group, Kind: kind})
-		fmt.Printf("Group '%s' and kind '%s' is added to blacklisted namespaced resources\n", group, kind)
 		return true
 	})
 }
@@ -469,7 +351,7 @@ func NewProjectDenyNamespaceResourceCommand(clientOpts *argocdclient.ClientOptio
 func NewProjectDenyClusterResourceCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	use := "deny-cluster-resource PROJECT GROUP KIND"
 	desc := "Removes a cluster-scoped API resource from the whitelist"
-	return modifyClusterResourceCmd(use, desc, clientOpts, func(proj *v1alpha1.AppProject, group string, kind string) bool {
+	return modifyProjectResourceCmd(use, desc, clientOpts, func(proj *v1alpha1.AppProject, group string, kind string) bool {
 		index := -1
 		for i, item := range proj.Spec.ClusterResourceWhitelist {
 			if item.Group == group && item.Kind == kind {
@@ -490,7 +372,7 @@ func NewProjectDenyClusterResourceCommand(clientOpts *argocdclient.ClientOptions
 func NewProjectAllowClusterResourceCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	use := "allow-cluster-resource PROJECT GROUP KIND"
 	desc := "Adds a cluster-scoped API resource to the whitelist"
-	return modifyClusterResourceCmd(use, desc, clientOpts, func(proj *v1alpha1.AppProject, group string, kind string) bool {
+	return modifyProjectResourceCmd(use, desc, clientOpts, func(proj *v1alpha1.AppProject, group string, kind string) bool {
 		for _, item := range proj.Spec.ClusterResourceWhitelist {
 			if item.Group == group && item.Kind == kind {
 				fmt.Printf("Group '%s' and kind '%s' already present in whitelisted cluster resources\n", group, kind)
@@ -517,7 +399,7 @@ func NewProjectRemoveSourceCommand(clientOpts *argocdclient.ClientOptions) *cobr
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
 
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+			proj, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 			errors.CheckError(err)
 
 			index := -1
@@ -531,7 +413,7 @@ func NewProjectRemoveSourceCommand(clientOpts *argocdclient.ClientOptions) *cobr
 				fmt.Printf("Source repository '%s' does not exist in project\n", url)
 			} else {
 				proj.Spec.SourceRepos = append(proj.Spec.SourceRepos[:index], proj.Spec.SourceRepos[index+1:]...)
-				_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
+				_, err = projIf.Update(context.Background(), &project.ProjectUpdateRequest{Project: proj})
 				errors.CheckError(err)
 			}
 		},
@@ -553,7 +435,7 @@ func NewProjectDeleteCommand(clientOpts *argocdclient.ClientOptions) *cobra.Comm
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
 			for _, name := range args {
-				_, err := projIf.Delete(context.Background(), &projectpkg.ProjectQuery{Name: name})
+				_, err := projIf.Delete(context.Background(), &project.ProjectQuery{Name: name})
 				errors.CheckError(err)
 			}
 		},
@@ -561,60 +443,27 @@ func NewProjectDeleteCommand(clientOpts *argocdclient.ClientOptions) *cobra.Comm
 	return command
 }
 
-// Print list of project names
-func printProjectNames(projects []v1alpha1.AppProject) {
-	for _, p := range projects {
-		fmt.Println(p.Name)
-	}
-}
-
-// Print table of project info
-func printProjectTable(projects []v1alpha1.AppProject) {
-	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
-	fmt.Fprintf(w, "NAME\tDESCRIPTION\tDESTINATIONS\tSOURCES\tCLUSTER-RESOURCE-WHITELIST\tNAMESPACE-RESOURCE-BLACKLIST\tORPHANED-RESOURCES\n")
-	for _, p := range projects {
-		printProjectLine(w, &p)
-	}
-	_ = w.Flush()
-}
-
 // NewProjectListCommand returns a new instance of an `argocd proj list` command
 func NewProjectListCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		output string
-	)
 	var command = &cobra.Command{
 		Use:   "list",
 		Short: "List projects",
 		Run: func(c *cobra.Command, args []string) {
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
-			projects, err := projIf.List(context.Background(), &projectpkg.ProjectQuery{})
+			projects, err := projIf.List(context.Background(), &project.ProjectQuery{})
 			errors.CheckError(err)
-			switch output {
-			case "yaml", "json":
-				err := PrintResourceList(projects.Items, output, false)
-				errors.CheckError(err)
-			case "name":
-				printProjectNames(projects.Items)
-			case "wide", "":
-				printProjectTable(projects.Items)
-			default:
-				errors.CheckError(fmt.Errorf("unknown output format: %s", output))
+			w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
+			fmt.Fprintf(w, "NAME\tDESCRIPTION\tDESTINATIONS\tSOURCES\tCLUSTER-RESOURCE-WHITELIST\tNAMESPACE-RESOURCE-BLACKLIST\n")
+			for _, p := range projects.Items {
+				printProjectLine(w, &p)
 			}
+			_ = w.Flush()
 		},
 	}
-	command.Flags().StringVarP(&output, "output", "o", "wide", "Output format. One of: json|yaml|wide|name")
 	return command
 }
 
-func formatOrphanedResources(p *v1alpha1.AppProject) string {
-	if p.Spec.OrphanedResources == nil {
-		return "disabled"
-	}
-	return fmt.Sprintf("enabled (warn=%v)", p.Spec.OrphanedResources.IsWarn())
-}
-
 func printProjectLine(w io.Writer, p *v1alpha1.AppProject) {
 	var destinations, sourceRepos, clusterWhitelist, namespaceBlacklist string
 	switch len(p.Spec.Destinations) {
@@ -647,63 +496,12 @@ func printProjectLine(w io.Writer, p *v1alpha1.AppProject) {
 	default:
 		namespaceBlacklist = fmt.Sprintf("%d resources", len(p.Spec.NamespaceResourceBlacklist))
 	}
-	fmt.Fprintf(w, "%s\t%s\t%v\t%v\t%v\t%v\t%v\n", p.Name, p.Spec.Description, destinations, sourceRepos, clusterWhitelist, namespaceBlacklist, formatOrphanedResources(p))
-}
-
-func printProject(p *v1alpha1.AppProject) {
-	const printProjFmtStr = "%-34s%s\n"
-
-	fmt.Printf(printProjFmtStr, "Name:", p.Name)
-	fmt.Printf(printProjFmtStr, "Description:", p.Spec.Description)
-
-	// Print destinations
-	dest0 := "<none>"
-	if len(p.Spec.Destinations) > 0 {
-		dest0 = fmt.Sprintf("%s,%s", p.Spec.Destinations[0].Server, p.Spec.Destinations[0].Namespace)
-	}
-	fmt.Printf(printProjFmtStr, "Destinations:", dest0)
-	for i := 1; i < len(p.Spec.Destinations); i++ {
-		fmt.Printf(printProjFmtStr, "", fmt.Sprintf("%s,%s", p.Spec.Destinations[i].Server, p.Spec.Destinations[i].Namespace))
-	}
-
-	// Print sources
-	src0 := "<none>"
-	if len(p.Spec.SourceRepos) > 0 {
-		src0 = p.Spec.SourceRepos[0]
-	}
-	fmt.Printf(printProjFmtStr, "Repositories:", src0)
-	for i := 1; i < len(p.Spec.SourceRepos); i++ {
-		fmt.Printf(printProjFmtStr, "", p.Spec.SourceRepos[i])
-	}
-
-	// Print whitelisted cluster resources
-	cwl0 := "<none>"
-	if len(p.Spec.ClusterResourceWhitelist) > 0 {
-		cwl0 = fmt.Sprintf("%s/%s", p.Spec.ClusterResourceWhitelist[0].Group, p.Spec.ClusterResourceWhitelist[0].Kind)
-	}
-	fmt.Printf(printProjFmtStr, "Whitelisted Cluster Resources:", cwl0)
-	for i := 1; i < len(p.Spec.ClusterResourceWhitelist); i++ {
-		fmt.Printf(printProjFmtStr, "", fmt.Sprintf("%s/%s", p.Spec.ClusterResourceWhitelist[i].Group, p.Spec.ClusterResourceWhitelist[i].Kind))
-	}
-
-	// Print blacklisted namespaced resources
-	rbl0 := "<none>"
-	if len(p.Spec.NamespaceResourceBlacklist) > 0 {
-		rbl0 = fmt.Sprintf("%s/%s", p.Spec.NamespaceResourceBlacklist[0].Group, p.Spec.NamespaceResourceBlacklist[0].Kind)
-	}
-	fmt.Printf(printProjFmtStr, "Blacklisted Namespaced Resources:", rbl0)
-	for i := 1; i < len(p.Spec.NamespaceResourceBlacklist); i++ {
-		fmt.Printf(printProjFmtStr, "", fmt.Sprintf("%s/%s", p.Spec.NamespaceResourceBlacklist[i].Group, p.Spec.NamespaceResourceBlacklist[i].Kind))
-	}
-	fmt.Printf(printProjFmtStr, "Orphaned Resources:", formatOrphanedResources(p))
-
+	fmt.Fprintf(w, "%s\t%s\t%v\t%v\t%v\t%v\n", p.Name, p.Spec.Description, destinations, sourceRepos, clusterWhitelist, namespaceBlacklist)
 }
 
 // NewProjectGetCommand returns a new instance of an `argocd proj get` command
 func NewProjectGetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		output string
-	)
+	const printProjFmtStr = "%-34s%s\n"
 	var command = &cobra.Command{
 		Use:   "get PROJECT",
 		Short: "Get project details",
@@ -715,21 +513,52 @@ func NewProjectGetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command
 			projName := args[0]
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
-			p, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+			p, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 			errors.CheckError(err)
+			fmt.Printf(printProjFmtStr, "Name:", p.Name)
+			fmt.Printf(printProjFmtStr, "Description:", p.Spec.Description)
 
-			switch output {
-			case "yaml", "json":
-				err := PrintResource(p, output)
-				errors.CheckError(err)
-			case "wide", "":
-				printProject(p)
-			default:
-				errors.CheckError(fmt.Errorf("unknown output format: %s", output))
+			// Print destinations
+			dest0 := "<none>"
+			if len(p.Spec.Destinations) > 0 {
+				dest0 = fmt.Sprintf("%s,%s", p.Spec.Destinations[0].Server, p.Spec.Destinations[0].Namespace)
+			}
+			fmt.Printf(printProjFmtStr, "Destinations:", dest0)
+			for i := 1; i < len(p.Spec.Destinations); i++ {
+				fmt.Printf(printProjFmtStr, "", fmt.Sprintf("%s,%s", p.Spec.Destinations[i].Server, p.Spec.Destinations[i].Namespace))
+			}
+
+			// Print sources
+			src0 := "<none>"
+			if len(p.Spec.SourceRepos) > 0 {
+				src0 = p.Spec.SourceRepos[0]
+			}
+			fmt.Printf(printProjFmtStr, "Repositories:", src0)
+			for i := 1; i < len(p.Spec.SourceRepos); i++ {
+				fmt.Printf(printProjFmtStr, "", p.Spec.SourceRepos[i])
+			}
+
+			// Print whitelisted cluster resources
+			cwl0 := "<none>"
+			if len(p.Spec.ClusterResourceWhitelist) > 0 {
+				cwl0 = fmt.Sprintf("%s/%s", p.Spec.ClusterResourceWhitelist[0].Group, p.Spec.ClusterResourceWhitelist[0].Kind)
+			}
+			fmt.Printf(printProjFmtStr, "Whitelisted Cluster Resources:", cwl0)
+			for i := 1; i < len(p.Spec.ClusterResourceWhitelist); i++ {
+				fmt.Printf(printProjFmtStr, "", fmt.Sprintf("%s/%s", p.Spec.ClusterResourceWhitelist[i].Group, p.Spec.ClusterResourceWhitelist[i].Kind))
+			}
+
+			// Print blacklisted namespaced resources
+			rbl0 := "<none>"
+			if len(p.Spec.NamespaceResourceBlacklist) > 0 {
+				rbl0 = fmt.Sprintf("%s/%s", p.Spec.NamespaceResourceBlacklist[0].Group, p.Spec.NamespaceResourceBlacklist[0].Kind)
+			}
+			fmt.Printf(printProjFmtStr, "Blacklisted Namespaced Resources:", rbl0)
+			for i := 1; i < len(p.Spec.NamespaceResourceBlacklist); i++ {
+				fmt.Printf(printProjFmtStr, "", fmt.Sprintf("%s/%s", p.Spec.NamespaceResourceBlacklist[i].Group, p.Spec.NamespaceResourceBlacklist[i].Kind))
 			}
 		},
 	}
-	command.Flags().StringVarP(&output, "output", "o", "wide", "Output format. One of: json|yaml|wide")
 	return command
 }
 
@@ -745,7 +574,7 @@ func NewProjectEditCommand(clientOpts *argocdclient.ClientOptions) *cobra.Comman
 			projName := args[0]
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+			proj, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 			errors.CheckError(err)
 			projData, err := json.Marshal(proj.Spec)
 			errors.CheckError(err)
@@ -762,12 +591,12 @@ func NewProjectEditCommand(clientOpts *argocdclient.ClientOptions) *cobra.Comman
 				if err != nil {
 					return err
 				}
-				proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+				proj, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 				if err != nil {
 					return err
 				}
 				proj.Spec = updatedSpec
-				_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
+				_, err = projIf.Update(context.Background(), &project.ProjectUpdateRequest{Project: proj})
 				if err != nil {
 					return fmt.Errorf("Failed to update project:\n%v", err)
 				}

cmd/argocd/commands/project_role.go

@@ -12,9 +12,10 @@ import (
 
 	"github.com/argoproj/argo-cd/errors"
 	argocdclient "github.com/argoproj/argo-cd/pkg/apiclient"
-	projectpkg "github.com/argoproj/argo-cd/pkg/apiclient/project"
 	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
+	"github.com/argoproj/argo-cd/server/project"
 	"github.com/argoproj/argo-cd/util"
+	projectutil "github.com/argoproj/argo-cd/util/project"
 )
 
 const (
@@ -39,8 +40,6 @@ func NewProjectRoleCommand(clientOpts *argocdclient.ClientOptions) *cobra.Comman
 	roleCommand.AddCommand(NewProjectRoleDeleteTokenCommand(clientOpts))
 	roleCommand.AddCommand(NewProjectRoleAddPolicyCommand(clientOpts))
 	roleCommand.AddCommand(NewProjectRoleRemovePolicyCommand(clientOpts))
-	roleCommand.AddCommand(NewProjectRoleAddGroupCommand(clientOpts))
-	roleCommand.AddCommand(NewProjectRoleRemoveGroupCommand(clientOpts))
 	return roleCommand
 }
 
@@ -62,16 +61,16 @@ func NewProjectRoleAddPolicyCommand(clientOpts *argocdclient.ClientOptions) *cob
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
 
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+			proj, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 			errors.CheckError(err)
 
-			role, roleIndex, err := proj.GetRoleByName(roleName)
+			role, roleIndex, err := projectutil.GetRoleByName(proj, roleName)
 			errors.CheckError(err)
 
 			policy := fmt.Sprintf(policyTemplate, proj.Name, role.Name, opts.action, proj.Name, opts.object, opts.permission)
 			proj.Spec.Roles[roleIndex].Policies = append(role.Policies, policy)
 
-			_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
+			_, err = projIf.Update(context.Background(), &project.ProjectUpdateRequest{Project: proj})
 			errors.CheckError(err)
 		},
 	}
@@ -97,10 +96,10 @@ func NewProjectRoleRemovePolicyCommand(clientOpts *argocdclient.ClientOptions) *
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
 
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+			proj, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 			errors.CheckError(err)
 
-			role, roleIndex, err := proj.GetRoleByName(roleName)
+			role, roleIndex, err := projectutil.GetRoleByName(proj, roleName)
 			errors.CheckError(err)
 
 			policyToRemove := fmt.Sprintf(policyTemplate, proj.Name, role.Name, opts.action, proj.Name, opts.object, opts.permission)
@@ -116,7 +115,7 @@ func NewProjectRoleRemovePolicyCommand(clientOpts *argocdclient.ClientOptions) *
 			}
 			role.Policies[duplicateIndex] = role.Policies[len(role.Policies)-1]
 			proj.Spec.Roles[roleIndex].Policies = role.Policies[:len(role.Policies)-1]
-			_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
+			_, err = projIf.Update(context.Background(), &project.ProjectUpdateRequest{Project: proj})
 			errors.CheckError(err)
 		},
 	}
@@ -142,17 +141,17 @@ func NewProjectRoleCreateCommand(clientOpts *argocdclient.ClientOptions) *cobra.
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
 
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+			proj, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 			errors.CheckError(err)
 
-			_, _, err = proj.GetRoleByName(roleName)
+			_, _, err = projectutil.GetRoleByName(proj, roleName)
 			if err == nil {
 				fmt.Printf("Role '%s' already exists\n", roleName)
 				return
 			}
 			proj.Spec.Roles = append(proj.Spec.Roles, v1alpha1.ProjectRole{Name: roleName, Description: description})
 
-			_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
+			_, err = projIf.Update(context.Background(), &project.ProjectUpdateRequest{Project: proj})
 			errors.CheckError(err)
 			fmt.Printf("Role '%s' created\n", roleName)
 		},
@@ -176,10 +175,10 @@ func NewProjectRoleDeleteCommand(clientOpts *argocdclient.ClientOptions) *cobra.
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
 
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+			proj, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 			errors.CheckError(err)
 
-			_, index, err := proj.GetRoleByName(roleName)
+			_, index, err := projectutil.GetRoleByName(proj, roleName)
 			if err != nil {
 				fmt.Printf("Role '%s' does not exist in project\n", roleName)
 				return
@@ -187,7 +186,7 @@ func NewProjectRoleDeleteCommand(clientOpts *argocdclient.ClientOptions) *cobra.
 			proj.Spec.Roles[index] = proj.Spec.Roles[len(proj.Spec.Roles)-1]
 			proj.Spec.Roles = proj.Spec.Roles[:len(proj.Spec.Roles)-1]
 
-			_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
+			_, err = projIf.Update(context.Background(), &project.ProjectUpdateRequest{Project: proj})
 			errors.CheckError(err)
 			fmt.Printf("Role '%s' deleted\n", roleName)
 		},
@@ -214,7 +213,7 @@ func NewProjectRoleCreateTokenCommand(clientOpts *argocdclient.ClientOptions) *c
 			defer util.Close(conn)
 			duration, err := timeutil.ParseDuration(expiresIn)
 			errors.CheckError(err)
-			token, err := projIf.CreateToken(context.Background(), &projectpkg.ProjectTokenCreateRequest{Project: projName, Role: roleName, ExpiresIn: int64(duration.Seconds())})
+			token, err := projIf.CreateToken(context.Background(), &project.ProjectTokenCreateRequest{Project: projName, Role: roleName, ExpiresIn: int64(duration.Seconds())})
 			errors.CheckError(err)
 			fmt.Println(token.Token)
 		},
@@ -242,35 +241,15 @@ func NewProjectRoleDeleteTokenCommand(clientOpts *argocdclient.ClientOptions) *c
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
 
-			_, err = projIf.DeleteToken(context.Background(), &projectpkg.ProjectTokenDeleteRequest{Project: projName, Role: roleName, Iat: issuedAt})
+			_, err = projIf.DeleteToken(context.Background(), &project.ProjectTokenDeleteRequest{Project: projName, Role: roleName, Iat: issuedAt})
 			errors.CheckError(err)
 		},
 	}
 	return command
 }
 
-// Print list of project role names
-func printProjectRoleListName(roles []v1alpha1.ProjectRole) {
-	for _, role := range roles {
-		fmt.Println(role.Name)
-	}
-}
-
-// Print table of project roles
-func printProjectRoleListTable(roles []v1alpha1.ProjectRole) {
-	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
-	fmt.Fprintf(w, "ROLE-NAME\tDESCRIPTION\n")
-	for _, role := range roles {
-		fmt.Fprintf(w, "%s\t%s\n", role.Name, role.Description)
-	}
-	_ = w.Flush()
-}
-
 // NewProjectRoleListCommand returns a new instance of an `argocd proj roles list` command
 func NewProjectRoleListCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		output string
-	)
 	var command = &cobra.Command{
 		Use:   "list PROJECT",
 		Short: "List all the roles in a project",
@@ -283,22 +262,16 @@ func NewProjectRoleListCommand(clientOpts *argocdclient.ClientOptions) *cobra.Co
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
 
-			project, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+			project, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 			errors.CheckError(err)
-			switch output {
-			case "json", "yaml":
-				err := PrintResourceList(project.Spec.Roles, output, false)
-				errors.CheckError(err)
-			case "name":
-				printProjectRoleListName(project.Spec.Roles)
-			case "wide", "":
-				printProjectRoleListTable(project.Spec.Roles)
-			default:
-				errors.CheckError(fmt.Errorf("unknown output format: %s", output))
+			w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
+			fmt.Fprintf(w, "ROLE-NAME\tDESCRIPTION\n")
+			for _, role := range project.Spec.Roles {
+				fmt.Fprintf(w, "%s\t%s\n", role.Name, role.Description)
 			}
+			_ = w.Flush()
 		},
 	}
-	command.Flags().StringVarP(&output, "output", "o", "wide", "Output format. One of: json|yaml|wide|name")
 	return command
 }
 
@@ -317,10 +290,10 @@ func NewProjectRoleGetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Com
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
 
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+			proj, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 			errors.CheckError(err)
 
-			role, _, err := proj.GetRoleByName(roleName)
+			role, _, err := projectutil.GetRoleByName(proj, roleName)
 			errors.CheckError(err)
 
 			printRoleFmtStr := "%-15s%s\n"
@@ -349,24 +322,24 @@ func NewProjectRoleGetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Com
 func NewProjectRoleAddGroupCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	var command = &cobra.Command{
 		Use:   "add-group PROJECT ROLE-NAME GROUP-CLAIM",
-		Short: "Add a group claim to a project role",
+		Short: "Add a policy to a project role",
 		Run: func(c *cobra.Command, args []string) {
-			if len(args) != 3 {
+			if len(args) != 2 {
 				c.HelpFunc()(c, args)
 				os.Exit(1)
 			}
 			projName, roleName, groupName := args[0], args[1], args[2]
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+			proj, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 			errors.CheckError(err)
-			updated, err := proj.AddGroupToRole(roleName, groupName)
+			updated, err := projectutil.AddGroupToRole(proj, roleName, groupName)
 			errors.CheckError(err)
-			if !updated {
+			if updated {
 				fmt.Printf("Group '%s' already present in role '%s'\n", groupName, roleName)
 				return
 			}
-			_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
+			_, err = projIf.Update(context.Background(), &project.ProjectUpdateRequest{Project: proj})
 			errors.CheckError(err)
 			fmt.Printf("Group '%s' added to role '%s'\n", groupName, roleName)
 		},
@@ -387,15 +360,15 @@ func NewProjectRoleRemoveGroupCommand(clientOpts *argocdclient.ClientOptions) *c
 			projName, roleName, groupName := args[0], args[1], args[2]
 			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
 			defer util.Close(conn)
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
+			proj, err := projIf.Get(context.Background(), &project.ProjectQuery{Name: projName})
 			errors.CheckError(err)
-			updated, err := proj.RemoveGroupFromRole(roleName, groupName)
+			updated, err := projectutil.RemoveGroupFromRole(proj, roleName, groupName)
 			errors.CheckError(err)
 			if !updated {
 				fmt.Printf("Group '%s' not present in role '%s'\n", groupName, roleName)
 				return
 			}
-			_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
+			_, err = projIf.Update(context.Background(), &project.ProjectUpdateRequest{Project: proj})
 			errors.CheckError(err)
 			fmt.Printf("Group '%s' removed from role '%s'\n", groupName, roleName)
 		},

cmd/argocd/commands/projectwindows.go

@@ -1,322 +0,0 @@
-package commands
-
-import (
-	"context"
-	"os"
-
-	"github.com/spf13/cobra"
-
-	"fmt"
-	"strings"
-	"text/tabwriter"
-
-	"strconv"
-
-	"github.com/argoproj/argo-cd/errors"
-	argocdclient "github.com/argoproj/argo-cd/pkg/apiclient"
-	projectpkg "github.com/argoproj/argo-cd/pkg/apiclient/project"
-	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	"github.com/argoproj/argo-cd/util"
-)
-
-// NewProjectWindowsCommand returns a new instance of the `argocd proj windows` command
-func NewProjectWindowsCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	roleCommand := &cobra.Command{
-		Use:   "windows",
-		Short: "Manage a project's sync windows",
-		Run: func(c *cobra.Command, args []string) {
-			c.HelpFunc()(c, args)
-			os.Exit(1)
-		},
-	}
-	roleCommand.AddCommand(NewProjectWindowsDisableManualSyncCommand(clientOpts))
-	roleCommand.AddCommand(NewProjectWindowsEnableManualSyncCommand(clientOpts))
-	roleCommand.AddCommand(NewProjectWindowsAddWindowCommand(clientOpts))
-	roleCommand.AddCommand(NewProjectWindowsDeleteCommand(clientOpts))
-	roleCommand.AddCommand(NewProjectWindowsListCommand(clientOpts))
-	roleCommand.AddCommand(NewProjectWindowsUpdateCommand(clientOpts))
-	return roleCommand
-}
-
-// NewProjectSyncWindowsDisableManualSyncCommand returns a new instance of an `argocd proj windows disable-manual-sync` command
-func NewProjectWindowsDisableManualSyncCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var command = &cobra.Command{
-		Use:   "disable-manual-sync PROJECT ID",
-		Short: "Disable manual sync for a sync window",
-		Long:  "Disable manual sync for a sync window. Requires ID which can be found by running \"argocd proj windows list PROJECT\"",
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) != 2 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-
-			projName := args[0]
-			id, err := strconv.Atoi(args[1])
-			errors.CheckError(err)
-
-			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
-			defer util.Close(conn)
-
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
-			errors.CheckError(err)
-
-			for i, window := range proj.Spec.SyncWindows {
-				if id == i {
-					window.ManualSync = false
-				}
-			}
-
-			_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
-			errors.CheckError(err)
-		},
-	}
-	return command
-}
-
-// NewProjectWindowsEnableManualSyncCommand returns a new instance of an `argocd proj windows enable-manual-sync` command
-func NewProjectWindowsEnableManualSyncCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var command = &cobra.Command{
-		Use:   "enable-manual-sync PROJECT ID",
-		Short: "Enable manual sync for a sync window",
-		Long:  "Enable manual sync for a sync window. Requires ID which can be found by running \"argocd proj windows list PROJECT\"",
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) != 2 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-
-			projName := args[0]
-			id, err := strconv.Atoi(args[1])
-			errors.CheckError(err)
-
-			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
-			defer util.Close(conn)
-
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
-			errors.CheckError(err)
-
-			for i, window := range proj.Spec.SyncWindows {
-				if id == i {
-					window.ManualSync = true
-				}
-			}
-
-			_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
-			errors.CheckError(err)
-		},
-	}
-	return command
-}
-
-// NewProjectWindowsAddWindowCommand returns a new instance of an `argocd proj windows add` command
-func NewProjectWindowsAddWindowCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		kind         string
-		schedule     string
-		duration     string
-		applications []string
-		namespaces   []string
-		clusters     []string
-		manualSync   bool
-	)
-	var command = &cobra.Command{
-		Use:   "add PROJECT",
-		Short: "Add a sync window to a project",
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) != 1 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-			projName := args[0]
-			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
-			defer util.Close(conn)
-
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
-			errors.CheckError(err)
-
-			err = proj.Spec.AddWindow(kind, schedule, duration, applications, namespaces, clusters, manualSync)
-			errors.CheckError(err)
-
-			_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
-			errors.CheckError(err)
-		},
-	}
-	command.Flags().StringVarP(&kind, "kind", "k", "", "Sync window kind, either allow or deny")
-	command.Flags().StringVar(&schedule, "schedule", "", "Sync window schedule in cron format. (e.g. --schedule \"0 22 * * *\")")
-	command.Flags().StringVar(&duration, "duration", "", "Sync window duration. (e.g. --duration 1h)")
-	command.Flags().StringSliceVar(&applications, "applications", []string{}, "Applications that the schedule will be applied to. Comma separated, wildcards supported (e.g. --applications prod-\\*,website)")
-	command.Flags().StringSliceVar(&namespaces, "namespaces", []string{}, "Namespaces that the schedule will be applied to. Comma separated, wildcards supported (e.g. --namespaces default,\\*-prod)")
-	command.Flags().StringSliceVar(&clusters, "clusters", []string{}, "Clusters that the schedule will be applied to. Comma separated, wildcards supported (e.g. --clusters prod,staging)")
-	command.Flags().BoolVar(&manualSync, "manual-sync", false, "Allow manual syncs for both deny and allow windows")
-
-	return command
-}
-
-// NewProjectWindowsAddWindowCommand returns a new instance of an `argocd proj windows delete` command
-func NewProjectWindowsDeleteCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var command = &cobra.Command{
-		Use:   "delete PROJECT ID",
-		Short: "Delete a sync window from a project. Requires ID which can be found by running \"argocd proj windows list PROJECT\"",
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) != 2 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-
-			projName := args[0]
-			id, err := strconv.Atoi(args[1])
-			errors.CheckError(err)
-
-			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
-			defer util.Close(conn)
-
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
-			errors.CheckError(err)
-
-			err = proj.Spec.DeleteWindow(id)
-			errors.CheckError(err)
-
-			_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
-			errors.CheckError(err)
-		},
-	}
-	return command
-}
-
-// NewProjectWindowsUpdateCommand returns a new instance of an `argocd proj windows update` command
-func NewProjectWindowsUpdateCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		schedule     string
-		duration     string
-		applications []string
-		namespaces   []string
-		clusters     []string
-	)
-	var command = &cobra.Command{
-		Use:   "update PROJECT ID",
-		Short: "Update a project sync window",
-		Long:  "Update a project sync window. Requires ID which can be found by running \"argocd proj windows list PROJECT\"",
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) != 2 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-
-			projName := args[0]
-			id, err := strconv.Atoi(args[1])
-			errors.CheckError(err)
-
-			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
-			defer util.Close(conn)
-
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
-			errors.CheckError(err)
-
-			for i, window := range proj.Spec.SyncWindows {
-				if id == i {
-					err := window.Update(schedule, duration, applications, namespaces, clusters)
-					if err != nil {
-						errors.CheckError(err)
-					}
-				}
-			}
-
-			_, err = projIf.Update(context.Background(), &projectpkg.ProjectUpdateRequest{Project: proj})
-			errors.CheckError(err)
-		},
-	}
-	command.Flags().StringVar(&schedule, "schedule", "", "Sync window schedule in cron format. (e.g. --schedule \"0 22 * * *\")")
-	command.Flags().StringVar(&duration, "duration", "", "Sync window duration. (e.g. --duration 1h)")
-	command.Flags().StringSliceVar(&applications, "applications", []string{}, "Applications that the schedule will be applied to. Comma separated, wildcards supported (e.g. --applications prod-\\*,website)")
-	command.Flags().StringSliceVar(&namespaces, "namespaces", []string{}, "Namespaces that the schedule will be applied to. Comma separated, wildcards supported (e.g. --namespaces default,\\*-prod)")
-	command.Flags().StringSliceVar(&clusters, "clusters", []string{}, "Clusters that the schedule will be applied to. Comma separated, wildcards supported (e.g. --clusters prod,staging)")
-	return command
-}
-
-// NewProjectWindowsListCommand returns a new instance of an `argocd proj windows list` command
-func NewProjectWindowsListCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		output string
-	)
-	var command = &cobra.Command{
-		Use:   "list PROJECT",
-		Short: "List project sync windows",
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) != 1 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-			projName := args[0]
-			conn, projIf := argocdclient.NewClientOrDie(clientOpts).NewProjectClientOrDie()
-			defer util.Close(conn)
-
-			proj, err := projIf.Get(context.Background(), &projectpkg.ProjectQuery{Name: projName})
-			errors.CheckError(err)
-			switch output {
-			case "yaml", "json":
-				err := PrintResourceList(proj.Spec.SyncWindows, output, false)
-				errors.CheckError(err)
-			case "wide", "":
-				printSyncWindows(proj)
-			default:
-				errors.CheckError(fmt.Errorf("unknown output format: %s", output))
-			}
-		},
-	}
-	command.Flags().StringVarP(&output, "output", "o", "wide", "Output format. One of: json|yaml|wide")
-	return command
-}
-
-// Print table of sync window data
-func printSyncWindows(proj *v1alpha1.AppProject) {
-	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
-	var fmtStr string
-	headers := []interface{}{"ID", "STATUS", "KIND", "SCHEDULE", "DURATION", "APPLICATIONS", "NAMESPACES", "CLUSTERS", "MANUALSYNC"}
-	fmtStr = "%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n"
-	fmt.Fprintf(w, fmtStr, headers...)
-	if proj.Spec.SyncWindows.HasWindows() {
-		for i, window := range proj.Spec.SyncWindows {
-			vals := []interface{}{
-				strconv.Itoa(i),
-				formatBoolOutput(window.Active()),
-				window.Kind,
-				window.Schedule,
-				window.Duration,
-				formatListOutput(window.Applications),
-				formatListOutput(window.Namespaces),
-				formatListOutput(window.Clusters),
-				formatManualOutput(window.ManualSync),
-			}
-			fmt.Fprintf(w, fmtStr, vals...)
-		}
-	}
-	_ = w.Flush()
-}
-
-func formatListOutput(list []string) string {
-	var o string
-	if len(list) == 0 {
-		o = "-"
-	} else {
-		o = strings.Join(list, ",")
-	}
-	return o
-}
-func formatBoolOutput(active bool) string {
-	var o string
-	if active {
-		o = "Active"
-	} else {
-		o = "Inactive"
-	}
-	return o
-}
-func formatManualOutput(active bool) string {
-	var o string
-	if active {
-		o = "Enabled"
-	} else {
-		o = "Disabled"
-	}
-	return o
-}

cmd/argocd/commands/relogin.go

@@ -5,13 +5,13 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/coreos/go-oidc"
+	oidc "github.com/coreos/go-oidc"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 
 	"github.com/argoproj/argo-cd/errors"
 	argocdclient "github.com/argoproj/argo-cd/pkg/apiclient"
-	settingspkg "github.com/argoproj/argo-cd/pkg/apiclient/settings"
+	"github.com/argoproj/argo-cd/server/settings"
 	"github.com/argoproj/argo-cd/util"
 	"github.com/argoproj/argo-cd/util/localconfig"
 	"github.com/argoproj/argo-cd/util/session"
@@ -43,12 +43,11 @@ func NewReloginCommand(globalClientOpts *argocdclient.ClientOptions) *cobra.Comm
 			var tokenString string
 			var refreshToken string
 			clientOpts := argocdclient.ClientOptions{
-				ConfigPath:      "",
-				ServerAddr:      configCtx.Server.Server,
-				Insecure:        configCtx.Server.Insecure,
-				GRPCWeb:         globalClientOpts.GRPCWeb,
-				GRPCWebRootPath: globalClientOpts.GRPCWebRootPath,
-				PlainText:       configCtx.Server.PlainText,
+				ConfigPath: "",
+				ServerAddr: configCtx.Server.Server,
+				Insecure:   configCtx.Server.Insecure,
+				GRPCWeb:    globalClientOpts.GRPCWeb,
+				PlainText:  configCtx.Server.PlainText,
 			}
 			acdClient := argocdclient.NewClientOrDie(&clientOpts)
 			claims, err := configCtx.User.Claims()
@@ -64,11 +63,11 @@ func NewReloginCommand(globalClientOpts *argocdclient.ClientOptions) *cobra.Comm
 				httpClient, err := acdClient.HTTPClient()
 				errors.CheckError(err)
 				ctx = oidc.ClientContext(ctx, httpClient)
-				acdSet, err := setIf.Get(ctx, &settingspkg.SettingsQuery{})
+				acdSet, err := setIf.Get(ctx, &settings.SettingsQuery{})
 				errors.CheckError(err)
 				oauth2conf, provider, err := acdClient.OIDCConfig(ctx, acdSet)
 				errors.CheckError(err)
-				tokenString, refreshToken = oauth2Login(ctx, ssoPort, acdSet.GetOIDCConfig(), oauth2conf, provider)
+				tokenString, refreshToken = oauth2Login(ctx, ssoPort, oauth2conf, provider)
 			}
 
 			localCfg.UpsertUser(localconfig.User{

cmd/argocd/commands/repo.go

@@ -10,11 +10,10 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 
-	"github.com/argoproj/argo-cd/common"
 	"github.com/argoproj/argo-cd/errors"
 	argocdclient "github.com/argoproj/argo-cd/pkg/apiclient"
-	repositorypkg "github.com/argoproj/argo-cd/pkg/apiclient/repository"
 	appsv1 "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
+	"github.com/argoproj/argo-cd/server/repository"
 	"github.com/argoproj/argo-cd/util"
 	"github.com/argoproj/argo-cd/util/cli"
 	"github.com/argoproj/argo-cd/util/git"
@@ -24,7 +23,7 @@ import (
 func NewRepoCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	var command = &cobra.Command{
 		Use:   "repo",
-		Short: "Manage repository connection parameters",
+		Short: "Manage git repository credentials",
 		Run: func(c *cobra.Command, args []string) {
 			c.HelpFunc()(c, args)
 			os.Exit(1)
@@ -40,146 +39,58 @@ func NewRepoCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 // NewRepoAddCommand returns a new instance of an `argocd repo add` command
 func NewRepoAddCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	var (
-		repo                           appsv1.Repository
-		upsert                         bool
-		sshPrivateKeyPath              string
-		insecureIgnoreHostKey          bool
-		insecureSkipServerVerification bool
-		tlsClientCertPath              string
-		tlsClientCertKeyPath           string
-		enableLfs                      bool
+		repo                  appsv1.Repository
+		upsert                bool
+		sshPrivateKeyPath     string
+		insecureIgnoreHostKey bool
 	)
-
-	// For better readability and easier formatting
-	var repoAddExamples = `  # Add a Git repository via SSH using a private key for authentication, ignoring the server's host key:
-	argocd repo add git@git.example.com:repos/repo --insecure-ignore-host-key --ssh-private-key-path ~/id_rsa
-
-	# Add a Git repository via SSH on a non-default port - need to use ssh:// style URLs here
-	argocd repo add ssh://git@git.example.com:2222/repos/repo --ssh-private-key-path ~/id_rsa
-
-  # Add a private Git repository via HTTPS using username/password and TLS client certificates:
-  argocd repo add https://git.example.com/repos/repo --username git --password secret --tls-client-cert-path ~/mycert.crt --tls-client-cert-key-path ~/mycert.key
-
-  # Add a private Git repository via HTTPS using username/password without verifying the server's TLS certificate
-  argocd repo add https://git.example.com/repos/repo --username git --password secret --insecure-skip-server-verification
-
-  # Add a public Helm repository named 'stable' via HTTPS
-  argocd repo add https://kubernetes-charts.storage.googleapis.com --type helm --name stable  
-
-  # Add a private Helm repository named 'stable' via HTTPS
-  argocd repo add https://kubernetes-charts.storage.googleapis.com --type helm --name stable --username test --password test
-`
-
 	var command = &cobra.Command{
-		Use:     "add REPOURL",
-		Short:   "Add git repository connection parameters",
-		Example: repoAddExamples,
+		Use:   "add REPO",
+		Short: "Add git repository credentials",
 		Run: func(c *cobra.Command, args []string) {
 			if len(args) != 1 {
 				c.HelpFunc()(c, args)
 				os.Exit(1)
 			}
-
-			// Repository URL
 			repo.Repo = args[0]
-
-			// Specifying ssh-private-key-path is only valid for SSH repositories
 			if sshPrivateKeyPath != "" {
-				if ok, _ := git.IsSSHURL(repo.Repo); ok {
-					keyData, err := ioutil.ReadFile(sshPrivateKeyPath)
-					if err != nil {
-						log.Fatal(err)
-					}
-					repo.SSHPrivateKey = string(keyData)
-				} else {
-					err := fmt.Errorf("--ssh-private-key-path is only supported for SSH repositories.")
-					errors.CheckError(err)
+				keyData, err := ioutil.ReadFile(sshPrivateKeyPath)
+				if err != nil {
+					log.Fatal(err)
 				}
+				repo.SSHPrivateKey = string(keyData)
 			}
-
-			// tls-client-cert-path and tls-client-cert-key-key-path must always be
-			// specified together
-			if (tlsClientCertPath != "" && tlsClientCertKeyPath == "") || (tlsClientCertPath == "" && tlsClientCertKeyPath != "") {
-				err := fmt.Errorf("--tls-client-cert-path and --tls-client-cert-key-path must be specified together")
-				errors.CheckError(err)
-			}
-
-			// Specifying tls-client-cert-path is only valid for HTTPS repositories
-			if tlsClientCertPath != "" {
-				if git.IsHTTPSURL(repo.Repo) {
-					tlsCertData, err := ioutil.ReadFile(tlsClientCertPath)
-					errors.CheckError(err)
-					tlsCertKey, err := ioutil.ReadFile(tlsClientCertKeyPath)
-					errors.CheckError(err)
-					repo.TLSClientCertData = string(tlsCertData)
-					repo.TLSClientCertKey = string(tlsCertKey)
-				} else {
-					err := fmt.Errorf("--tls-client-cert-path is only supported for HTTPS repositories")
-					errors.CheckError(err)
-				}
-			}
-
-			// Set repository connection properties only when creating repository, not
-			// when creating repository credentials.
-			// InsecureIgnoreHostKey is deprecated and only here for backwards compat
 			repo.InsecureIgnoreHostKey = insecureIgnoreHostKey
-			repo.Insecure = insecureSkipServerVerification
-			repo.EnableLFS = enableLfs
-
-			if repo.Type == "helm" && repo.Name == "" {
-				errors.CheckError(fmt.Errorf("Must specify --name for repos of type 'helm'"))
+			// First test the repo *without* username/password. This gives us a hint on whether this
+			// is a private repo.
+			// NOTE: it is important not to run git commands to test git credentials on the user's
+			// system since it may mess with their git credential store (e.g. osx keychain).
+			// See issue #315
+			err := git.TestRepo(repo.Repo, "", "", repo.SSHPrivateKey, repo.InsecureIgnoreHostKey)
+			if err != nil {
+				if git.IsSSHURL(repo.Repo) {
+					// If we failed using git SSH credentials, then the repo is automatically bad
+					log.Fatal(err)
+				}
+				// If we can't test the repo, it's probably private. Prompt for credentials and
+				// let the server test it.
+				repo.Username, repo.Password = cli.PromptCredentials(repo.Username, repo.Password)
 			}
-
 			conn, repoIf := argocdclient.NewClientOrDie(clientOpts).NewRepoClientOrDie()
 			defer util.Close(conn)
-
-			// If the user set a username, but didn't supply password via --password,
-			// then we prompt for it
-			if repo.Username != "" && repo.Password == "" {
-				repo.Password = cli.PromptPassword(repo.Password)
-			}
-
-			// We let the server check access to the repository before adding it. If
-			// it is a private repo, but we cannot access with with the credentials
-			// that were supplied, we bail out.
-			//
-			// Skip validation if we are just adding credentials template, chances
-			// are high that we do not have the given URL pointing to a valid Git
-			// repo anyway.
-			repoAccessReq := repositorypkg.RepoAccessQuery{
-				Repo:              repo.Repo,
-				Type:              repo.Type,
-				Name:              repo.Name,
-				Username:          repo.Username,
-				Password:          repo.Password,
-				SshPrivateKey:     repo.SSHPrivateKey,
-				TlsClientCertData: repo.TLSClientCertData,
-				TlsClientCertKey:  repo.TLSClientCertKey,
-				Insecure:          repo.IsInsecure(),
-			}
-			_, err := repoIf.ValidateAccess(context.Background(), &repoAccessReq)
-			errors.CheckError(err)
-
-			repoCreateReq := repositorypkg.RepoCreateRequest{
+			repoCreateReq := repository.RepoCreateRequest{
 				Repo:   &repo,
 				Upsert: upsert,
 			}
-
 			createdRepo, err := repoIf.Create(context.Background(), &repoCreateReq)
 			errors.CheckError(err)
 			fmt.Printf("repository '%s' added\n", createdRepo.Repo)
 		},
 	}
-	command.Flags().StringVar(&repo.Type, "type", common.DefaultRepoType, "type of the repository, \"git\" or \"helm\"")
-	command.Flags().StringVar(&repo.Name, "name", "", "name of the repository, mandatory for repositories of type helm")
 	command.Flags().StringVar(&repo.Username, "username", "", "username to the repository")
 	command.Flags().StringVar(&repo.Password, "password", "", "password to the repository")
 	command.Flags().StringVar(&sshPrivateKeyPath, "ssh-private-key-path", "", "path to the private ssh key (e.g. ~/.ssh/id_rsa)")
-	command.Flags().StringVar(&tlsClientCertPath, "tls-client-cert-path", "", "path to the TLS client cert (must be PEM format)")
-	command.Flags().StringVar(&tlsClientCertKeyPath, "tls-client-cert-key-path", "", "path to the TLS client cert's key path (must be PEM format)")
-	command.Flags().BoolVar(&insecureIgnoreHostKey, "insecure-ignore-host-key", false, "disables SSH strict host key checking (deprecated, use --insecure-skip-server-verification instead)")
-	command.Flags().BoolVar(&insecureSkipServerVerification, "insecure-skip-server-verification", false, "disables server certificate and host key checks")
-	command.Flags().BoolVar(&enableLfs, "enable-lfs", false, "enable git-lfs (Large File Support) on this repository")
+	command.Flags().BoolVar(&insecureIgnoreHostKey, "insecure-ignore-host-key", false, "disables SSH strict host key checking")
 	command.Flags().BoolVar(&upsert, "upsert", false, "Override an existing repository with the same name even if the spec differs")
 	return command
 }
@@ -188,7 +99,7 @@ func NewRepoAddCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 func NewRepoRemoveCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	var command = &cobra.Command{
 		Use:   "rm REPO",
-		Short: "Remove repository credentials",
+		Short: "Remove git repository credentials",
 		Run: func(c *cobra.Command, args []string) {
 			if len(args) == 0 {
 				c.HelpFunc()(c, args)
@@ -197,7 +108,7 @@ func NewRepoRemoveCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command
 			conn, repoIf := argocdclient.NewClientOrDie(clientOpts).NewRepoClientOrDie()
 			defer util.Close(conn)
 			for _, repoURL := range args {
-				_, err := repoIf.Delete(context.Background(), &repositorypkg.RepoQuery{Repo: repoURL})
+				_, err := repoIf.Delete(context.Background(), &repository.RepoQuery{Repo: repoURL})
 				errors.CheckError(err)
 			}
 		},
@@ -205,71 +116,23 @@ func NewRepoRemoveCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command
 	return command
 }
 
-// Print table of repo info
-func printRepoTable(repos appsv1.Repositories) {
-	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
-	_, _ = fmt.Fprintf(w, "TYPE\tNAME\tREPO\tINSECURE\tLFS\tCREDS\tSTATUS\tMESSAGE\n")
-	for _, r := range repos {
-		var hasCreds string
-		if !r.HasCredentials() {
-			hasCreds = "false"
-		} else {
-			if r.InheritedCreds {
-				hasCreds = "inherited"
-			} else {
-				hasCreds = "true"
-			}
-		}
-		_, _ = fmt.Fprintf(w, "%s\t%s\t%s\t%v\t%v\t%s\t%s\t%s\n", r.Type, r.Name, r.Repo, r.IsInsecure(), r.EnableLFS, hasCreds, r.ConnectionState.Status, r.ConnectionState.Message)
-	}
-	_ = w.Flush()
-}
-
-// Print list of repo urls or url patterns for repository credentials
-func printRepoUrls(repos appsv1.Repositories) {
-	for _, r := range repos {
-		fmt.Println(r.Repo)
-	}
-}
-
 // NewRepoListCommand returns a new instance of an `argocd repo rm` command
 func NewRepoListCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		output  string
-		refresh string
-	)
 	var command = &cobra.Command{
 		Use:   "list",
 		Short: "List configured repositories",
 		Run: func(c *cobra.Command, args []string) {
 			conn, repoIf := argocdclient.NewClientOrDie(clientOpts).NewRepoClientOrDie()
 			defer util.Close(conn)
-			forceRefresh := false
-			switch refresh {
-			case "":
-			case "hard":
-				forceRefresh = true
-			default:
-				err := fmt.Errorf("--refresh must be one of: 'hard'")
-				errors.CheckError(err)
-			}
-			repos, err := repoIf.List(context.Background(), &repositorypkg.RepoQuery{ForceRefresh: forceRefresh})
+			repos, err := repoIf.List(context.Background(), &repository.RepoQuery{})
 			errors.CheckError(err)
-			switch output {
-			case "yaml", "json":
-				err := PrintResourceList(repos.Items, output, false)
-				errors.CheckError(err)
-			case "url":
-				printRepoUrls(repos.Items)
-				// wide is the default
-			case "wide", "":
-				printRepoTable(repos.Items)
-			default:
-				errors.CheckError(fmt.Errorf("unknown output format: %s", output))
+			w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
+			fmt.Fprintf(w, "REPO\tUSER\tSTATUS\tMESSAGE\n")
+			for _, r := range repos.Items {
+				fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", r.Repo, r.Username, r.ConnectionState.Status, r.ConnectionState.Message)
 			}
+			_ = w.Flush()
 		},
 	}
-	command.Flags().StringVarP(&output, "output", "o", "wide", "Output format. One of: json|yaml|wide|url")
-	command.Flags().StringVar(&refresh, "refresh", "", "Force a cache refresh on connection status")
 	return command
 }

cmd/argocd/commands/repocreds.go

@@ -1,203 +0,0 @@
-package commands
-
-import (
-	"context"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"text/tabwriter"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-
-	"github.com/argoproj/argo-cd/errors"
-	argocdclient "github.com/argoproj/argo-cd/pkg/apiclient"
-	repocredspkg "github.com/argoproj/argo-cd/pkg/apiclient/repocreds"
-	appsv1 "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	"github.com/argoproj/argo-cd/util"
-	"github.com/argoproj/argo-cd/util/cli"
-	"github.com/argoproj/argo-cd/util/git"
-)
-
-// NewRepoCredsCommand returns a new instance of an `argocd repocreds` command
-func NewRepoCredsCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var command = &cobra.Command{
-		Use:   "repocreds",
-		Short: "Manage repository connection parameters",
-		Run: func(c *cobra.Command, args []string) {
-			c.HelpFunc()(c, args)
-			os.Exit(1)
-		},
-	}
-
-	command.AddCommand(NewRepoCredsAddCommand(clientOpts))
-	command.AddCommand(NewRepoCredsListCommand(clientOpts))
-	command.AddCommand(NewRepoCredsRemoveCommand(clientOpts))
-	return command
-}
-
-// NewRepoCredsAddCommand returns a new instance of an `argocd repocreds add` command
-func NewRepoCredsAddCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		repo                 appsv1.RepoCreds
-		upsert               bool
-		sshPrivateKeyPath    string
-		tlsClientCertPath    string
-		tlsClientCertKeyPath string
-	)
-
-	// For better readability and easier formatting
-	var repocredsAddExamples = `  # Add credentials with user/pass authentication to use for all repositories under https://git.example.com/repos
-  argocd repocreds add https://git.example.com/repos/ --username git --password secret
-
-  # Add credentials with SSH private key authentication to use for all repositories under ssh://git@git.example.com/repos
-  argocd repocreds add ssh://git@git.example.com/repos/ --ssh-private-key-path ~/.ssh/id_rsa
-`
-
-	var command = &cobra.Command{
-		Use:     "add REPOURL",
-		Short:   "Add git repository connection parameters",
-		Example: repocredsAddExamples,
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) != 1 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-
-			// Repository URL
-			repo.URL = args[0]
-
-			// Specifying ssh-private-key-path is only valid for SSH repositories
-			if sshPrivateKeyPath != "" {
-				if ok, _ := git.IsSSHURL(repo.URL); ok {
-					keyData, err := ioutil.ReadFile(sshPrivateKeyPath)
-					if err != nil {
-						log.Fatal(err)
-					}
-					repo.SSHPrivateKey = string(keyData)
-				} else {
-					err := fmt.Errorf("--ssh-private-key-path is only supported for SSH repositories.")
-					errors.CheckError(err)
-				}
-			}
-
-			// tls-client-cert-path and tls-client-cert-key-key-path must always be
-			// specified together
-			if (tlsClientCertPath != "" && tlsClientCertKeyPath == "") || (tlsClientCertPath == "" && tlsClientCertKeyPath != "") {
-				err := fmt.Errorf("--tls-client-cert-path and --tls-client-cert-key-path must be specified together")
-				errors.CheckError(err)
-			}
-
-			// Specifying tls-client-cert-path is only valid for HTTPS repositories
-			if tlsClientCertPath != "" {
-				if git.IsHTTPSURL(repo.URL) {
-					tlsCertData, err := ioutil.ReadFile(tlsClientCertPath)
-					errors.CheckError(err)
-					tlsCertKey, err := ioutil.ReadFile(tlsClientCertKeyPath)
-					errors.CheckError(err)
-					repo.TLSClientCertData = string(tlsCertData)
-					repo.TLSClientCertKey = string(tlsCertKey)
-				} else {
-					err := fmt.Errorf("--tls-client-cert-path is only supported for HTTPS repositories")
-					errors.CheckError(err)
-				}
-			}
-
-			conn, repoIf := argocdclient.NewClientOrDie(clientOpts).NewRepoCredsClientOrDie()
-			defer util.Close(conn)
-
-			// If the user set a username, but didn't supply password via --password,
-			// then we prompt for it
-			if repo.Username != "" && repo.Password == "" {
-				repo.Password = cli.PromptPassword(repo.Password)
-			}
-
-			repoCreateReq := repocredspkg.RepoCredsCreateRequest{
-				Creds:  &repo,
-				Upsert: upsert,
-			}
-
-			createdRepo, err := repoIf.CreateRepositoryCredentials(context.Background(), &repoCreateReq)
-			errors.CheckError(err)
-			fmt.Printf("repository credentials for '%s' added\n", createdRepo.URL)
-		},
-	}
-	command.Flags().StringVar(&repo.Username, "username", "", "username to the repository")
-	command.Flags().StringVar(&repo.Password, "password", "", "password to the repository")
-	command.Flags().StringVar(&sshPrivateKeyPath, "ssh-private-key-path", "", "path to the private ssh key (e.g. ~/.ssh/id_rsa)")
-	command.Flags().StringVar(&tlsClientCertPath, "tls-client-cert-path", "", "path to the TLS client cert (must be PEM format)")
-	command.Flags().StringVar(&tlsClientCertKeyPath, "tls-client-cert-key-path", "", "path to the TLS client cert's key path (must be PEM format)")
-	command.Flags().BoolVar(&upsert, "upsert", false, "Override an existing repository with the same name even if the spec differs")
-	return command
-}
-
-// NewRepoCredsRemoveCommand returns a new instance of an `argocd repocreds rm` command
-func NewRepoCredsRemoveCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var command = &cobra.Command{
-		Use:   "rm CREDSURL",
-		Short: "Remove repository credentials",
-		Run: func(c *cobra.Command, args []string) {
-			if len(args) == 0 {
-				c.HelpFunc()(c, args)
-				os.Exit(1)
-			}
-			conn, repoIf := argocdclient.NewClientOrDie(clientOpts).NewRepoCredsClientOrDie()
-			defer util.Close(conn)
-			for _, repoURL := range args {
-				_, err := repoIf.DeleteRepositoryCredentials(context.Background(), &repocredspkg.RepoCredsDeleteRequest{Url: repoURL})
-				errors.CheckError(err)
-			}
-		},
-	}
-	return command
-}
-
-// Print the repository credentials as table
-func printRepoCredsTable(repos []appsv1.RepoCreds) {
-	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
-	fmt.Fprintf(w, "URL PATTERN\tUSERNAME\tSSH_CREDS\tTLS_CREDS\n")
-	for _, r := range repos {
-		if r.Username == "" {
-			r.Username = "-"
-		}
-		fmt.Fprintf(w, "%s\t%s\t%v\t%v\n", r.URL, r.Username, r.SSHPrivateKey != "", r.TLSClientCertData != "")
-	}
-	_ = w.Flush()
-}
-
-// Print list of repo urls or url patterns for repository credentials
-func printRepoCredsUrls(repos []appsv1.RepoCreds) {
-	for _, r := range repos {
-		fmt.Println(r.URL)
-	}
-}
-
-// NewRepoCredsListCommand returns a new instance of an `argocd repo list` command
-func NewRepoCredsListCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		output string
-	)
-	var command = &cobra.Command{
-		Use:   "list",
-		Short: "List configured repository credentials",
-		Run: func(c *cobra.Command, args []string) {
-			conn, repoIf := argocdclient.NewClientOrDie(clientOpts).NewRepoCredsClientOrDie()
-			defer util.Close(conn)
-			repos, err := repoIf.ListRepositoryCredentials(context.Background(), &repocredspkg.RepoCredsQuery{})
-			errors.CheckError(err)
-			switch output {
-			case "yaml", "json":
-				err := PrintResourceList(repos.Items, output, false)
-				errors.CheckError(err)
-			case "url":
-				printRepoCredsUrls(repos.Items)
-			case "wide", "":
-				printRepoCredsTable(repos.Items)
-			default:
-				errors.CheckError(fmt.Errorf("unknown output format: %s", output))
-			}
-		},
-	}
-	command.Flags().StringVarP(&output, "output", "o", "wide", "Output format. One of: json|yaml|wide|url")
-	return command
-}

cmd/argocd/commands/root.go

@@ -36,19 +36,15 @@ func NewCommand() *cobra.Command {
 		},
 	}
 
-	command.AddCommand(NewCompletionCommand())
 	command.AddCommand(NewVersionCmd(&clientOpts))
 	command.AddCommand(NewClusterCommand(&clientOpts, pathOpts))
 	command.AddCommand(NewApplicationCommand(&clientOpts))
 	command.AddCommand(NewLoginCommand(&clientOpts))
 	command.AddCommand(NewReloginCommand(&clientOpts))
 	command.AddCommand(NewRepoCommand(&clientOpts))
-	command.AddCommand(NewRepoCredsCommand(&clientOpts))
 	command.AddCommand(NewContextCommand(&clientOpts))
 	command.AddCommand(NewProjectCommand(&clientOpts))
 	command.AddCommand(NewAccountCommand(&clientOpts))
-	command.AddCommand(NewLogoutCommand(&clientOpts))
-	command.AddCommand(NewCertCommand(&clientOpts))
 
 	defaultLocalConfigPath, err := localconfig.DefaultLocalConfigPath()
 	errors.CheckError(err)
@@ -59,10 +55,6 @@ func NewCommand() *cobra.Command {
 	command.PersistentFlags().StringVar(&clientOpts.CertFile, "server-crt", config.GetFlag("server-crt", ""), "Server certificate file")
 	command.PersistentFlags().StringVar(&clientOpts.AuthToken, "auth-token", config.GetFlag("auth-token", ""), "Authentication token")
 	command.PersistentFlags().BoolVar(&clientOpts.GRPCWeb, "grpc-web", config.GetBoolFlag("grpc-web"), "Enables gRPC-web protocol. Useful if Argo CD server is behind proxy which does not support HTTP2.")
-	command.PersistentFlags().StringVar(&clientOpts.GRPCWebRootPath, "grpc-web-root-path", config.GetFlag("grpc-web-root-path", ""), "Enables gRPC-web protocol. Useful if Argo CD server is behind proxy which does not support HTTP2. Set web root.")
 	command.PersistentFlags().StringVar(&logLevel, "loglevel", config.GetFlag("loglevel", "info"), "Set the logging level. One of: debug|info|warn|error")
-	command.PersistentFlags().StringSliceVarP(&clientOpts.Headers, "header", "H", []string{}, "Sets additional header to all requests made by Argo CD CLI. (Can be repeated multiple times to add multiple headers, also supports comma separated headers)")
-	command.PersistentFlags().BoolVar(&clientOpts.PortForward, "port-forward", config.GetBoolFlag("port-forward"), "Connect to a random argocd-server port using port forwarding")
-	command.PersistentFlags().StringVar(&clientOpts.PortForwardNamespace, "port-forward-namespace", config.GetFlag("port-forward-namespace", ""), "Namespace name which should be used for port forwarding")
 	return command
 }

cmd/argocd/commands/testdata/config

@@ -1,25 +0,0 @@
-contexts:
-- name: argocd1.example.com:443
-  server: argocd1.example.com:443
-  user: argocd1.example.com:443
-- name: argocd2.example.com:443
-  server: argocd2.example.com:443
-  user: argocd2.example.com:443
-- name: localhost:8080
-  server: localhost:8080
-  user: localhost:8080
-current-context: localhost:8080
-servers:
-- server: argocd1.example.com:443
-- server: argocd2.example.com:443
-- plain-text: true
-  server: localhost:8080
-users:
-- auth-token: vErrYS3c3tReFRe$hToken
-  name: argocd1.example.com:443
-  refresh-token: vErrYS3c3tReFRe$hToken
-- auth-token: vErrYS3c3tReFRe$hToken
-  name: argocd2.example.com:443
-  refresh-token: vErrYS3c3tReFRe$hToken
-- auth-token: vErrYS3c3tReFRe$hToken
-  name: localhost:8080

cmd/argocd/commands/version.go

@@ -3,121 +3,64 @@ package commands
 import (
 	"context"
 	"fmt"
-	"io"
 
 	"github.com/golang/protobuf/ptypes/empty"
 	"github.com/spf13/cobra"
 
-	"github.com/argoproj/argo-cd/common"
+	argocd "github.com/argoproj/argo-cd"
 	"github.com/argoproj/argo-cd/errors"
 	argocdclient "github.com/argoproj/argo-cd/pkg/apiclient"
-	"github.com/argoproj/argo-cd/pkg/apiclient/version"
 	"github.com/argoproj/argo-cd/util"
 )
 
 // NewVersionCmd returns a new `version` command to be used as a sub-command to root
 func NewVersionCmd(clientOpts *argocdclient.ClientOptions) *cobra.Command {
-	var (
-		short  bool
-		client bool
-		output string
-	)
+	var short bool
+	var client bool
 
 	versionCmd := cobra.Command{
 		Use:   "version",
 		Short: fmt.Sprintf("Print version information"),
-		Example: `  # Print the full version of client and server to stdout
-  argocd version
-
-  # Print only full version of the client - no connection to server will be made
-  argocd version --client
-
-  # Print the full version of client and server in JSON format
-  argocd version -o json
-
-  # Print only client and server core version strings in YAML format
-  argocd version --short -o yaml
-`,
 		Run: func(cmd *cobra.Command, args []string) {
-			var (
-				versionIf  version.VersionServiceClient
-				serverVers *version.VersionMessage
-				conn       io.Closer
-				err        error
-			)
-			if !client {
-				// Get Server version
-				conn, versionIf = argocdclient.NewClientOrDie(clientOpts).NewVersionClientOrDie()
-				defer util.Close(conn)
-				serverVers, err = versionIf.Version(context.Background(), &empty.Empty{})
-				errors.CheckError(err)
-			}
-			switch output {
-			case "yaml", "json":
-				clientVers := common.GetVersion()
-				version := make(map[string]interface{})
-				if !short {
-					version["client"] = clientVers
-				} else {
-					version["client"] = map[string]string{cliName: clientVers.Version}
+			version := argocd.GetVersion()
+			fmt.Printf("%s: %s\n", cliName, version)
+			if !short {
+				fmt.Printf("  BuildDate: %s\n", version.BuildDate)
+				fmt.Printf("  GitCommit: %s\n", version.GitCommit)
+				fmt.Printf("  GitTreeState: %s\n", version.GitTreeState)
+				if version.GitTag != "" {
+					fmt.Printf("  GitTag: %s\n", version.GitTag)
 				}
-				if !client {
-					if !short {
-						version["server"] = serverVers
-					} else {
-						version["server"] = map[string]string{"argocd-server": serverVers.Version}
-					}
-				}
-				err := PrintResource(version, output)
-				errors.CheckError(err)
-			case "short":
-				printVersion(serverVers, client, true)
-			case "wide", "":
-				// we use value of short for backward compatibility
-				printVersion(serverVers, client, short)
-			default:
-				errors.CheckError(fmt.Errorf("unknown output format: %s", output))
+				fmt.Printf("  GoVersion: %s\n", version.GoVersion)
+				fmt.Printf("  Compiler: %s\n", version.Compiler)
+				fmt.Printf("  Platform: %s\n", version.Platform)
 			}
+			if client {
+				return
+			}
+
+			// Get Server version
+			conn, versionIf := argocdclient.NewClientOrDie(clientOpts).NewVersionClientOrDie()
+			defer util.Close(conn)
+			serverVers, err := versionIf.Version(context.Background(), &empty.Empty{})
+			errors.CheckError(err)
+			fmt.Printf("%s: %s\n", "argocd-server", serverVers.Version)
+			if !short {
+				fmt.Printf("  BuildDate: %s\n", serverVers.BuildDate)
+				fmt.Printf("  GitCommit: %s\n", serverVers.GitCommit)
+				fmt.Printf("  GitTreeState: %s\n", serverVers.GitTreeState)
+				if version.GitTag != "" {
+					fmt.Printf("  GitTag: %s\n", serverVers.GitTag)
+				}
+				fmt.Printf("  GoVersion: %s\n", serverVers.GoVersion)
+				fmt.Printf("  Compiler: %s\n", serverVers.Compiler)
+				fmt.Printf("  Platform: %s\n", serverVers.Platform)
+				fmt.Printf("  Ksonnet Version: %s\n", serverVers.KsonnetVersion)
+			}
+
 		},
 	}
-	versionCmd.Flags().StringVarP(&output, "output", "o", "wide", "Output format. One of: json|yaml|wide|short")
 	versionCmd.Flags().BoolVar(&short, "short", false, "print just the version number")
 	versionCmd.Flags().BoolVar(&client, "client", false, "client version only (no server required)")
 	return &versionCmd
 }
-
-func printVersion(serverVers *version.VersionMessage, client bool, short bool) {
-	version := common.GetVersion()
-	fmt.Printf("%s: %s\n", cliName, version)
-	if !short {
-		fmt.Printf("  BuildDate: %s\n", version.BuildDate)
-		fmt.Printf("  GitCommit: %s\n", version.GitCommit)
-		fmt.Printf("  GitTreeState: %s\n", version.GitTreeState)
-		if version.GitTag != "" {
-			fmt.Printf("  GitTag: %s\n", version.GitTag)
-		}
-		fmt.Printf("  GoVersion: %s\n", version.GoVersion)
-		fmt.Printf("  Compiler: %s\n", version.Compiler)
-		fmt.Printf("  Platform: %s\n", version.Platform)
-	}
-	if client {
-		return
-	}
-
-	fmt.Printf("%s: %s\n", "argocd-server", serverVers.Version)
-	if !short {
-		fmt.Printf("  BuildDate: %s\n", serverVers.BuildDate)
-		fmt.Printf("  GitCommit: %s\n", serverVers.GitCommit)
-		fmt.Printf("  GitTreeState: %s\n", serverVers.GitTreeState)
-		if version.GitTag != "" {
-			fmt.Printf("  GitTag: %s\n", serverVers.GitTag)
-		}
-		fmt.Printf("  GoVersion: %s\n", serverVers.GoVersion)
-		fmt.Printf("  Compiler: %s\n", serverVers.Compiler)
-		fmt.Printf("  Platform: %s\n", serverVers.Platform)
-		fmt.Printf("  Ksonnet Version: %s\n", serverVers.KsonnetVersion)
-		fmt.Printf("  Kustomize Version: %s\n", serverVers.KustomizeVersion)
-		fmt.Printf("  Helm Version: %s\n", serverVers.HelmVersion)
-		fmt.Printf("  Kubectl Version: %s\n", serverVers.KubectlVersion)
-	}
-}

common/common.go

@@ -1,11 +1,5 @@
 package common
 
-import (
-	"os"
-	"strconv"
-	"time"
-)
-
 // Default service addresses and URLS of Argo CD internal services
 const (
 	// DefaultRepoServerAddr is the gRPC address of the Argo CD repo server
@@ -21,35 +15,14 @@ const (
 	ArgoCDConfigMapName     = "argocd-cm"
 	ArgoCDSecretName        = "argocd-secret"
 	ArgoCDRBACConfigMapName = "argocd-rbac-cm"
-	// Contains SSH known hosts data for connecting repositories. Will get mounted as volume to pods
-	ArgoCDKnownHostsConfigMapName = "argocd-ssh-known-hosts-cm"
-	// Contains TLS certificate data for connecting repositories. Will get mounted as volume to pods
-	ArgoCDTLSCertsConfigMapName = "argocd-tls-certs-cm"
 )
 
-// Some default configurables
 const (
-	DefaultSystemNamespace = "kube-system"
-	DefaultRepoType        = "git"
-)
-
-// Default listener ports for ArgoCD components
-const (
-	DefaultPortAPIServer              = 8080
-	DefaultPortRepoServer             = 8081
-	DefaultPortArgoCDMetrics          = 8082
-	DefaultPortArgoCDAPIServerMetrics = 8083
-	DefaultPortRepoServerMetrics      = 8084
-)
-
-// Default paths on the pod's file system
-const (
-	// The default path where TLS certificates for repositories are located
-	DefaultPathTLSConfig = "/app/config/tls"
-	// The default path where SSH known hosts are stored
-	DefaultPathSSHConfig = "/app/config/ssh"
-	// Default name for the SSH known hosts file
-	DefaultSSHKnownHostsName = "ssh_known_hosts"
+	PortAPIServer              = 8080
+	PortRepoServer             = 8081
+	PortArgoCDMetrics          = 8082
+	PortArgoCDAPIServerMetrics = 8083
+	PortRepoServerMetrics      = 8084
 )
 
 // Argo CD application related constants
@@ -66,8 +39,10 @@ const (
 	AuthCookieName = "argocd.token"
 	// RevisionHistoryLimit is the max number of successful sync to keep in history
 	RevisionHistoryLimit = 10
-	// ChangePasswordSSOTokenMaxAge is the max token age for password change operation
-	ChangePasswordSSOTokenMaxAge = time.Minute * 5
+	// K8sClientConfigQPS controls the QPS to be used in K8s REST client configs
+	K8sClientConfigQPS = 25
+	// K8sClientConfigBurst controls the burst to be used in K8s REST client configs
+	K8sClientConfigBurst = 50
 )
 
 // Dex related constants
@@ -78,8 +53,6 @@ const (
 	LoginEndpoint = "/auth/login"
 	// CallbackEndpoint is Argo CD's final callback endpoint we reach after OAuth 2.0 login flow has been completed
 	CallbackEndpoint = "/auth/callback"
-	// DexCallbackEndpoint is Argo CD's final callback endpoint when Dex is configured
-	DexCallbackEndpoint = "/api/dex/callback"
 	// ArgoCDClientAppName is name of the Oauth client app used when registering our web app to dex
 	ArgoCDClientAppName = "Argo CD"
 	// ArgoCDClientAppID is the Oauth client ID we will use when registering our app to dex
@@ -102,12 +75,6 @@ const (
 	// LabelValueSecretTypeCluster indicates a secret type of cluster
 	LabelValueSecretTypeCluster = "cluster"
 
-	// AnnotationCompareOptions is a comma-separated list of options for comparison
-	AnnotationCompareOptions = "argocd.argoproj.io/compare-options"
-	// AnnotationSyncOptions is a comma-separated list of options for syncing
-	AnnotationSyncOptions = "argocd.argoproj.io/sync-options"
-	// AnnotationSyncWave indicates which wave of the sync the resource or hook should be in
-	AnnotationSyncWave = "argocd.argoproj.io/sync-wave"
 	// AnnotationKeyHook contains the hook type of a resource
 	AnnotationKeyHook = "argocd.argoproj.io/hook"
 	// AnnotationKeyHookDeletePolicy is the policy of deleting a hook
@@ -119,6 +86,10 @@ const (
 	AnnotationKeyManagedBy = "managed-by"
 	// AnnotationValueManagedByArgoCD is a 'managed-by' annotation value for resources managed by Argo CD
 	AnnotationValueManagedByArgoCD = "argocd.argoproj.io"
+	// AnnotationKeyHelmHook is the helm hook annotation
+	AnnotationKeyHelmHook = "helm.sh/hook"
+	// AnnotationValueHelmHookCRDInstall is a value of crd helm hook
+	AnnotationValueHelmHookCRDInstall = "crd-install"
 	// ResourcesFinalizerName the finalizer value which we inject to finalize deletion of an application
 	ResourcesFinalizerName = "resources-finalizer.argocd.argoproj.io"
 )
@@ -132,58 +103,14 @@ const (
 	// EnvVarFakeInClusterConfig is an environment variable to fake an in-cluster RESTConfig using
 	// the current kubectl context (for development purposes)
 	EnvVarFakeInClusterConfig = "ARGOCD_FAKE_IN_CLUSTER"
-	// Overrides the location where SSH known hosts for repo access data is stored
-	EnvVarSSHDataPath = "ARGOCD_SSH_DATA_PATH"
-	// Overrides the location where TLS certificate for repo access data is stored
-	EnvVarTLSDataPath = "ARGOCD_TLS_DATA_PATH"
-	// Specifies number of git remote operations attempts count
-	EnvGitAttemptsCount = "ARGOCD_GIT_ATTEMPTS_COUNT"
-	// Overrides git submodule support, true by default
-	EnvGitSubmoduleEnabled = "ARGOCD_GIT_MODULES_ENABLED"
-	// EnvK8sClientQPS is the QPS value used for the kubernetes client (default: 50)
-	EnvK8sClientQPS = "ARGOCD_K8S_CLIENT_QPS"
-	// EnvK8sClientBurst is the burst value used for the kubernetes client (default: twice the client QPS)
-	EnvK8sClientBurst = "ARGOCD_K8S_CLIENT_BURST"
-	// EnvK8sClientMaxIdleConnections is the number of max idle connections in K8s REST client HTTP transport (default: 500)
-	EnvK8sClientMaxIdleConnections = "ARGOCD_K8S_CLIENT_MAX_IDLE_CONNECTIONS"
 )
 
 const (
 	// MinClientVersion is the minimum client version that can interface with this API server.
 	// When introducing breaking changes to the API or datastructures, this number should be bumped.
 	// The value here may be lower than the current value in VERSION
-	MinClientVersion = "1.4.0"
+	MinClientVersion = "0.12.0"
 	// CacheVersion is a objects version cached using util/cache/cache.go.
 	// Number should be bumped in case of backward incompatible change to make sure cache is invalidated after upgrade.
-	CacheVersion = "1.0.0"
+	CacheVersion = "0.12.0"
 )
-
-var (
-	// K8sClientConfigQPS controls the QPS to be used in K8s REST client configs
-	K8sClientConfigQPS float32 = 50
-	// K8sClientConfigBurst controls the burst to be used in K8s REST client configs
-	K8sClientConfigBurst int = 100
-	// K8sMaxIdleConnections controls the number of max idle connections in K8s REST client HTTP transport
-	K8sMaxIdleConnections = 500
-)
-
-func init() {
-	if envQPS := os.Getenv(EnvK8sClientQPS); envQPS != "" {
-		if qps, err := strconv.ParseFloat(envQPS, 32); err != nil {
-			K8sClientConfigQPS = float32(qps)
-		}
-	}
-	if envBurst := os.Getenv(EnvK8sClientBurst); envBurst != "" {
-		if burst, err := strconv.Atoi(envBurst); err != nil {
-			K8sClientConfigBurst = burst
-		}
-	} else {
-		K8sClientConfigBurst = 2 * int(K8sClientConfigQPS)
-	}
-
-	if envMaxConn := os.Getenv(EnvK8sClientMaxIdleConnections); envMaxConn != "" {
-		if maxConn, err := strconv.Atoi(envMaxConn); err != nil {
-			K8sMaxIdleConnections = maxConn
-		}
-	}
-}

common/installer.go

@@ -0,0 +1,219 @@
+package common
+
+import (
+	"fmt"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	apiv1 "k8s.io/api/core/v1"
+	rbacv1 "k8s.io/api/rbac/v1"
+	apierr "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/kubernetes"
+)
+
+// ArgoCDManagerServiceAccount is the name of the service account for managing a cluster
+const (
+	ArgoCDManagerServiceAccount     = "argocd-manager"
+	ArgoCDManagerClusterRole        = "argocd-manager-role"
+	ArgoCDManagerClusterRoleBinding = "argocd-manager-role-binding"
+)
+
+// ArgoCDManagerPolicyRules are the policies to give argocd-manager
+var ArgoCDManagerPolicyRules = []rbacv1.PolicyRule{
+	{
+		APIGroups: []string{"*"},
+		Resources: []string{"*"},
+		Verbs:     []string{"*"},
+	},
+	{
+		NonResourceURLs: []string{"*"},
+		Verbs:           []string{"*"},
+	},
+}
+
+// CreateServiceAccount creates a service account
+func CreateServiceAccount(
+	clientset kubernetes.Interface,
+	serviceAccountName string,
+	namespace string,
+) error {
+	serviceAccount := apiv1.ServiceAccount{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "v1",
+			Kind:       "ServiceAccount",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      serviceAccountName,
+			Namespace: namespace,
+		},
+	}
+	_, err := clientset.CoreV1().ServiceAccounts(namespace).Create(&serviceAccount)
+	if err != nil {
+		if !apierr.IsAlreadyExists(err) {
+			return fmt.Errorf("Failed to create service account %q: %v", serviceAccountName, err)
+		}
+		log.Infof("ServiceAccount %q already exists", serviceAccountName)
+		return nil
+	}
+	log.Infof("ServiceAccount %q created", serviceAccountName)
+	return nil
+}
+
+// CreateClusterRole creates a cluster role
+func CreateClusterRole(
+	clientset kubernetes.Interface,
+	clusterRoleName string,
+	rules []rbacv1.PolicyRule,
+) error {
+	clusterRole := rbacv1.ClusterRole{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "rbac.authorization.k8s.io/v1",
+			Kind:       "ClusterRole",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: clusterRoleName,
+		},
+		Rules: rules,
+	}
+	crclient := clientset.RbacV1().ClusterRoles()
+	_, err := crclient.Create(&clusterRole)
+	if err != nil {
+		if !apierr.IsAlreadyExists(err) {
+			return fmt.Errorf("Failed to create ClusterRole %q: %v", clusterRoleName, err)
+		}
+		_, err = crclient.Update(&clusterRole)
+		if err != nil {
+			return fmt.Errorf("Failed to update ClusterRole %q: %v", clusterRoleName, err)
+		}
+		log.Infof("ClusterRole %q updated", clusterRoleName)
+	} else {
+		log.Infof("ClusterRole %q created", clusterRoleName)
+	}
+	return nil
+}
+
+// CreateClusterRoleBinding create a ClusterRoleBinding
+func CreateClusterRoleBinding(
+	clientset kubernetes.Interface,
+	clusterBindingRoleName,
+	serviceAccountName,
+	clusterRoleName string,
+	namespace string,
+) error {
+	roleBinding := rbacv1.ClusterRoleBinding{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "rbac.authorization.k8s.io/v1",
+			Kind:       "ClusterRoleBinding",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: clusterBindingRoleName,
+		},
+		RoleRef: rbacv1.RoleRef{
+			APIGroup: "rbac.authorization.k8s.io",
+			Kind:     "ClusterRole",
+			Name:     clusterRoleName,
+		},
+		Subjects: []rbacv1.Subject{
+			{
+				Kind:      rbacv1.ServiceAccountKind,
+				Name:      serviceAccountName,
+				Namespace: namespace,
+			},
+		},
+	}
+	_, err := clientset.RbacV1().ClusterRoleBindings().Create(&roleBinding)
+	if err != nil {
+		if !apierr.IsAlreadyExists(err) {
+			return fmt.Errorf("Failed to create ClusterRoleBinding %s: %v", clusterBindingRoleName, err)
+		}
+		log.Infof("ClusterRoleBinding %q already exists", clusterBindingRoleName)
+		return nil
+	}
+	log.Infof("ClusterRoleBinding %q created, bound %q to %q", clusterBindingRoleName, serviceAccountName, clusterRoleName)
+	return nil
+}
+
+// InstallClusterManagerRBAC installs RBAC resources for a cluster manager to operate a cluster. Returns a token
+func InstallClusterManagerRBAC(clientset kubernetes.Interface) (string, error) {
+	const ns = "kube-system"
+	var err error
+
+	err = CreateServiceAccount(clientset, ArgoCDManagerServiceAccount, ns)
+	if err != nil {
+		return "", err
+	}
+
+	err = CreateClusterRole(clientset, ArgoCDManagerClusterRole, ArgoCDManagerPolicyRules)
+	if err != nil {
+		return "", err
+	}
+
+	err = CreateClusterRoleBinding(clientset, ArgoCDManagerClusterRoleBinding, ArgoCDManagerServiceAccount, ArgoCDManagerClusterRole, ns)
+	if err != nil {
+		return "", err
+	}
+
+	var serviceAccount *apiv1.ServiceAccount
+	var secretName string
+	err = wait.Poll(500*time.Millisecond, 30*time.Second, func() (bool, error) {
+		serviceAccount, err = clientset.CoreV1().ServiceAccounts(ns).Get(ArgoCDManagerServiceAccount, metav1.GetOptions{})
+		if err != nil {
+			return false, err
+		}
+		if len(serviceAccount.Secrets) == 0 {
+			return false, nil
+		}
+		secretName = serviceAccount.Secrets[0].Name
+		return true, nil
+	})
+	if err != nil {
+		return "", fmt.Errorf("Failed to wait for service account secret: %v", err)
+	}
+	secret, err := clientset.CoreV1().Secrets(ns).Get(secretName, metav1.GetOptions{})
+	if err != nil {
+		return "", fmt.Errorf("Failed to retrieve secret %q: %v", secretName, err)
+	}
+	token, ok := secret.Data["token"]
+	if !ok {
+		return "", fmt.Errorf("Secret %q for service account %q did not have a token", secretName, serviceAccount)
+	}
+	return string(token), nil
+}
+
+// UninstallClusterManagerRBAC removes RBAC resources for a cluster manager to operate a cluster
+func UninstallClusterManagerRBAC(clientset kubernetes.Interface) error {
+	return UninstallRBAC(clientset, "kube-system", ArgoCDManagerClusterRoleBinding, ArgoCDManagerClusterRole, ArgoCDManagerServiceAccount)
+}
+
+// UninstallRBAC uninstalls RBAC related resources  for a binding, role, and service account
+func UninstallRBAC(clientset kubernetes.Interface, namespace, bindingName, roleName, serviceAccount string) error {
+	if err := clientset.RbacV1().ClusterRoleBindings().Delete(bindingName, &metav1.DeleteOptions{}); err != nil {
+		if !apierr.IsNotFound(err) {
+			return fmt.Errorf("Failed to delete ClusterRoleBinding: %v", err)
+		}
+		log.Infof("ClusterRoleBinding %q not found", bindingName)
+	} else {
+		log.Infof("ClusterRoleBinding %q deleted", bindingName)
+	}
+
+	if err := clientset.RbacV1().ClusterRoles().Delete(roleName, &metav1.DeleteOptions{}); err != nil {
+		if !apierr.IsNotFound(err) {
+			return fmt.Errorf("Failed to delete ClusterRole: %v", err)
+		}
+		log.Infof("ClusterRole %q not found", roleName)
+	} else {
+		log.Infof("ClusterRole %q deleted", roleName)
+	}
+
+	if err := clientset.CoreV1().ServiceAccounts(namespace).Delete(serviceAccount, &metav1.DeleteOptions{}); err != nil {
+		if !apierr.IsNotFound(err) {
+			return fmt.Errorf("Failed to delete ServiceAccount: %v", err)
+		}
+		log.Infof("ServiceAccount %q in namespace %q not found", serviceAccount, namespace)
+	} else {
+		log.Infof("ServiceAccount %q deleted", serviceAccount)
+	}
+	return nil
+}

controller/appcontroller_test.go

@@ -2,7 +2,6 @@ package controller
 
 import (
 	"context"
-	"encoding/json"
 	"testing"
 	"time"
 
@@ -10,41 +9,29 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	corev1 "k8s.io/api/core/v1"
-	apierr "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/kubernetes/fake"
 	kubetesting "k8s.io/client-go/testing"
 	"k8s.io/client-go/tools/cache"
 
-	"github.com/argoproj/argo-cd/common"
 	mockstatecache "github.com/argoproj/argo-cd/controller/cache/mocks"
 	argoappv1 "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
 	appclientset "github.com/argoproj/argo-cd/pkg/client/clientset/versioned/fake"
-	"github.com/argoproj/argo-cd/reposerver/apiclient"
-	mockrepoclient "github.com/argoproj/argo-cd/reposerver/apiclient/mocks"
 	mockreposerver "github.com/argoproj/argo-cd/reposerver/mocks"
+	"github.com/argoproj/argo-cd/reposerver/repository"
+	mockrepoclient "github.com/argoproj/argo-cd/reposerver/repository/mocks"
 	"github.com/argoproj/argo-cd/test"
-	cacheutil "github.com/argoproj/argo-cd/util/cache"
-	appstatecache "github.com/argoproj/argo-cd/util/cache/appstate"
+	utilcache "github.com/argoproj/argo-cd/util/cache"
 	"github.com/argoproj/argo-cd/util/kube"
-	"github.com/argoproj/argo-cd/util/kube/kubetest"
 	"github.com/argoproj/argo-cd/util/settings"
 )
 
-type namespacedResource struct {
-	argoappv1.ResourceNode
-	AppName string
-}
-
 type fakeData struct {
-	apps                []runtime.Object
-	manifestResponse    *apiclient.ManifestResponse
-	managedLiveObjs     map[kube.ResourceKey]*unstructured.Unstructured
-	namespacedResources map[kube.ResourceKey]namespacedResource
-	configMapData       map[string]string
+	apps             []runtime.Object
+	manifestResponse *repository.ManifestResponse
+	managedLiveObjs  map[kube.ResourceKey]*unstructured.Unstructured
 }
 
 func newFakeController(data *fakeData) *ApplicationController {
@@ -74,30 +61,19 @@ func newFakeController(data *fakeData) *ApplicationController {
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "argocd-cm",
 			Namespace: test.FakeArgoCDNamespace,
-			Labels: map[string]string{
-				"app.kubernetes.io/part-of": "argocd",
-			},
 		},
-		Data: data.configMapData,
+		Data: nil,
 	}
 	kubeClient := fake.NewSimpleClientset(&clust, &cm, &secret)
 	settingsMgr := settings.NewSettingsManager(context.Background(), kubeClient, test.FakeArgoCDNamespace)
-	kubectl := &kubetest.MockKubectlCmd{}
 	ctrl, err := NewApplicationController(
 		test.FakeArgoCDNamespace,
 		settingsMgr,
 		kubeClient,
 		appclientset.NewSimpleClientset(data.apps...),
 		&mockRepoClientset,
-		appstatecache.NewCache(
-			cacheutil.NewCache(cacheutil.NewInMemoryCache(1*time.Minute)),
-			1*time.Minute,
-		),
-		kubectl,
+		utilcache.NewCache(utilcache.NewInMemoryCache(1*time.Hour)),
 		time.Minute,
-		time.Minute,
-		common.DefaultPortArgoCDMetrics,
-		0,
 	)
 	if err != nil {
 		panic(err)
@@ -106,26 +82,14 @@ func newFakeController(data *fakeData) *ApplicationController {
 	defer cancelProj()
 	cancelApp := test.StartInformer(ctrl.appInformer)
 	defer cancelApp()
-	mockStateCache := mockstatecache.LiveStateCache{}
-	ctrl.appStateManager.(*appStateManager).liveStateCache = &mockStateCache
-	ctrl.stateCache = &mockStateCache
-	mockStateCache.On("IsNamespaced", mock.Anything, mock.Anything).Return(true, nil)
-	mockStateCache.On("GetManagedLiveObjs", mock.Anything, mock.Anything).Return(data.managedLiveObjs, nil)
-	mockStateCache.On("GetVersionsInfo", mock.Anything).Return("v1.2.3", nil, nil)
-	response := make(map[kube.ResourceKey]argoappv1.ResourceNode)
-	for k, v := range data.namespacedResources {
-		response[k] = v.ResourceNode
+	// Mock out call to GetManagedLiveObjs if fake data supplied
+	if data.managedLiveObjs != nil {
+		mockStateCache := mockstatecache.LiveStateCache{}
+		mockStateCache.On("GetManagedLiveObjs", mock.Anything, mock.Anything).Return(data.managedLiveObjs, nil)
+		mockStateCache.On("IsNamespaced", mock.Anything, mock.Anything).Return(true, nil)
+		ctrl.stateCache = &mockStateCache
+		ctrl.appStateManager.(*appStateManager).liveStateCache = &mockStateCache
 	}
-	mockStateCache.On("GetNamespaceTopLevelResources", mock.Anything, mock.Anything).Return(response, nil)
-	mockStateCache.On("IterateHierarchy", mock.Anything, mock.Anything, mock.Anything).Run(func(args mock.Arguments) {
-		key := args[1].(kube.ResourceKey)
-		action := args[2].(func(child argoappv1.ResourceNode, appName string))
-		appName := ""
-		if res, ok := data.namespacedResources[key]; ok {
-			appName = res.AppName
-		}
-		action(argoappv1.ResourceNode{ResourceRef: argoappv1.ResourceRef{Group: key.Group, Namespace: key.Namespace, Name: key.Name}}, appName)
-	}).Return(nil)
 	return ctrl
 }
 
@@ -155,7 +119,6 @@ var fakeApp = `
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  uid: "123"
   name: my-app
   namespace: ` + test.FakeArgoCDNamespace + `
 spec:
@@ -192,17 +155,6 @@ status:
         repoURL: https://github.com/argoproj/argocd-example-apps.git
 `
 
-var fakeStrayResource = `
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: test-cm
-  namespace: invalid
-  labels:
-    app.kubernetes.io/instance: my-app
-data:
-`
-
 func newFakeApp() *argoappv1.Application {
 	var app argoappv1.Application
 	err := yaml.Unmarshal([]byte(fakeApp), &app)
@@ -212,15 +164,6 @@ func newFakeApp() *argoappv1.Application {
 	return &app
 }
 
-func newFakeCM() map[string]interface{} {
-	var cm map[string]interface{}
-	err := yaml.Unmarshal([]byte(fakeStrayResource), &cm)
-	if err != nil {
-		panic(err)
-	}
-	return cm
-}
-
 func TestAutoSync(t *testing.T) {
 	app := newFakeApp()
 	ctrl := newFakeController(&fakeData{apps: []runtime.Object{app}})
@@ -228,7 +171,7 @@ func TestAutoSync(t *testing.T) {
 		Status:   argoappv1.SyncStatusCodeOutOfSync,
 		Revision: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
 	}
-	cond := ctrl.autoSync(app, &syncStatus, []argoappv1.ResourceStatus{{Name: "guestbook", Kind: kube.DeploymentKind, Status: argoappv1.SyncStatusCodeOutOfSync}})
+	cond := ctrl.autoSync(app, &syncStatus)
 	assert.Nil(t, cond)
 	app, err := ctrl.applicationClientset.ArgoprojV1alpha1().Applications(test.FakeArgoCDNamespace).Get("my-app", metav1.GetOptions{})
 	assert.NoError(t, err)
@@ -240,37 +183,37 @@ func TestAutoSync(t *testing.T) {
 func TestSkipAutoSync(t *testing.T) {
 	// Verify we skip when we previously synced to it in our most recent history
 	// Set current to 'aaaaa', desired to 'aaaa' and mark system OutOfSync
-	t.Run("PreviouslySyncedToRevision", func(t *testing.T) {
+	{
 		app := newFakeApp()
 		ctrl := newFakeController(&fakeData{apps: []runtime.Object{app}})
 		syncStatus := argoappv1.SyncStatus{
 			Status:   argoappv1.SyncStatusCodeOutOfSync,
 			Revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
 		}
-		cond := ctrl.autoSync(app, &syncStatus, []argoappv1.ResourceStatus{})
+		cond := ctrl.autoSync(app, &syncStatus)
 		assert.Nil(t, cond)
 		app, err := ctrl.applicationClientset.ArgoprojV1alpha1().Applications(test.FakeArgoCDNamespace).Get("my-app", metav1.GetOptions{})
 		assert.NoError(t, err)
 		assert.Nil(t, app.Operation)
-	})
+	}
 
 	// Verify we skip when we are already Synced (even if revision is different)
-	t.Run("AlreadyInSyncedState", func(t *testing.T) {
+	{
 		app := newFakeApp()
 		ctrl := newFakeController(&fakeData{apps: []runtime.Object{app}})
 		syncStatus := argoappv1.SyncStatus{
 			Status:   argoappv1.SyncStatusCodeSynced,
 			Revision: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
 		}
-		cond := ctrl.autoSync(app, &syncStatus, []argoappv1.ResourceStatus{})
+		cond := ctrl.autoSync(app, &syncStatus)
 		assert.Nil(t, cond)
 		app, err := ctrl.applicationClientset.ArgoprojV1alpha1().Applications(test.FakeArgoCDNamespace).Get("my-app", metav1.GetOptions{})
 		assert.NoError(t, err)
 		assert.Nil(t, app.Operation)
-	})
+	}
 
 	// Verify we skip when auto-sync is disabled
-	t.Run("AutoSyncIsDisabled", func(t *testing.T) {
+	{
 		app := newFakeApp()
 		app.Spec.SyncPolicy = nil
 		ctrl := newFakeController(&fakeData{apps: []runtime.Object{app}})
@@ -278,15 +221,15 @@ func TestSkipAutoSync(t *testing.T) {
 			Status:   argoappv1.SyncStatusCodeOutOfSync,
 			Revision: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
 		}
-		cond := ctrl.autoSync(app, &syncStatus, []argoappv1.ResourceStatus{})
+		cond := ctrl.autoSync(app, &syncStatus)
 		assert.Nil(t, cond)
 		app, err := ctrl.applicationClientset.ArgoprojV1alpha1().Applications(test.FakeArgoCDNamespace).Get("my-app", metav1.GetOptions{})
 		assert.NoError(t, err)
 		assert.Nil(t, app.Operation)
-	})
+	}
 
 	// Verify we skip when application is marked for deletion
-	t.Run("ApplicationIsMarkedForDeletion", func(t *testing.T) {
+	{
 		app := newFakeApp()
 		now := metav1.Now()
 		app.DeletionTimestamp = &now
@@ -295,16 +238,16 @@ func TestSkipAutoSync(t *testing.T) {
 			Status:   argoappv1.SyncStatusCodeOutOfSync,
 			Revision: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
 		}
-		cond := ctrl.autoSync(app, &syncStatus, []argoappv1.ResourceStatus{})
+		cond := ctrl.autoSync(app, &syncStatus)
 		assert.Nil(t, cond)
 		app, err := ctrl.applicationClientset.ArgoprojV1alpha1().Applications(test.FakeArgoCDNamespace).Get("my-app", metav1.GetOptions{})
 		assert.NoError(t, err)
 		assert.Nil(t, app.Operation)
-	})
+	}
 
 	// Verify we skip when previous sync attempt failed and return error condition
 	// Set current to 'aaaaa', desired to 'bbbbb' and add 'bbbbb' to failure history
-	t.Run("PreviousSyncAttemptFailed", func(t *testing.T) {
+	{
 		app := newFakeApp()
 		app.Status.OperationState = &argoappv1.OperationState{
 			Operation: argoappv1.Operation{
@@ -321,28 +264,12 @@ func TestSkipAutoSync(t *testing.T) {
 			Status:   argoappv1.SyncStatusCodeOutOfSync,
 			Revision: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
 		}
-		cond := ctrl.autoSync(app, &syncStatus, []argoappv1.ResourceStatus{{Name: "guestbook", Kind: kube.DeploymentKind, Status: argoappv1.SyncStatusCodeOutOfSync}})
+		cond := ctrl.autoSync(app, &syncStatus)
 		assert.NotNil(t, cond)
 		app, err := ctrl.applicationClientset.ArgoprojV1alpha1().Applications(test.FakeArgoCDNamespace).Get("my-app", metav1.GetOptions{})
 		assert.NoError(t, err)
 		assert.Nil(t, app.Operation)
-	})
-
-	t.Run("NeedsToPruneResourcesOnlyButAutomatedPruneDisabled", func(t *testing.T) {
-		app := newFakeApp()
-		ctrl := newFakeController(&fakeData{apps: []runtime.Object{app}})
-		syncStatus := argoappv1.SyncStatus{
-			Status:   argoappv1.SyncStatusCodeOutOfSync,
-			Revision: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-		}
-		cond := ctrl.autoSync(app, &syncStatus, []argoappv1.ResourceStatus{
-			{Name: "guestbook", Kind: kube.DeploymentKind, Status: argoappv1.SyncStatusCodeOutOfSync, RequiresPruning: true},
-		})
-		assert.Nil(t, cond)
-		app, err := ctrl.applicationClientset.ArgoprojV1alpha1().Applications(test.FakeArgoCDNamespace).Get("my-app", metav1.GetOptions{})
-		assert.NoError(t, err)
-		assert.Nil(t, app.Operation)
-	})
+	}
 }
 
 // TestAutoSyncIndicateError verifies we skip auto-sync and return error condition if previous sync failed
@@ -373,7 +300,7 @@ func TestAutoSyncIndicateError(t *testing.T) {
 			Source:   *app.Spec.Source.DeepCopy(),
 		},
 	}
-	cond := ctrl.autoSync(app, &syncStatus, []argoappv1.ResourceStatus{{Name: "guestbook", Kind: kube.DeploymentKind, Status: argoappv1.SyncStatusCodeOutOfSync}})
+	cond := ctrl.autoSync(app, &syncStatus)
 	assert.NotNil(t, cond)
 	app, err := ctrl.applicationClientset.ArgoprojV1alpha1().Applications(test.FakeArgoCDNamespace).Get("my-app", metav1.GetOptions{})
 	assert.NoError(t, err)
@@ -416,7 +343,7 @@ func TestAutoSyncParameterOverrides(t *testing.T) {
 			Revision: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
 		},
 	}
-	cond := ctrl.autoSync(app, &syncStatus, []argoappv1.ResourceStatus{{Name: "guestbook", Kind: kube.DeploymentKind, Status: argoappv1.SyncStatusCodeOutOfSync}})
+	cond := ctrl.autoSync(app, &syncStatus)
 	assert.Nil(t, cond)
 	app, err := ctrl.applicationClientset.ArgoprojV1alpha1().Applications(test.FakeArgoCDNamespace).Get("my-app", metav1.GetOptions{})
 	assert.NoError(t, err)
@@ -425,118 +352,21 @@ func TestAutoSyncParameterOverrides(t *testing.T) {
 
 // TestFinalizeAppDeletion verifies application deletion
 func TestFinalizeAppDeletion(t *testing.T) {
-	// Ensure app can be deleted cascading
-	{
-		defaultProj := argoappv1.AppProject{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "default",
-				Namespace: test.FakeArgoCDNamespace,
-			},
-			Spec: argoappv1.AppProjectSpec{
-				SourceRepos: []string{"*"},
-				Destinations: []argoappv1.ApplicationDestination{
-					{
-						Server:    "*",
-						Namespace: "*",
-					},
-				},
-			},
-		}
-		app := newFakeApp()
-		app.Spec.Destination.Namespace = test.FakeArgoCDNamespace
-		appObj := kube.MustToUnstructured(&app)
-		ctrl := newFakeController(&fakeData{apps: []runtime.Object{app, &defaultProj}, managedLiveObjs: map[kube.ResourceKey]*unstructured.Unstructured{
-			kube.GetResourceKey(appObj): appObj,
-		}})
+	app := newFakeApp()
+	ctrl := newFakeController(&fakeData{apps: []runtime.Object{app}})
 
-		patched := false
-		fakeAppCs := ctrl.applicationClientset.(*appclientset.Clientset)
-		defaultReactor := fakeAppCs.ReactionChain[0]
-		fakeAppCs.ReactionChain = nil
-		fakeAppCs.AddReactor("get", "*", func(action kubetesting.Action) (handled bool, ret runtime.Object, err error) {
-			return defaultReactor.React(action)
-		})
-		fakeAppCs.AddReactor("patch", "*", func(action kubetesting.Action) (handled bool, ret runtime.Object, err error) {
-			patched = true
-			return true, nil, nil
-		})
-		_, err := ctrl.finalizeApplicationDeletion(app)
-		assert.NoError(t, err)
-		assert.True(t, patched)
-	}
-
-	// Ensure any stray resources irregulary labeled with instance label of app are not deleted upon deleting,
-	// when app project restriction is in place
-	{
-		defaultProj := argoappv1.AppProject{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "default",
-				Namespace: test.FakeArgoCDNamespace,
-			},
-			Spec: argoappv1.AppProjectSpec{
-				SourceRepos: []string{"*"},
-				Destinations: []argoappv1.ApplicationDestination{
-					{
-						Server:    "*",
-						Namespace: "*",
-					},
-				},
-			},
-		}
-		restrictedProj := argoappv1.AppProject{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "restricted",
-				Namespace: test.FakeArgoCDNamespace,
-			},
-			Spec: argoappv1.AppProjectSpec{
-				SourceRepos: []string{"*"},
-				Destinations: []argoappv1.ApplicationDestination{
-					{
-						Server:    "*",
-						Namespace: "my-app",
-					},
-				},
-			},
-		}
-		app := newFakeApp()
-		app.Spec.Destination.Namespace = test.FakeArgoCDNamespace
-		app.Spec.Project = "restricted"
-		appObj := kube.MustToUnstructured(&app)
-		cm := newFakeCM()
-		strayObj := kube.MustToUnstructured(&cm)
-		ctrl := newFakeController(&fakeData{
-			apps: []runtime.Object{app, &defaultProj, &restrictedProj},
-			managedLiveObjs: map[kube.ResourceKey]*unstructured.Unstructured{
-				kube.GetResourceKey(appObj):   appObj,
-				kube.GetResourceKey(strayObj): strayObj,
-			},
-		})
-
-		patched := false
-		fakeAppCs := ctrl.applicationClientset.(*appclientset.Clientset)
-		defaultReactor := fakeAppCs.ReactionChain[0]
-		fakeAppCs.ReactionChain = nil
-		fakeAppCs.AddReactor("get", "*", func(action kubetesting.Action) (handled bool, ret runtime.Object, err error) {
-			return defaultReactor.React(action)
-		})
-		fakeAppCs.AddReactor("patch", "*", func(action kubetesting.Action) (handled bool, ret runtime.Object, err error) {
-			patched = true
-			return true, nil, nil
-		})
-		objs, err := ctrl.finalizeApplicationDeletion(app)
-		assert.NoError(t, err)
-		assert.True(t, patched)
-		objsMap, err := ctrl.stateCache.GetManagedLiveObjs(app, []*unstructured.Unstructured{})
-		if err != nil {
-			assert.NoError(t, err)
-		}
-		// Managed objects must be empty
-		assert.Empty(t, objsMap)
-		// Loop through all deleted objects, ensure that test-cm is none of them
-		for _, o := range objs {
-			assert.NotEqual(t, "test-cm", o.GetName())
-		}
-	}
+	fakeAppCs := ctrl.applicationClientset.(*appclientset.Clientset)
+	patched := false
+	fakeAppCs.ReactionChain = nil
+	fakeAppCs.AddReactor("patch", "*", func(action kubetesting.Action) (handled bool, ret runtime.Object, err error) {
+		patched = true
+		return true, nil, nil
+	})
+	err := ctrl.finalizeApplicationDeletion(app)
+	// TODO: use an interface to fake out the calls to GetResourcesWithLabel and DeleteResourceWithLabel
+	// For now just ensure we have an expected error condition
+	assert.Error(t, err)     // Change this to assert.Nil when we stub out GetResourcesWithLabel/DeleteResourceWithLabel
+	assert.False(t, patched) // Change this to assert.True when we stub out GetResourcesWithLabel/DeleteResourceWithLabel
 }
 
 // TestNormalizeApplication verifies we normalize an application during reconciliation
@@ -561,7 +391,7 @@ func TestNormalizeApplication(t *testing.T) {
 	app.Spec.Source.Kustomize = &argoappv1.ApplicationSourceKustomize{NamePrefix: "foo-"}
 	data := fakeData{
 		apps: []runtime.Object{app, &defaultProj},
-		manifestResponse: &apiclient.ManifestResponse{
+		manifestResponse: &repository.ManifestResponse{
 			Manifests: []string{},
 			Namespace: test.FakeDestNamespace,
 			Server:    test.FakeClusterURL,
@@ -612,253 +442,3 @@ func TestNormalizeApplication(t *testing.T) {
 		assert.False(t, normalized)
 	}
 }
-
-func TestHandleAppUpdated(t *testing.T) {
-	app := newFakeApp()
-	app.Spec.Destination.Namespace = test.FakeArgoCDNamespace
-	app.Spec.Destination.Server = common.KubernetesInternalAPIServerAddr
-	ctrl := newFakeController(&fakeData{apps: []runtime.Object{app}})
-
-	ctrl.handleObjectUpdated(map[string]bool{app.Name: true}, kube.GetObjectRef(kube.MustToUnstructured(app)))
-	isRequested, level := ctrl.isRefreshRequested(app.Name)
-	assert.False(t, isRequested)
-	assert.Equal(t, ComparisonWithNothing, level)
-
-	ctrl.handleObjectUpdated(map[string]bool{app.Name: true}, corev1.ObjectReference{UID: "test", Kind: kube.DeploymentKind, Name: "test", Namespace: "default"})
-	isRequested, level = ctrl.isRefreshRequested(app.Name)
-	assert.True(t, isRequested)
-	assert.Equal(t, CompareWithRecent, level)
-}
-
-func TestHandleOrphanedResourceUpdated(t *testing.T) {
-	app1 := newFakeApp()
-	app1.Name = "app1"
-	app1.Spec.Destination.Namespace = test.FakeArgoCDNamespace
-	app1.Spec.Destination.Server = common.KubernetesInternalAPIServerAddr
-
-	app2 := newFakeApp()
-	app2.Name = "app2"
-	app2.Spec.Destination.Namespace = test.FakeArgoCDNamespace
-	app2.Spec.Destination.Server = common.KubernetesInternalAPIServerAddr
-
-	proj := defaultProj.DeepCopy()
-	proj.Spec.OrphanedResources = &argoappv1.OrphanedResourcesMonitorSettings{}
-
-	ctrl := newFakeController(&fakeData{apps: []runtime.Object{app1, app2, proj}})
-
-	ctrl.handleObjectUpdated(map[string]bool{}, corev1.ObjectReference{UID: "test", Kind: kube.DeploymentKind, Name: "test", Namespace: test.FakeArgoCDNamespace})
-
-	isRequested, level := ctrl.isRefreshRequested(app1.Name)
-	assert.True(t, isRequested)
-	assert.Equal(t, ComparisonWithNothing, level)
-
-	isRequested, level = ctrl.isRefreshRequested(app2.Name)
-	assert.True(t, isRequested)
-	assert.Equal(t, ComparisonWithNothing, level)
-}
-
-func TestSetOperationStateOnDeletedApp(t *testing.T) {
-	ctrl := newFakeController(&fakeData{apps: []runtime.Object{}})
-	fakeAppCs := ctrl.applicationClientset.(*appclientset.Clientset)
-	fakeAppCs.ReactionChain = nil
-	patched := false
-	fakeAppCs.AddReactor("patch", "*", func(action kubetesting.Action) (handled bool, ret runtime.Object, err error) {
-		patched = true
-		return true, nil, apierr.NewNotFound(schema.GroupResource{}, "my-app")
-	})
-	ctrl.setOperationState(newFakeApp(), &argoappv1.OperationState{Phase: argoappv1.OperationSucceeded})
-	assert.True(t, patched)
-}
-
-func TestNeedRefreshAppStatus(t *testing.T) {
-	ctrl := newFakeController(&fakeData{apps: []runtime.Object{}})
-
-	app := newFakeApp()
-	now := metav1.Now()
-	app.Status.ReconciledAt = &now
-	app.Status.Sync = argoappv1.SyncStatus{
-		Status: argoappv1.SyncStatusCodeSynced,
-		ComparedTo: argoappv1.ComparedTo{
-			Source:      app.Spec.Source,
-			Destination: app.Spec.Destination,
-		},
-	}
-
-	// no need to refresh just reconciled application
-	needRefresh, _, _ := ctrl.needRefreshAppStatus(app, 1*time.Hour)
-	assert.False(t, needRefresh)
-
-	// refresh app using the 'deepest' requested comparison level
-	ctrl.requestAppRefresh(app.Name, CompareWithRecent.Pointer(), nil)
-	ctrl.requestAppRefresh(app.Name, ComparisonWithNothing.Pointer(), nil)
-
-	needRefresh, refreshType, compareWith := ctrl.needRefreshAppStatus(app, 1*time.Hour)
-	assert.True(t, needRefresh)
-	assert.Equal(t, argoappv1.RefreshTypeNormal, refreshType)
-	assert.Equal(t, CompareWithRecent, compareWith)
-
-	// refresh application which status is not reconciled using latest commit
-	app.Status.Sync = argoappv1.SyncStatus{Status: argoappv1.SyncStatusCodeUnknown}
-
-	needRefresh, refreshType, compareWith = ctrl.needRefreshAppStatus(app, 1*time.Hour)
-	assert.True(t, needRefresh)
-	assert.Equal(t, argoappv1.RefreshTypeNormal, refreshType)
-	assert.Equal(t, CompareWithLatest, compareWith)
-
-	{
-		// refresh app using the 'latest' level if comparison expired
-		app := app.DeepCopy()
-		ctrl.requestAppRefresh(app.Name, CompareWithRecent.Pointer(), nil)
-		reconciledAt := metav1.NewTime(time.Now().UTC().Add(-1 * time.Hour))
-		app.Status.ReconciledAt = &reconciledAt
-		needRefresh, refreshType, compareWith = ctrl.needRefreshAppStatus(app, 1*time.Minute)
-		assert.True(t, needRefresh)
-		assert.Equal(t, argoappv1.RefreshTypeNormal, refreshType)
-		assert.Equal(t, CompareWithLatest, compareWith)
-	}
-
-	{
-		app := app.DeepCopy()
-		// execute hard refresh if app has refresh annotation
-		reconciledAt := metav1.NewTime(time.Now().UTC().Add(-1 * time.Hour))
-		app.Status.ReconciledAt = &reconciledAt
-		app.Annotations = map[string]string{
-			common.AnnotationKeyRefresh: string(argoappv1.RefreshTypeHard),
-		}
-		needRefresh, refreshType, compareWith = ctrl.needRefreshAppStatus(app, 1*time.Hour)
-		assert.True(t, needRefresh)
-		assert.Equal(t, argoappv1.RefreshTypeHard, refreshType)
-		assert.Equal(t, CompareWithLatest, compareWith)
-	}
-
-	{
-		app := app.DeepCopy()
-		// ensure that CompareWithLatest level is used if application source has changed
-		ctrl.requestAppRefresh(app.Name, ComparisonWithNothing.Pointer(), nil)
-		// sample app source change
-		app.Spec.Source.Helm = &argoappv1.ApplicationSourceHelm{
-			Parameters: []argoappv1.HelmParameter{{
-				Name:  "foo",
-				Value: "bar",
-			}},
-		}
-
-		needRefresh, refreshType, compareWith = ctrl.needRefreshAppStatus(app, 1*time.Hour)
-		assert.True(t, needRefresh)
-		assert.Equal(t, argoappv1.RefreshTypeNormal, refreshType)
-		assert.Equal(t, CompareWithLatest, compareWith)
-	}
-}
-
-func TestRefreshAppConditions(t *testing.T) {
-	defaultProj := argoappv1.AppProject{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "default",
-			Namespace: test.FakeArgoCDNamespace,
-		},
-		Spec: argoappv1.AppProjectSpec{
-			SourceRepos: []string{"*"},
-			Destinations: []argoappv1.ApplicationDestination{
-				{
-					Server:    "*",
-					Namespace: "*",
-				},
-			},
-		},
-	}
-
-	t.Run("NoErrorConditions", func(t *testing.T) {
-		app := newFakeApp()
-		ctrl := newFakeController(&fakeData{apps: []runtime.Object{app, &defaultProj}})
-
-		_, hasErrors := ctrl.refreshAppConditions(app)
-		assert.False(t, hasErrors)
-		assert.Len(t, app.Status.Conditions, 0)
-	})
-
-	t.Run("PreserveExistingWarningCondition", func(t *testing.T) {
-		app := newFakeApp()
-		app.Status.SetConditions([]argoappv1.ApplicationCondition{{Type: argoappv1.ApplicationConditionExcludedResourceWarning}}, nil)
-
-		ctrl := newFakeController(&fakeData{apps: []runtime.Object{app, &defaultProj}})
-
-		_, hasErrors := ctrl.refreshAppConditions(app)
-		assert.False(t, hasErrors)
-		assert.Len(t, app.Status.Conditions, 1)
-		assert.Equal(t, argoappv1.ApplicationConditionExcludedResourceWarning, app.Status.Conditions[0].Type)
-	})
-
-	t.Run("ReplacesSpecErrorCondition", func(t *testing.T) {
-		app := newFakeApp()
-		app.Spec.Project = "wrong project"
-		app.Status.SetConditions([]argoappv1.ApplicationCondition{{Type: argoappv1.ApplicationConditionInvalidSpecError, Message: "old message"}}, nil)
-
-		ctrl := newFakeController(&fakeData{apps: []runtime.Object{app, &defaultProj}})
-
-		_, hasErrors := ctrl.refreshAppConditions(app)
-		assert.True(t, hasErrors)
-		assert.Len(t, app.Status.Conditions, 1)
-		assert.Equal(t, argoappv1.ApplicationConditionInvalidSpecError, app.Status.Conditions[0].Type)
-		assert.Equal(t, "Application referencing project wrong project which does not exist", app.Status.Conditions[0].Message)
-	})
-}
-
-func TestUpdateReconciledAt(t *testing.T) {
-	app := newFakeApp()
-	reconciledAt := metav1.NewTime(time.Now().Add(-1 * time.Second))
-	app.Status = argoappv1.ApplicationStatus{ReconciledAt: &reconciledAt}
-	app.Status.Sync = argoappv1.SyncStatus{ComparedTo: argoappv1.ComparedTo{Source: app.Spec.Source, Destination: app.Spec.Destination}}
-	ctrl := newFakeController(&fakeData{
-		apps: []runtime.Object{app, &defaultProj},
-		manifestResponse: &apiclient.ManifestResponse{
-			Manifests: []string{},
-			Namespace: test.FakeDestNamespace,
-			Server:    test.FakeClusterURL,
-			Revision:  "abc123",
-		},
-		managedLiveObjs: make(map[kube.ResourceKey]*unstructured.Unstructured),
-	})
-	key, _ := cache.MetaNamespaceKeyFunc(app)
-	fakeAppCs := ctrl.applicationClientset.(*appclientset.Clientset)
-	fakeAppCs.ReactionChain = nil
-	receivedPatch := map[string]interface{}{}
-	fakeAppCs.AddReactor("patch", "*", func(action kubetesting.Action) (handled bool, ret runtime.Object, err error) {
-		if patchAction, ok := action.(kubetesting.PatchAction); ok {
-			assert.NoError(t, json.Unmarshal(patchAction.GetPatch(), &receivedPatch))
-		}
-		return true, nil, nil
-	})
-
-	t.Run("UpdatedOnFullReconciliation", func(t *testing.T) {
-		receivedPatch = map[string]interface{}{}
-		ctrl.requestAppRefresh(app.Name, CompareWithLatest.Pointer(), nil)
-		ctrl.appRefreshQueue.Add(key)
-
-		ctrl.processAppRefreshQueueItem()
-
-		_, updated, err := unstructured.NestedString(receivedPatch, "status", "reconciledAt")
-		assert.NoError(t, err)
-		assert.True(t, updated)
-
-		_, updated, err = unstructured.NestedString(receivedPatch, "status", "observedAt")
-		assert.NoError(t, err)
-		assert.True(t, updated)
-	})
-
-	t.Run("NotUpdatedOnPartialReconciliation", func(t *testing.T) {
-		receivedPatch = map[string]interface{}{}
-		ctrl.appRefreshQueue.Add(key)
-		ctrl.requestAppRefresh(app.Name, CompareWithRecent.Pointer(), nil)
-
-		ctrl.processAppRefreshQueueItem()
-
-		_, updated, err := unstructured.NestedString(receivedPatch, "status", "reconciledAt")
-		assert.NoError(t, err)
-		assert.False(t, updated)
-
-		_, updated, err = unstructured.NestedString(receivedPatch, "status", "observedAt")
-		assert.NoError(t, err)
-		assert.True(t, updated)
-	})
-
-}

controller/cache/cache.go

@@ -2,18 +2,14 @@ package cache
 
 import (
 	"context"
-	"reflect"
 	"sync"
 
 	log "github.com/sirupsen/logrus"
-	v1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/watch"
 	"k8s.io/client-go/tools/cache"
 
-	"github.com/argoproj/argo-cd/controller/metrics"
 	appv1 "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
 	"github.com/argoproj/argo-cd/util"
 	"github.com/argoproj/argo-cd/util/db"
@@ -21,33 +17,20 @@ import (
 	"github.com/argoproj/argo-cd/util/settings"
 )
 
-type cacheSettings struct {
-	ResourceOverrides   map[string]appv1.ResourceOverride
-	AppInstanceLabelKey string
-	ResourcesFilter     *settings.ResourcesFilter
-}
-
 type LiveStateCache interface {
-	// Returns k8s server version
-	GetVersionsInfo(serverURL string) (string, []metav1.APIGroup, error)
-	// Returns true of given group kind is a namespaced resource
-	IsNamespaced(server string, gk schema.GroupKind) (bool, error)
-	// Executes give callback against resource specified by the key and all its children
-	IterateHierarchy(server string, key kube.ResourceKey, action func(child appv1.ResourceNode, appName string)) error
+	IsNamespaced(server string, obj *unstructured.Unstructured) (bool, error)
+	// Returns child nodes for a given k8s resource
+	GetChildren(server string, obj *unstructured.Unstructured) ([]appv1.ResourceNode, error)
 	// Returns state of live nodes which correspond for target nodes of specified application.
 	GetManagedLiveObjs(a *appv1.Application, targetObjs []*unstructured.Unstructured) (map[kube.ResourceKey]*unstructured.Unstructured, error)
-	// Returns all top level resources (resources without owner references) of a specified namespace
-	GetNamespaceTopLevelResources(server string, namespace string) (map[kube.ResourceKey]appv1.ResourceNode, error)
 	// Starts watching resources of each controlled cluster.
-	Run(ctx context.Context) error
+	Run(ctx context.Context)
+	// Deletes specified resource from cluster.
+	Delete(server string, obj *unstructured.Unstructured) error
 	// Invalidate invalidates the entire cluster state cache
 	Invalidate()
-	// Returns information about monitored clusters
-	GetClustersInfo() []metrics.ClusterInfo
 }
 
-type ObjectUpdatedHandler = func(managedByApp map[string]bool, ref v1.ObjectReference)
-
 func GetTargetObjKey(a *appv1.Application, un *unstructured.Unstructured, isNamespaced bool) kube.ResourceKey {
 	key := kube.GetResourceKey(un)
 	if !isNamespaced {
@@ -59,98 +42,61 @@ func GetTargetObjKey(a *appv1.Application, un *unstructured.Unstructured, isName
 	return key
 }
 
-func NewLiveStateCache(
-	db db.ArgoDB,
-	appInformer cache.SharedIndexInformer,
-	settingsMgr *settings.SettingsManager,
-	kubectl kube.Kubectl,
-	metricsServer *metrics.MetricsServer,
-	onObjectUpdated ObjectUpdatedHandler) LiveStateCache {
-
+func NewLiveStateCache(db db.ArgoDB, appInformer cache.SharedIndexInformer, settings *settings.ArgoCDSettings, kubectl kube.Kubectl, onAppUpdated func(appName string, fullRefresh bool)) LiveStateCache {
 	return &liveStateCache{
-		appInformer:       appInformer,
-		db:                db,
-		clusters:          make(map[string]*clusterInfo),
-		lock:              &sync.RWMutex{},
-		onObjectUpdated:   onObjectUpdated,
-		kubectl:           kubectl,
-		settingsMgr:       settingsMgr,
-		metricsServer:     metricsServer,
-		cacheSettingsLock: &sync.Mutex{},
+		appInformer:  appInformer,
+		db:           db,
+		clusters:     make(map[string]*clusterInfo),
+		lock:         &sync.Mutex{},
+		onAppUpdated: onAppUpdated,
+		kubectl:      kubectl,
+		settings:     settings,
 	}
 }
 
 type liveStateCache struct {
-	db                db.ArgoDB
-	clusters          map[string]*clusterInfo
-	lock              *sync.RWMutex
-	appInformer       cache.SharedIndexInformer
-	onObjectUpdated   ObjectUpdatedHandler
-	kubectl           kube.Kubectl
-	settingsMgr       *settings.SettingsManager
-	metricsServer     *metrics.MetricsServer
-	cacheSettingsLock *sync.Mutex
-	cacheSettings     *cacheSettings
+	db           db.ArgoDB
+	clusters     map[string]*clusterInfo
+	lock         *sync.Mutex
+	appInformer  cache.SharedIndexInformer
+	onAppUpdated func(appName string, fullRefresh bool)
+	kubectl      kube.Kubectl
+	settings     *settings.ArgoCDSettings
 }
 
-func (c *liveStateCache) loadCacheSettings() (*cacheSettings, error) {
-	appInstanceLabelKey, err := c.settingsMgr.GetAppInstanceLabelKey()
+func (c *liveStateCache) processEvent(event watch.EventType, obj *unstructured.Unstructured, url string) error {
+	info, err := c.getSyncedCluster(url)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	resourcesFilter, err := c.settingsMgr.GetResourcesFilter()
-	if err != nil {
-		return nil, err
-	}
-	resourceOverrides, err := c.settingsMgr.GetResourceOverrides()
-	if err != nil {
-		return nil, err
-	}
-	return &cacheSettings{AppInstanceLabelKey: appInstanceLabelKey, ResourceOverrides: resourceOverrides, ResourcesFilter: resourcesFilter}, nil
+	return info.processEvent(event, obj)
 }
 
 func (c *liveStateCache) getCluster(server string) (*clusterInfo, error) {
-	c.lock.RLock()
-	info, ok := c.clusters[server]
-	c.lock.RUnlock()
-
-	if ok {
-		return info, nil
-	}
-
 	c.lock.Lock()
 	defer c.lock.Unlock()
+	info, ok := c.clusters[server]
+	if !ok {
+		cluster, err := c.db.GetCluster(context.Background(), server)
+		if err != nil {
+			return nil, err
+		}
+		info = &clusterInfo{
+			apisMeta:     make(map[schema.GroupKind]*apiMeta),
+			lock:         &sync.Mutex{},
+			nodes:        make(map[kube.ResourceKey]*node),
+			nsIndex:      make(map[string]map[kube.ResourceKey]*node),
+			onAppUpdated: c.onAppUpdated,
+			kubectl:      c.kubectl,
+			cluster:      cluster,
+			syncTime:     nil,
+			syncLock:     &sync.Mutex{},
+			log:          log.WithField("server", cluster.Server),
+			settings:     c.settings,
+		}
 
-	info, ok = c.clusters[server]
-	if ok {
-		return info, nil
+		c.clusters[cluster.Server] = info
 	}
-
-	logCtx := log.WithField("server", server)
-	logCtx.Info("initializing cluster")
-	cluster, err := c.db.GetCluster(context.Background(), server)
-	if err != nil {
-		return nil, err
-	}
-	info = &clusterInfo{
-		apisMeta:         make(map[schema.GroupKind]*apiMeta),
-		lock:             &sync.RWMutex{},
-		nodes:            make(map[kube.ResourceKey]*node),
-		nsIndex:          make(map[string]map[kube.ResourceKey]*node),
-		onObjectUpdated:  c.onObjectUpdated,
-		kubectl:          c.kubectl,
-		cluster:          cluster,
-		syncTime:         nil,
-		log:              logCtx,
-		cacheSettingsSrc: c.getCacheSettings,
-		onEventReceived: func(event watch.EventType, un *unstructured.Unstructured) {
-			gvk := un.GroupVersionKind()
-			c.metricsServer.IncClusterEventsCount(cluster.Server, gvk.Group, gvk.Kind)
-		},
-		metricsServer: c.metricsServer,
-	}
-	c.clusters[cluster.Server] = info
-
 	return info, nil
 }
 
@@ -168,37 +114,38 @@ func (c *liveStateCache) getSyncedCluster(server string) (*clusterInfo, error) {
 
 func (c *liveStateCache) Invalidate() {
 	log.Info("invalidating live state cache")
-	c.lock.RLock()
-	defer c.lock.RLock()
+	c.lock.Lock()
+	defer c.lock.Unlock()
 	for _, clust := range c.clusters {
+		clust.lock.Lock()
 		clust.invalidate()
+		clust.lock.Unlock()
 	}
 	log.Info("live state cache invalidated")
 }
 
-func (c *liveStateCache) IsNamespaced(server string, gk schema.GroupKind) (bool, error) {
-	clusterInfo, err := c.getSyncedCluster(server)
-	if err != nil {
-		return false, err
-	}
-	return clusterInfo.isNamespaced(gk), nil
-}
-
-func (c *liveStateCache) IterateHierarchy(server string, key kube.ResourceKey, action func(child appv1.ResourceNode, appName string)) error {
+func (c *liveStateCache) Delete(server string, obj *unstructured.Unstructured) error {
 	clusterInfo, err := c.getSyncedCluster(server)
 	if err != nil {
 		return err
 	}
-	clusterInfo.iterateHierarchy(key, action)
-	return nil
+	return clusterInfo.delete(obj)
 }
 
-func (c *liveStateCache) GetNamespaceTopLevelResources(server string, namespace string) (map[kube.ResourceKey]appv1.ResourceNode, error) {
+func (c *liveStateCache) IsNamespaced(server string, obj *unstructured.Unstructured) (bool, error) {
+	clusterInfo, err := c.getSyncedCluster(server)
+	if err != nil {
+		return false, err
+	}
+	return clusterInfo.isNamespaced(obj), nil
+}
+
+func (c *liveStateCache) GetChildren(server string, obj *unstructured.Unstructured) ([]appv1.ResourceNode, error) {
 	clusterInfo, err := c.getSyncedCluster(server)
 	if err != nil {
 		return nil, err
 	}
-	return clusterInfo.getNamespaceTopLevelResources(namespace), nil
+	return clusterInfo.getChildren(obj), nil
 }
 
 func (c *liveStateCache) GetManagedLiveObjs(a *appv1.Application, targetObjs []*unstructured.Unstructured) (map[kube.ResourceKey]*unstructured.Unstructured, error) {
@@ -209,14 +156,6 @@ func (c *liveStateCache) GetManagedLiveObjs(a *appv1.Application, targetObjs []*
 	return clusterInfo.getManagedLiveObjs(a, targetObjs)
 }
 
-func (c *liveStateCache) GetVersionsInfo(serverURL string) (string, []metav1.APIGroup, error) {
-	clusterInfo, err := c.getSyncedCluster(serverURL)
-	if err != nil {
-		return "", nil, err
-	}
-	return clusterInfo.serverVersion, clusterInfo.apiGroups, nil
-}
-
 func isClusterHasApps(apps []interface{}, cluster *appv1.Cluster) bool {
 	for _, obj := range apps {
 		if app, ok := obj.(*appv1.Application); ok && app.Spec.Destination.Server == cluster.Server {
@@ -226,59 +165,13 @@ func isClusterHasApps(apps []interface{}, cluster *appv1.Cluster) bool {
 	return false
 }
 
-func (c *liveStateCache) getCacheSettings() *cacheSettings {
-	return c.cacheSettings
-}
-
-func (c *liveStateCache) watchSettings(ctx context.Context) {
-	updateCh := make(chan *settings.ArgoCDSettings, 1)
-	c.settingsMgr.Subscribe(updateCh)
-
-	done := false
-	for !done {
-		select {
-		case <-updateCh:
-			nextCacheSettings, err := c.loadCacheSettings()
-			if err != nil {
-				log.Warnf("Failed to read updated settings: %v", err)
-				continue
-			}
-
-			c.cacheSettingsLock.Lock()
-			needInvalidate := false
-			if !reflect.DeepEqual(c.cacheSettings, nextCacheSettings) {
-				c.cacheSettings = nextCacheSettings
-				needInvalidate = true
-			}
-			c.cacheSettingsLock.Unlock()
-			if needInvalidate {
-				c.Invalidate()
-			}
-		case <-ctx.Done():
-			done = true
-		}
-	}
-	log.Info("shutting down settings watch")
-	c.settingsMgr.Unsubscribe(updateCh)
-	close(updateCh)
-}
-
 // Run watches for resource changes annotated with application label on all registered clusters and schedule corresponding app refresh.
-func (c *liveStateCache) Run(ctx context.Context) error {
-	cacheSettings, err := c.loadCacheSettings()
-	if err != nil {
-		return err
-	}
-	c.cacheSettings = cacheSettings
-
-	go c.watchSettings(ctx)
-
+func (c *liveStateCache) Run(ctx context.Context) {
 	util.RetryUntilSucceed(func() error {
 		clusterEventCallback := func(event *db.ClusterEvent) {
 			c.lock.Lock()
-			cluster, ok := c.clusters[event.Cluster.Server]
-			if ok {
-				defer c.lock.Unlock()
+			defer c.lock.Unlock()
+			if cluster, ok := c.clusters[event.Cluster.Server]; ok {
 				if event.Type == watch.Deleted {
 					cluster.invalidate()
 					delete(c.clusters, event.Cluster.Server)
@@ -286,14 +179,11 @@ func (c *liveStateCache) Run(ctx context.Context) error {
 					cluster.cluster = event.Cluster
 					cluster.invalidate()
 				}
-			} else {
-				c.lock.Unlock()
-				if event.Type == watch.Added && isClusterHasApps(c.appInformer.GetStore().List(), event.Cluster) {
-					go func() {
-						// warm up cache for cluster with apps
-						_, _ = c.getSyncedCluster(event.Cluster.Server)
-					}()
-				}
+			} else if event.Type == watch.Added && isClusterHasApps(c.appInformer.GetStore().List(), event.Cluster) {
+				go func() {
+					// warm up cache for cluster with apps
+					_, _ = c.getSyncedCluster(event.Cluster.Server)
+				}()
 			}
 		}
 
@@ -302,15 +192,4 @@ func (c *liveStateCache) Run(ctx context.Context) error {
 	}, "watch clusters", ctx, clusterRetryTimeout)
 
 	<-ctx.Done()
-	return nil
-}
-
-func (c *liveStateCache) GetClustersInfo() []metrics.ClusterInfo {
-	c.lock.RLock()
-	defer c.lock.RUnlock()
-	res := make([]metrics.ClusterInfo, 0)
-	for _, info := range c.clusters {
-		res = append(res, info.getClusterInfo())
-	}
-	return res
 }

controller/cache/cache_test.go

@@ -1,26 +0,0 @@
-package cache
-
-import (
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetServerVersion(t *testing.T) {
-	now := time.Now()
-	cache := &liveStateCache{
-		lock: &sync.RWMutex{},
-		clusters: map[string]*clusterInfo{
-			"http://localhost": {
-				syncTime:      &now,
-				lock:          &sync.RWMutex{},
-				serverVersion: "123",
-			},
-		}}
-
-	version, _, err := cache.GetVersionsInfo("http://localhost")
-	assert.NoError(t, err)
-	assert.Equal(t, "123", version)
-}

controller/cache/cluster.go

@@ -4,28 +4,21 @@ import (
 	"context"
 	"fmt"
 	"runtime/debug"
-	"sort"
-	"strings"
 	"sync"
 	"time"
 
 	log "github.com/sirupsen/logrus"
+	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/watch"
-	"k8s.io/client-go/dynamic"
 
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/tools/pager"
-
-	"github.com/argoproj/argo-cd/controller/metrics"
 	appv1 "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
 	"github.com/argoproj/argo-cd/util"
-	"github.com/argoproj/argo-cd/util/health"
 	"github.com/argoproj/argo-cd/util/kube"
+	"github.com/argoproj/argo-cd/util/settings"
 )
 
 const (
@@ -41,51 +34,45 @@ type apiMeta struct {
 }
 
 type clusterInfo struct {
-	syncTime      *time.Time
-	syncError     error
-	apisMeta      map[schema.GroupKind]*apiMeta
-	serverVersion string
-	apiGroups     []metav1.APIGroup
-	// namespacedResources is a simple map which indicates a groupKind is namespaced
-	namespacedResources map[schema.GroupKind]bool
+	syncLock  *sync.Mutex
+	syncTime  *time.Time
+	syncError error
+	apisMeta  map[schema.GroupKind]*apiMeta
 
-	// lock is a rw lock which protects the fields of clusterInfo
-	lock    *sync.RWMutex
+	lock    *sync.Mutex
 	nodes   map[kube.ResourceKey]*node
 	nsIndex map[string]map[kube.ResourceKey]*node
 
-	onObjectUpdated  ObjectUpdatedHandler
-	onEventReceived  func(event watch.EventType, un *unstructured.Unstructured)
-	kubectl          kube.Kubectl
-	cluster          *appv1.Cluster
-	log              *log.Entry
-	cacheSettingsSrc func() *cacheSettings
-	metricsServer    *metrics.MetricsServer
+	onAppUpdated func(appName string, fullRefresh bool)
+	kubectl      kube.Kubectl
+	cluster      *appv1.Cluster
+	log          *log.Entry
+	settings     *settings.ArgoCDSettings
 }
 
-func (c *clusterInfo) replaceResourceCache(gk schema.GroupKind, resourceVersion string, objs []unstructured.Unstructured, ns string) {
+func (c *clusterInfo) replaceResourceCache(gk schema.GroupKind, resourceVersion string, objs []unstructured.Unstructured) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
 	info, ok := c.apisMeta[gk]
 	if ok {
-		objByKey := make(map[kube.ResourceKey]*unstructured.Unstructured)
+		objByKind := make(map[kube.ResourceKey]*unstructured.Unstructured)
 		for i := range objs {
-			objByKey[kube.GetResourceKey(&objs[i])] = &objs[i]
+			objByKind[kube.GetResourceKey(&objs[i])] = &objs[i]
 		}
 
-		// update existing nodes
 		for i := range objs {
 			obj := &objs[i]
 			key := kube.GetResourceKey(&objs[i])
 			existingNode, exists := c.nodes[key]
-			c.onNodeUpdated(exists, existingNode, obj)
+			c.onNodeUpdated(exists, existingNode, obj, key)
 		}
 
-		// remove existing nodes that a no longer exist
 		for key, existingNode := range c.nodes {
-			if key.Kind != gk.Kind || key.Group != gk.Group || ns != "" && key.Namespace != ns {
+			if key.Kind != gk.Kind || key.Group != gk.Group {
 				continue
 			}
 
-			if _, ok := objByKey[key]; !ok {
+			if _, ok := objByKind[key]; !ok {
 				c.onNodeRemoved(key, existingNode)
 			}
 		}
@@ -93,83 +80,33 @@ func (c *clusterInfo) replaceResourceCache(gk schema.GroupKind, resourceVersion
 	}
 }
 
-func isServiceAccountTokenSecret(un *unstructured.Unstructured) (bool, metav1.OwnerReference) {
-	ref := metav1.OwnerReference{
-		APIVersion: "v1",
-		Kind:       kube.ServiceAccountKind,
-	}
-	if un.GetKind() != kube.SecretKind || un.GroupVersionKind().Group != "" {
-		return false, ref
-	}
-
-	if typeVal, ok, err := unstructured.NestedString(un.Object, "type"); !ok || err != nil || typeVal != "kubernetes.io/service-account-token" {
-		return false, ref
-	}
-
-	annotations := un.GetAnnotations()
-	if annotations == nil {
-		return false, ref
-	}
-
-	id, okId := annotations["kubernetes.io/service-account.uid"]
-	name, okName := annotations["kubernetes.io/service-account.name"]
-	if okId && okName {
-		ref.Name = name
-		ref.UID = types.UID(id)
-	}
-	return ref.Name != "" && ref.UID != "", ref
-}
-
-func (c *clusterInfo) createObjInfo(un *unstructured.Unstructured, appInstanceLabel string) *node {
+func createObjInfo(un *unstructured.Unstructured, appInstanceLabel string) *node {
 	ownerRefs := un.GetOwnerReferences()
-	gvk := un.GroupVersionKind()
 	// Special case for endpoint. Remove after https://github.com/kubernetes/kubernetes/issues/28483 is fixed
-	if gvk.Group == "" && gvk.Kind == kube.EndpointsKind && len(un.GetOwnerReferences()) == 0 {
+	if un.GroupVersionKind().Group == "" && un.GetKind() == kube.EndpointsKind && len(un.GetOwnerReferences()) == 0 {
 		ownerRefs = append(ownerRefs, metav1.OwnerReference{
 			Name:       un.GetName(),
 			Kind:       kube.ServiceKind,
-			APIVersion: "v1",
+			APIVersion: "",
 		})
 	}
-
-	// Special case for Operator Lifecycle Manager ClusterServiceVersion:
-	if un.GroupVersionKind().Group == "operators.coreos.com" && un.GetKind() == "ClusterServiceVersion" {
-		if un.GetAnnotations()["olm.operatorGroup"] != "" {
-			ownerRefs = append(ownerRefs, metav1.OwnerReference{
-				Name:       un.GetAnnotations()["olm.operatorGroup"],
-				Kind:       "OperatorGroup",
-				APIVersion: "operators.coreos.com/v1",
-			})
-		}
-	}
-
-	// edge case. Consider auto-created service account tokens as a child of service account objects
-	if yes, ref := isServiceAccountTokenSecret(un); yes {
-		ownerRefs = append(ownerRefs, ref)
-	}
-
-	nodeInfo := &node{
+	info := &node{
 		resourceVersion: un.GetResourceVersion(),
-		ref:             kube.GetObjectRef(un),
-		ownerRefs:       ownerRefs,
+		ref: v1.ObjectReference{
+			APIVersion: un.GetAPIVersion(),
+			Kind:       un.GetKind(),
+			Name:       un.GetName(),
+			Namespace:  un.GetNamespace(),
+		},
+		ownerRefs: ownerRefs,
+		info:      getNodeInfo(un),
 	}
-
-	populateNodeInfo(un, nodeInfo)
 	appName := kube.GetAppInstanceLabel(un, appInstanceLabel)
 	if len(ownerRefs) == 0 && appName != "" {
-		nodeInfo.appName = appName
-		nodeInfo.resource = un
-	} else {
-		// edge case. we do not label CRDs, so they miss the tracking label we inject. But we still
-		// want the full resource to be available in our cache (to diff), so we store all CRDs
-		switch gvk.Kind {
-		case kube.CustomResourceDefinitionKind:
-			nodeInfo.resource = un
-		}
+		info.appName = appName
+		info.resource = un
 	}
-
-	nodeInfo.health, _ = health.GetResourceHealth(un, c.cacheSettingsSrc().ResourceOverrides)
-	return nodeInfo
+	return info
 }
 
 func (c *clusterInfo) setNode(n *node) {
@@ -194,80 +131,63 @@ func (c *clusterInfo) removeNode(key kube.ResourceKey) {
 }
 
 func (c *clusterInfo) invalidate() {
-	c.lock.Lock()
-	defer c.lock.Unlock()
+	c.syncLock.Lock()
+	defer c.syncLock.Unlock()
 	c.syncTime = nil
 	for i := range c.apisMeta {
 		c.apisMeta[i].watchCancel()
 	}
 	c.apisMeta = nil
-	c.namespacedResources = nil
-	c.log.Warnf("invalidated cluster")
 }
 
 func (c *clusterInfo) synced() bool {
-	syncTime := c.syncTime
-	if syncTime == nil {
+	if c.syncTime == nil {
 		return false
 	}
 	if c.syncError != nil {
-		return time.Now().Before(syncTime.Add(clusterRetryTimeout))
+		return time.Now().Before(c.syncTime.Add(clusterRetryTimeout))
 	}
-	return time.Now().Before(syncTime.Add(clusterSyncTimeout))
+	return time.Now().Before(c.syncTime.Add(clusterSyncTimeout))
 }
 
-func (c *clusterInfo) stopWatching(gk schema.GroupKind, ns string) {
-	c.lock.Lock()
-	defer c.lock.Unlock()
+func (c *clusterInfo) stopWatching(gk schema.GroupKind) {
+	c.syncLock.Lock()
+	defer c.syncLock.Unlock()
 	if info, ok := c.apisMeta[gk]; ok {
 		info.watchCancel()
 		delete(c.apisMeta, gk)
-		c.replaceResourceCache(gk, "", []unstructured.Unstructured{}, ns)
-		c.log.Warnf("Stop watching: %s not found", gk)
+		c.replaceResourceCache(gk, "", []unstructured.Unstructured{})
+		log.Warnf("Stop watching %s not found on %s.", gk, c.cluster.Server)
 	}
 }
 
 // startMissingWatches lists supported cluster resources and start watching for changes unless watch is already running
 func (c *clusterInfo) startMissingWatches() error {
-	config := c.cluster.RESTConfig()
 
-	apis, err := c.kubectl.GetAPIResources(config, c.cacheSettingsSrc().ResourcesFilter)
+	apis, err := c.kubectl.GetAPIResources(c.cluster.RESTConfig(), c.settings)
 	if err != nil {
 		return err
 	}
-	client, err := c.kubectl.NewDynamicClient(config)
-	if err != nil {
-		return err
-	}
-	namespacedResources := make(map[schema.GroupKind]bool)
+
 	for i := range apis {
 		api := apis[i]
-		namespacedResources[api.GroupKind] = api.Meta.Namespaced
 		if _, ok := c.apisMeta[api.GroupKind]; !ok {
 			ctx, cancel := context.WithCancel(context.Background())
 			info := &apiMeta{namespaced: api.Meta.Namespaced, watchCancel: cancel}
 			c.apisMeta[api.GroupKind] = info
-
-			err = c.processApi(client, api, func(resClient dynamic.ResourceInterface, ns string) error {
-				go c.watchEvents(ctx, api, info, resClient, ns)
-				return nil
-			})
-			if err != nil {
-				return err
-			}
+			go c.watchEvents(ctx, api, info)
 		}
 	}
-	c.namespacedResources = namespacedResources
 	return nil
 }
 
-func runSynced(lock sync.Locker, action func() error) error {
+func runSynced(lock *sync.Mutex, action func() error) error {
 	lock.Lock()
 	defer lock.Unlock()
 	return action()
 }
 
-func (c *clusterInfo) watchEvents(ctx context.Context, api kube.APIResourceInfo, info *apiMeta, resClient dynamic.ResourceInterface, ns string) {
+func (c *clusterInfo) watchEvents(ctx context.Context, api kube.APIResourceInfo, info *apiMeta) {
 	util.RetryUntilSucceed(func() (err error) {
 		defer func() {
 			if r := recover(); r != nil {
@@ -275,28 +195,13 @@ func (c *clusterInfo) watchEvents(ctx context.Context, api kube.APIResourceInfo,
 			}
 		}()
 
-		err = runSynced(c.lock, func() error {
+		err = runSynced(c.syncLock, func() error {
 			if info.resourceVersion == "" {
-				listPager := pager.New(func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
-					res, err := resClient.List(opts)
-					if err == nil {
-						info.resourceVersion = res.GetResourceVersion()
-					}
-					return res, err
-				})
-				var items []unstructured.Unstructured
-				err = listPager.EachListItem(ctx, metav1.ListOptions{}, func(obj runtime.Object) error {
-					if un, ok := obj.(*unstructured.Unstructured); !ok {
-						return fmt.Errorf("object %s/%s has an unexpected type", un.GroupVersionKind().String(), un.GetName())
-					} else {
-						items = append(items, *un)
-					}
-					return nil
-				})
+				list, err := api.Interface.List(metav1.ListOptions{})
 				if err != nil {
-					return fmt.Errorf("failed to load initial state of resource %s: %v", api.GroupKind.String(), err)
+					return err
 				}
-				c.replaceResourceCache(api.GroupKind, info.resourceVersion, items, ns)
+				c.replaceResourceCache(api.GroupKind, list.GetResourceVersion(), list.Items)
 			}
 			return nil
 		})
@@ -305,15 +210,20 @@ func (c *clusterInfo) watchEvents(ctx context.Context, api kube.APIResourceInfo,
 			return err
 		}
 
-		w, err := resClient.Watch(metav1.ListOptions{ResourceVersion: info.resourceVersion})
+		w, err := api.Interface.Watch(metav1.ListOptions{ResourceVersion: info.resourceVersion})
 		if errors.IsNotFound(err) {
-			c.stopWatching(api.GroupKind, ns)
+			c.stopWatching(api.GroupKind)
 			return nil
 		}
-		if errors.IsGone(err) {
-			info.resourceVersion = ""
-			c.log.Warnf("Resource version of %s is too old", api.GroupKind)
-		}
+
+		err = runSynced(c.syncLock, func() error {
+			if errors.IsGone(err) {
+				info.resourceVersion = ""
+				log.Warnf("Resource version of %s on %s is too old.", api.GroupKind, c.cluster.Server)
+			}
+			return err
+		})
+
 		if err != nil {
 			return err
 		}
@@ -326,7 +236,12 @@ func (c *clusterInfo) watchEvents(ctx context.Context, api kube.APIResourceInfo,
 				if ok {
 					obj := event.Object.(*unstructured.Unstructured)
 					info.resourceVersion = obj.GetResourceVersion()
-					c.processEvent(event.Type, obj)
+					err = c.processEvent(event.Type, obj)
+					if err != nil {
+						log.Warnf("Failed to process event %s %s/%s/%s: %v", event.Type, obj.GroupVersionKind(), obj.GetNamespace(), obj.GetName(), err)
+						continue
+					}
+
 					if kube.IsCRD(obj) {
 						if event.Type == watch.Deleted {
 							group, groupOk, groupErr := unstructured.NestedString(obj.Object, "spec", "group")
@@ -334,17 +249,17 @@ func (c *clusterInfo) watchEvents(ctx context.Context, api kube.APIResourceInfo,
 
 							if groupOk && groupErr == nil && kindOk && kindErr == nil {
 								gk := schema.GroupKind{Group: group, Kind: kind}
-								c.stopWatching(gk, ns)
+								c.stopWatching(gk)
 							}
 						} else {
-							err = runSynced(c.lock, func() error {
+							err = runSynced(c.syncLock, func() error {
 								return c.startMissingWatches()
 							})
 
 						}
 					}
 					if err != nil {
-						c.log.Warnf("Failed to start missing watch: %v", err)
+						log.Warnf("Failed to start missing watch: %v", err)
 					}
 				} else {
 					return fmt.Errorf("Watch %s on %s has closed", api.GroupKind, c.cluster.Server)
@@ -355,25 +270,6 @@ func (c *clusterInfo) watchEvents(ctx context.Context, api kube.APIResourceInfo,
 	}, fmt.Sprintf("watch %s on %s", api.GroupKind, c.cluster.Server), ctx, watchResourcesRetryTimeout)
 }
 
-func (c *clusterInfo) processApi(client dynamic.Interface, api kube.APIResourceInfo, callback func(resClient dynamic.ResourceInterface, ns string) error) error {
-	resClient := client.Resource(api.GroupVersionResource)
-	if len(c.cluster.Namespaces) == 0 {
-		return callback(resClient, "")
-	}
-
-	if !api.Meta.Namespaced {
-		return nil
-	}
-
-	for _, ns := range c.cluster.Namespaces {
-		err := callback(resClient.Namespace(ns), ns)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
 func (c *clusterInfo) sync() (err error) {
 
 	c.log.Info("Start syncing cluster")
@@ -383,70 +279,31 @@ func (c *clusterInfo) sync() (err error) {
 	}
 	c.apisMeta = make(map[schema.GroupKind]*apiMeta)
 	c.nodes = make(map[kube.ResourceKey]*node)
-	c.namespacedResources = make(map[schema.GroupKind]bool)
-	config := c.cluster.RESTConfig()
-	version, err := c.kubectl.GetServerVersion(config)
-	if err != nil {
-		return err
-	}
-	c.serverVersion = version
-	groups, err := c.kubectl.GetAPIGroups(config)
-	if err != nil {
-		return err
-	}
-	c.apiGroups = groups
 
-	apis, err := c.kubectl.GetAPIResources(config, c.cacheSettingsSrc().ResourcesFilter)
-	if err != nil {
-		return err
-	}
-	client, err := c.kubectl.NewDynamicClient(config)
+	apis, err := c.kubectl.GetAPIResources(c.cluster.RESTConfig(), c.settings)
 	if err != nil {
 		return err
 	}
 	lock := sync.Mutex{}
 	err = util.RunAllAsync(len(apis), func(i int) error {
 		api := apis[i]
+		list, err := api.Interface.List(metav1.ListOptions{})
+		if err != nil {
+			return err
+		}
 
 		lock.Lock()
-		ctx, cancel := context.WithCancel(context.Background())
-		info := &apiMeta{namespaced: api.Meta.Namespaced, watchCancel: cancel}
-		c.apisMeta[api.GroupKind] = info
-		c.namespacedResources[api.GroupKind] = api.Meta.Namespaced
+		for i := range list.Items {
+			c.setNode(createObjInfo(&list.Items[i], c.settings.GetAppInstanceLabelKey()))
+		}
 		lock.Unlock()
-
-		return c.processApi(client, api, func(resClient dynamic.ResourceInterface, ns string) error {
-
-			listPager := pager.New(func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
-				res, err := resClient.List(opts)
-				if err == nil {
-					lock.Lock()
-					info.resourceVersion = res.GetResourceVersion()
-					lock.Unlock()
-				}
-				return res, err
-			})
-
-			err = listPager.EachListItem(context.Background(), metav1.ListOptions{}, func(obj runtime.Object) error {
-				if un, ok := obj.(*unstructured.Unstructured); !ok {
-					return fmt.Errorf("object %s/%s has an unexpected type", un.GroupVersionKind().String(), un.GetName())
-				} else {
-					lock.Lock()
-					c.setNode(c.createObjInfo(un, c.cacheSettingsSrc().AppInstanceLabelKey))
-					lock.Unlock()
-				}
-				return nil
-			})
-
-			if err != nil {
-				return fmt.Errorf("failed to load initial state of resource %s: %v", api.GroupKind.String(), err)
-			}
-
-			go c.watchEvents(ctx, api, info, resClient, ns)
-			return nil
-		})
+		return nil
 	})
 
+	if err == nil {
+		err = c.startMissingWatches()
+	}
+
 	if err != nil {
 		log.Errorf("Failed to sync cluster %s: %v", c.cluster.Server, err)
 		return err
@@ -457,17 +314,12 @@ func (c *clusterInfo) sync() (err error) {
 }
 
 func (c *clusterInfo) ensureSynced() error {
-	// first check if cluster is synced *without lock*
-	if c.synced() {
-		return c.syncError
-	}
-	c.lock.Lock()
-	defer c.lock.Unlock()
-	// before doing any work, check once again now that we have the lock, to see if it got
-	// synced between the first check and now
+	c.syncLock.Lock()
+	defer c.syncLock.Unlock()
 	if c.synced() {
 		return c.syncError
 	}
+
 	err := c.sync()
 	syncTime := time.Now()
 	c.syncTime = &syncTime
@@ -475,60 +327,31 @@ func (c *clusterInfo) ensureSynced() error {
 	return c.syncError
 }
 
-func (c *clusterInfo) getNamespaceTopLevelResources(namespace string) map[kube.ResourceKey]appv1.ResourceNode {
-	c.lock.RLock()
-	defer c.lock.RUnlock()
-	nodes := make(map[kube.ResourceKey]appv1.ResourceNode)
-	for _, node := range c.nsIndex[namespace] {
-		if len(node.ownerRefs) == 0 {
-			nodes[node.resourceKey()] = node.asResourceNode()
-		}
-	}
-	return nodes
-}
-
-func (c *clusterInfo) iterateHierarchy(key kube.ResourceKey, action func(child appv1.ResourceNode, appName string)) {
+func (c *clusterInfo) getChildren(obj *unstructured.Unstructured) []appv1.ResourceNode {
 	c.lock.Lock()
 	defer c.lock.Unlock()
-	if objInfo, ok := c.nodes[key]; ok {
-		nsNodes := c.nsIndex[key.Namespace]
-		action(objInfo.asResourceNode(), objInfo.getApp(nsNodes))
-		childrenByUID := make(map[types.UID][]*node)
+	children := make([]appv1.ResourceNode, 0)
+	if objInfo, ok := c.nodes[kube.GetResourceKey(obj)]; ok {
+		nsNodes := c.nsIndex[obj.GetNamespace()]
 		for _, child := range nsNodes {
 			if objInfo.isParentOf(child) {
-				childrenByUID[child.ref.UID] = append(childrenByUID[child.ref.UID], child)
-			}
-		}
-		// make sure children has no duplicates
-		for _, children := range childrenByUID {
-			if len(children) > 0 {
-				// The object might have multiple children with the same UID (e.g. replicaset from apps and extensions group). It is ok to pick any object but we need to make sure
-				// we pick the same child after every refresh.
-				sort.Slice(children, func(i, j int) bool {
-					key1 := children[i].resourceKey()
-					key2 := children[j].resourceKey()
-					return strings.Compare(key1.String(), key2.String()) < 0
-				})
-				child := children[0]
-				action(child.asResourceNode(), child.getApp(nsNodes))
-				child.iterateChildren(nsNodes, map[kube.ResourceKey]bool{objInfo.resourceKey(): true}, action)
+				children = append(children, child.childResourceNodes(nsNodes, map[kube.ResourceKey]bool{objInfo.resourceKey(): true}))
 			}
 		}
 	}
+	return children
 }
 
-func (c *clusterInfo) isNamespaced(gk schema.GroupKind) bool {
-	// this is safe to access without a lock since we always replace the entire map instead of mutating keys
-	if isNamespaced, ok := c.namespacedResources[gk]; ok {
-		return isNamespaced
+func (c *clusterInfo) isNamespaced(obj *unstructured.Unstructured) bool {
+	if api, ok := c.apisMeta[kube.GetResourceKey(obj).GroupKind()]; ok && !api.namespaced {
+		return false
 	}
-	log.Warnf("group/kind %s scope is unknown (known objects: %d). assuming namespaced object", gk, len(c.namespacedResources))
 	return true
 }
 
 func (c *clusterInfo) getManagedLiveObjs(a *appv1.Application, targetObjs []*unstructured.Unstructured) (map[kube.ResourceKey]*unstructured.Unstructured, error) {
-	c.lock.RLock()
-	defer c.lock.RUnlock()
+	c.lock.Lock()
+	defer c.lock.Unlock()
 
 	managedObjs := make(map[kube.ResourceKey]*unstructured.Unstructured)
 	// iterate all objects in live state cache to find ones associated with app
@@ -537,13 +360,12 @@ func (c *clusterInfo) getManagedLiveObjs(a *appv1.Application, targetObjs []*uns
 			managedObjs[key] = o.resource
 		}
 	}
-	config := metrics.AddMetricsTransportWrapper(c.metricsServer, a, c.cluster.RESTConfig())
-	// iterate target objects and identify ones that already exist in the cluster,
+	// iterate target objects and identify ones that already exist in the cluster,\
 	// but are simply missing our label
 	lock := &sync.Mutex{}
 	err := util.RunAllAsync(len(targetObjs), func(i int) error {
 		targetObj := targetObjs[i]
-		key := GetTargetObjKey(a, targetObj, c.isNamespaced(targetObj.GroupVersionKind().GroupKind()))
+		key := GetTargetObjKey(a, targetObj, c.isNamespaced(targetObj))
 		lock.Lock()
 		managedObj := managedObjs[key]
 		lock.Unlock()
@@ -554,7 +376,7 @@ func (c *clusterInfo) getManagedLiveObjs(a *appv1.Application, targetObjs []*uns
 					managedObj = existingObj.resource
 				} else {
 					var err error
-					managedObj, err = c.kubectl.GetResource(config, targetObj.GroupVersionKind(), existingObj.ref.Name, existingObj.ref.Namespace)
+					managedObj, err = c.kubectl.GetResource(c.cluster.RESTConfig(), targetObj.GroupVersionKind(), existingObj.ref.Name, existingObj.ref.Namespace)
 					if err != nil {
 						if errors.IsNotFound(err) {
 							return nil
@@ -562,32 +384,13 @@ func (c *clusterInfo) getManagedLiveObjs(a *appv1.Application, targetObjs []*uns
 						return err
 					}
 				}
-			} else if _, watched := c.apisMeta[key.GroupKind()]; !watched {
-				var err error
-				managedObj, err = c.kubectl.GetResource(config, targetObj.GroupVersionKind(), targetObj.GetName(), targetObj.GetNamespace())
-				if err != nil {
-					if errors.IsNotFound(err) {
-						return nil
-					}
-					return err
-				}
 			}
 		}
 
 		if managedObj != nil {
-			converted, err := c.kubectl.ConvertToVersion(managedObj, targetObj.GroupVersionKind().Group, targetObj.GroupVersionKind().Version)
+			managedObj, err := c.kubectl.ConvertToVersion(managedObj, targetObj.GroupVersionKind().Group, targetObj.GroupVersionKind().Version)
 			if err != nil {
-				// fallback to loading resource from kubernetes if conversion fails
-				log.Warnf("Failed to convert resource: %v", err)
-				managedObj, err = c.kubectl.GetResource(config, targetObj.GroupVersionKind(), managedObj.GetName(), managedObj.GetNamespace())
-				if err != nil {
-					if errors.IsNotFound(err) {
-						return nil
-					}
-					return err
-				}
-			} else {
-				managedObj = converted
+				return err
 			}
 			lock.Lock()
 			managedObjs[key] = managedObj
@@ -602,32 +405,32 @@ func (c *clusterInfo) getManagedLiveObjs(a *appv1.Application, targetObjs []*uns
 	return managedObjs, nil
 }
 
-func (c *clusterInfo) processEvent(event watch.EventType, un *unstructured.Unstructured) {
-	if c.onEventReceived != nil {
-		c.onEventReceived(event, un)
-	}
-	key := kube.GetResourceKey(un)
-	if event == watch.Modified && skipAppRequeing(key) {
-		return
-	}
+func (c *clusterInfo) delete(obj *unstructured.Unstructured) error {
+	return c.kubectl.DeleteResource(c.cluster.RESTConfig(), obj.GroupVersionKind(), obj.GetName(), obj.GetNamespace(), false)
+}
+
+func (c *clusterInfo) processEvent(event watch.EventType, un *unstructured.Unstructured) error {
 	c.lock.Lock()
 	defer c.lock.Unlock()
+	key := kube.GetResourceKey(un)
 	existingNode, exists := c.nodes[key]
 	if event == watch.Deleted {
 		if exists {
 			c.onNodeRemoved(key, existingNode)
 		}
 	} else if event != watch.Deleted {
-		c.onNodeUpdated(exists, existingNode, un)
+		c.onNodeUpdated(exists, existingNode, un, key)
 	}
+
+	return nil
 }
 
-func (c *clusterInfo) onNodeUpdated(exists bool, existingNode *node, un *unstructured.Unstructured) {
+func (c *clusterInfo) onNodeUpdated(exists bool, existingNode *node, un *unstructured.Unstructured, key kube.ResourceKey) {
 	nodes := make([]*node, 0)
 	if exists {
 		nodes = append(nodes, existingNode)
 	}
-	newObj := c.createObjInfo(un, c.cacheSettingsSrc().AppInstanceLabelKey)
+	newObj := createObjInfo(un, c.settings.GetAppInstanceLabelKey())
 	c.setNode(newObj)
 	nodes = append(nodes, newObj)
 	toNotify := make(map[string]bool)
@@ -635,13 +438,15 @@ func (c *clusterInfo) onNodeUpdated(exists bool, existingNode *node, un *unstruc
 		n := nodes[i]
 		if ns, ok := c.nsIndex[n.ref.Namespace]; ok {
 			app := n.getApp(ns)
-			if app == "" {
+			if app == "" || skipAppRequeing(key) {
 				continue
 			}
 			toNotify[app] = n.isRootAppNode() || toNotify[app]
 		}
 	}
-	c.onObjectUpdated(toNotify, newObj.ref)
+	for name, full := range toNotify {
+		c.onAppUpdated(name, full)
+	}
 }
 
 func (c *clusterInfo) onNodeRemoved(key kube.ResourceKey, n *node) {
@@ -651,11 +456,9 @@ func (c *clusterInfo) onNodeRemoved(key kube.ResourceKey, n *node) {
 	}
 
 	c.removeNode(key)
-	managedByApp := make(map[string]bool)
 	if appName != "" {
-		managedByApp[appName] = n.isRootAppNode()
+		c.onAppUpdated(appName, n.isRootAppNode())
 	}
-	c.onObjectUpdated(managedByApp, n.ref)
 }
 
 var (
@@ -664,18 +467,6 @@ var (
 	}
 )
 
-func (c *clusterInfo) getClusterInfo() metrics.ClusterInfo {
-	c.lock.RLock()
-	defer c.lock.RUnlock()
-	return metrics.ClusterInfo{
-		APIsCount:         len(c.apisMeta),
-		K8SVersion:        c.serverVersion,
-		ResourcesCount:    len(c.nodes),
-		Server:            c.cluster.Server,
-		LastCacheSyncTime: c.syncTime,
-	}
-}
-
 // skipAppRequeing checks if the object is an API type which we want to skip requeuing against.
 // We ignore API types which have a high churn rate, and/or whose updates are irrelevant to the app
 func skipAppRequeing(key kube.ResourceKey) bool {

controller/cache/cluster_test.go

@@ -7,22 +7,23 @@ import (
 	"sync"
 	"testing"
 
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/dynamic/fake"
+
 	"github.com/ghodss/yaml"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/watch"
-	"k8s.io/client-go/dynamic/fake"
 
-	"github.com/argoproj/argo-cd/common"
 	"github.com/argoproj/argo-cd/errors"
 	appv1 "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
 	"github.com/argoproj/argo-cd/util/kube"
 	"github.com/argoproj/argo-cd/util/kube/kubetest"
+	"github.com/argoproj/argo-cd/util/settings"
 )
 
 func strToUnstructured(jsonStr string) *unstructured.Unstructured {
@@ -43,30 +44,24 @@ var (
   apiVersion: v1
   kind: Pod
   metadata:
-    uid: "1"
     name: helm-guestbook-pod
     namespace: default
     ownerReferences:
-    - apiVersion: apps/v1
+    - apiVersion: extensions/v1beta1
       kind: ReplicaSet
       name: helm-guestbook-rs
-      uid: "2"
     resourceVersion: "123"`)
 
 	testRS = strToUnstructured(`
   apiVersion: apps/v1
   kind: ReplicaSet
   metadata:
-    uid: "2"
     name: helm-guestbook-rs
     namespace: default
-    annotations:
-      deployment.kubernetes.io/revision: "2"
     ownerReferences:
-    - apiVersion: apps/v1beta1
+    - apiVersion: extensions/v1beta1
       kind: Deployment
       name: helm-guestbook
-      uid: "3"
     resourceVersion: "123"`)
 
 	testDeploy = strToUnstructured(`
@@ -75,55 +70,9 @@ var (
   metadata:
     labels:
       app.kubernetes.io/instance: helm-guestbook
-    uid: "3"
     name: helm-guestbook
     namespace: default
     resourceVersion: "123"`)
-
-	testService = strToUnstructured(`
-  apiVersion: v1
-  kind: Service
-  metadata:
-    name: helm-guestbook
-    namespace: default
-    resourceVersion: "123"
-    uid: "4"
-  spec:
-    selector:
-      app: guestbook
-    type: LoadBalancer
-  status:
-    loadBalancer:
-      ingress:
-      - hostname: localhost`)
-
-	testIngress = strToUnstructured(`
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    name: helm-guestbook
-    namespace: default
-    uid: "4"
-  spec:
-    backend:
-      serviceName: not-found-service
-      servicePort: 443
-    rules:
-    - host: helm-guestbook.com
-      http:
-        paths:
-        - backend:
-            serviceName: helm-guestbook
-            servicePort: 443
-          path: /
-        - backend:
-            serviceName: helm-guestbook
-            servicePort: https
-          path: /
-  status:
-    loadBalancer:
-      ingress:
-      - ip: 107.178.210.11`)
 )
 
 func newCluster(objs ...*unstructured.Unstructured) *clusterInfo {
@@ -135,171 +84,66 @@ func newCluster(objs ...*unstructured.Unstructured) *clusterInfo {
 	client := fake.NewSimpleDynamicClient(scheme, runtimeObjs...)
 
 	apiResources := []kube.APIResourceInfo{{
-		GroupKind:            schema.GroupKind{Group: "", Kind: "Pod"},
-		GroupVersionResource: schema.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"},
-		Meta:                 metav1.APIResource{Namespaced: true},
+		GroupKind: schema.GroupKind{Group: "", Kind: "Pod"},
+		Interface: client.Resource(schema.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"}),
+		Meta:      metav1.APIResource{Namespaced: true},
 	}, {
-		GroupKind:            schema.GroupKind{Group: "apps", Kind: "ReplicaSet"},
-		GroupVersionResource: schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "replicasets"},
-		Meta:                 metav1.APIResource{Namespaced: true},
+		GroupKind: schema.GroupKind{Group: "apps", Kind: "ReplicaSet"},
+		Interface: client.Resource(schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "replicasets"}),
+		Meta:      metav1.APIResource{Namespaced: true},
 	}, {
-		GroupKind:            schema.GroupKind{Group: "apps", Kind: "Deployment"},
-		GroupVersionResource: schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployments"},
-		Meta:                 metav1.APIResource{Namespaced: true},
+		GroupKind: schema.GroupKind{Group: "apps", Kind: "Deployment"},
+		Interface: client.Resource(schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployments"}),
+		Meta:      metav1.APIResource{Namespaced: true},
 	}}
 
-	return newClusterExt(&kubetest.MockKubectlCmd{APIResources: apiResources, DynamicClient: client})
+	return newClusterExt(kubetest.MockKubectlCmd{APIResources: apiResources})
 }
 
 func newClusterExt(kubectl kube.Kubectl) *clusterInfo {
 	return &clusterInfo{
-		lock:            &sync.RWMutex{},
-		nodes:           make(map[kube.ResourceKey]*node),
-		onObjectUpdated: func(managedByApp map[string]bool, reference corev1.ObjectReference) {},
-		kubectl:         kubectl,
-		nsIndex:         make(map[string]map[kube.ResourceKey]*node),
-		cluster:         &appv1.Cluster{},
-		syncTime:        nil,
-		apisMeta:        make(map[schema.GroupKind]*apiMeta),
-		log:             log.WithField("cluster", "test"),
-		cacheSettingsSrc: func() *cacheSettings {
-			return &cacheSettings{AppInstanceLabelKey: common.LabelKeyAppInstance}
-		},
+		lock:         &sync.Mutex{},
+		nodes:        make(map[kube.ResourceKey]*node),
+		onAppUpdated: func(appName string, fullRefresh bool) {},
+		kubectl:      kubectl,
+		nsIndex:      make(map[string]map[kube.ResourceKey]*node),
+		cluster:      &appv1.Cluster{},
+		syncTime:     nil,
+		syncLock:     &sync.Mutex{},
+		apisMeta:     make(map[schema.GroupKind]*apiMeta),
+		log:          log.WithField("cluster", "test"),
+		settings:     &settings.ArgoCDSettings{},
 	}
 }
 
-func getChildren(cluster *clusterInfo, un *unstructured.Unstructured) []appv1.ResourceNode {
-	hierarchy := make([]appv1.ResourceNode, 0)
-	cluster.iterateHierarchy(kube.GetResourceKey(un), func(child appv1.ResourceNode, app string) {
-		hierarchy = append(hierarchy, child)
-	})
-	return hierarchy[1:]
-}
-
-func TestEnsureSynced(t *testing.T) {
-	obj1 := strToUnstructured(`
-  apiVersion: apps/v1
-  kind: Deployment
-  metadata: {"name": "helm-guestbook1", "namespace": "default1"}
-`)
-	obj2 := strToUnstructured(`
-  apiVersion: apps/v1
-  kind: Deployment
-  metadata: {"name": "helm-guestbook2", "namespace": "default2"}
-`)
-
-	cluster := newCluster(obj1, obj2)
-	err := cluster.ensureSynced()
-	assert.Nil(t, err)
-
-	assert.Len(t, cluster.nodes, 2)
-	var names []string
-	for k := range cluster.nodes {
-		names = append(names, k.Name)
-	}
-	assert.ElementsMatch(t, []string{"helm-guestbook1", "helm-guestbook2"}, names)
-}
-
-func TestEnsureSyncedSingleNamespace(t *testing.T) {
-	obj1 := strToUnstructured(`
-  apiVersion: apps/v1
-  kind: Deployment
-  metadata: {"name": "helm-guestbook1", "namespace": "default1"}
-`)
-	obj2 := strToUnstructured(`
-  apiVersion: apps/v1
-  kind: Deployment
-  metadata: {"name": "helm-guestbook2", "namespace": "default2"}
-`)
-
-	cluster := newCluster(obj1, obj2)
-	cluster.cluster.Namespaces = []string{"default1"}
-	err := cluster.ensureSynced()
-	assert.Nil(t, err)
-
-	assert.Len(t, cluster.nodes, 1)
-	var names []string
-	for k := range cluster.nodes {
-		names = append(names, k.Name)
-	}
-	assert.ElementsMatch(t, []string{"helm-guestbook1"}, names)
-}
-
-func TestGetNamespaceResources(t *testing.T) {
-	defaultNamespaceTopLevel1 := strToUnstructured(`
-  apiVersion: apps/v1
-  kind: Deployment
-  metadata: {"name": "helm-guestbook1", "namespace": "default"}
-`)
-	defaultNamespaceTopLevel2 := strToUnstructured(`
-  apiVersion: apps/v1
-  kind: Deployment
-  metadata: {"name": "helm-guestbook2", "namespace": "default"}
-`)
-	kubesystemNamespaceTopLevel2 := strToUnstructured(`
-  apiVersion: apps/v1
-  kind: Deployment
-  metadata: {"name": "helm-guestbook3", "namespace": "kube-system"}
-`)
-
-	cluster := newCluster(defaultNamespaceTopLevel1, defaultNamespaceTopLevel2, kubesystemNamespaceTopLevel2)
-	err := cluster.ensureSynced()
-	assert.Nil(t, err)
-
-	resources := cluster.getNamespaceTopLevelResources("default")
-	assert.Len(t, resources, 2)
-	assert.Equal(t, resources[kube.GetResourceKey(defaultNamespaceTopLevel1)].Name, "helm-guestbook1")
-	assert.Equal(t, resources[kube.GetResourceKey(defaultNamespaceTopLevel2)].Name, "helm-guestbook2")
-
-	resources = cluster.getNamespaceTopLevelResources("kube-system")
-	assert.Len(t, resources, 1)
-	assert.Equal(t, resources[kube.GetResourceKey(kubesystemNamespaceTopLevel2)].Name, "helm-guestbook3")
-}
-
 func TestGetChildren(t *testing.T) {
 	cluster := newCluster(testPod, testRS, testDeploy)
 	err := cluster.ensureSynced()
 	assert.Nil(t, err)
 
-	rsChildren := getChildren(cluster, testRS)
+	rsChildren := cluster.getChildren(testRS)
 	assert.Equal(t, []appv1.ResourceNode{{
-		ResourceRef: appv1.ResourceRef{
-			Kind:      "Pod",
-			Namespace: "default",
-			Name:      "helm-guestbook-pod",
-			Group:     "",
-			Version:   "v1",
-			UID:       "1",
-		},
-		ParentRefs: []appv1.ResourceRef{{
-			Group:     "apps",
-			Version:   "",
-			Kind:      "ReplicaSet",
-			Namespace: "default",
-			Name:      "helm-guestbook-rs",
-			UID:       "2",
-		}},
-		Health:          &appv1.HealthStatus{Status: appv1.HealthStatusUnknown},
-		NetworkingInfo:  &appv1.ResourceNetworkingInfo{Labels: testPod.GetLabels()},
-		ResourceVersion: "123",
+		Kind:            "Pod",
+		Namespace:       "default",
+		Name:            "helm-guestbook-pod",
+		Group:           "",
+		Version:         "v1",
 		Info:            []appv1.InfoItem{{Name: "Containers", Value: "0/0"}},
-	}}, rsChildren)
-	deployChildren := getChildren(cluster, testDeploy)
-
-	assert.Equal(t, append([]appv1.ResourceNode{{
-		ResourceRef: appv1.ResourceRef{
-			Kind:      "ReplicaSet",
-			Namespace: "default",
-			Name:      "helm-guestbook-rs",
-			Group:     "apps",
-			Version:   "v1",
-			UID:       "2",
-		},
+		Children:        make([]appv1.ResourceNode, 0),
 		ResourceVersion: "123",
-		Health:          &appv1.HealthStatus{Status: appv1.HealthStatusHealthy},
-		Info:            []appv1.InfoItem{{Name: "Revision", Value: "Rev:2"}},
-		ParentRefs:      []appv1.ResourceRef{{Group: "apps", Version: "", Kind: "Deployment", Namespace: "default", Name: "helm-guestbook", UID: "3"}},
-	}}, rsChildren...), deployChildren)
+	}}, rsChildren)
+	deployChildren := cluster.getChildren(testDeploy)
+
+	assert.Equal(t, []appv1.ResourceNode{{
+		Kind:            "ReplicaSet",
+		Namespace:       "default",
+		Name:            "helm-guestbook-rs",
+		Group:           "apps",
+		Version:         "v1",
+		ResourceVersion: "123",
+		Children:        rsChildren,
+		Info:            []appv1.InfoItem{},
+	}}, deployChildren)
 }
 
 func TestGetManagedLiveObjs(t *testing.T) {
@@ -334,9 +178,10 @@ func TestChildDeletedEvent(t *testing.T) {
 	err := cluster.ensureSynced()
 	assert.Nil(t, err)
 
-	cluster.processEvent(watch.Deleted, testPod)
+	err = cluster.processEvent(watch.Deleted, testPod)
+	assert.Nil(t, err)
 
-	rsChildren := getChildren(cluster, testRS)
+	rsChildren := cluster.getChildren(testRS)
 	assert.Equal(t, []appv1.ResourceNode{}, rsChildren)
 }
 
@@ -349,63 +194,38 @@ func TestProcessNewChildEvent(t *testing.T) {
   apiVersion: v1
   kind: Pod
   metadata:
-    uid: "4"
     name: helm-guestbook-pod2
     namespace: default
     ownerReferences:
-    - apiVersion: apps/v1
+    - apiVersion: extensions/v1beta1
       kind: ReplicaSet
       name: helm-guestbook-rs
-      uid: "2"
     resourceVersion: "123"`)
 
-	cluster.processEvent(watch.Added, newPod)
+	err = cluster.processEvent(watch.Added, newPod)
+	assert.Nil(t, err)
 
-	rsChildren := getChildren(cluster, testRS)
+	rsChildren := cluster.getChildren(testRS)
 	sort.Slice(rsChildren, func(i, j int) bool {
 		return strings.Compare(rsChildren[i].Name, rsChildren[j].Name) < 0
 	})
 	assert.Equal(t, []appv1.ResourceNode{{
-		ResourceRef: appv1.ResourceRef{
-			Kind:      "Pod",
-			Namespace: "default",
-			Name:      "helm-guestbook-pod",
-			Group:     "",
-			Version:   "v1",
-			UID:       "1",
-		},
-		Info:           []appv1.InfoItem{{Name: "Containers", Value: "0/0"}},
-		Health:         &appv1.HealthStatus{Status: appv1.HealthStatusUnknown},
-		NetworkingInfo: &appv1.ResourceNetworkingInfo{Labels: testPod.GetLabels()},
-		ParentRefs: []appv1.ResourceRef{{
-			Group:     "apps",
-			Version:   "",
-			Kind:      "ReplicaSet",
-			Namespace: "default",
-			Name:      "helm-guestbook-rs",
-			UID:       "2",
-		}},
+		Kind:            "Pod",
+		Namespace:       "default",
+		Name:            "helm-guestbook-pod",
+		Group:           "",
+		Version:         "v1",
+		Info:            []appv1.InfoItem{{Name: "Containers", Value: "0/0"}},
+		Children:        make([]appv1.ResourceNode, 0),
 		ResourceVersion: "123",
 	}, {
-		ResourceRef: appv1.ResourceRef{
-			Kind:      "Pod",
-			Namespace: "default",
-			Name:      "helm-guestbook-pod2",
-			Group:     "",
-			Version:   "v1",
-			UID:       "4",
-		},
-		NetworkingInfo: &appv1.ResourceNetworkingInfo{Labels: testPod.GetLabels()},
-		Info:           []appv1.InfoItem{{Name: "Containers", Value: "0/0"}},
-		Health:         &appv1.HealthStatus{Status: appv1.HealthStatusUnknown},
-		ParentRefs: []appv1.ResourceRef{{
-			Group:     "apps",
-			Version:   "",
-			Kind:      "ReplicaSet",
-			Namespace: "default",
-			Name:      "helm-guestbook-rs",
-			UID:       "2",
-		}},
+		Kind:            "Pod",
+		Namespace:       "default",
+		Name:            "helm-guestbook-pod2",
+		Group:           "",
+		Version:         "v1",
+		Info:            []appv1.InfoItem{{Name: "Containers", Value: "0/0"}},
+		Children:        make([]appv1.ResourceNode, 0),
 		ResourceVersion: "123",
 	}}, rsChildren)
 }
@@ -440,7 +260,8 @@ func TestUpdateResourceTags(t *testing.T) {
 			},
 		}},
 	}
-	cluster.processEvent(watch.Modified, mustToUnstructured(pod))
+	err = cluster.processEvent(watch.Modified, mustToUnstructured(pod))
+	assert.Nil(t, err)
 
 	podNode = cluster.nodes[kube.GetResourceKey(mustToUnstructured(pod))]
 
@@ -451,16 +272,15 @@ func TestUpdateResourceTags(t *testing.T) {
 func TestUpdateAppResource(t *testing.T) {
 	updatesReceived := make([]string, 0)
 	cluster := newCluster(testPod, testRS, testDeploy)
-	cluster.onObjectUpdated = func(managedByApp map[string]bool, _ corev1.ObjectReference) {
-		for appName, fullRefresh := range managedByApp {
-			updatesReceived = append(updatesReceived, fmt.Sprintf("%s: %v", appName, fullRefresh))
-		}
+	cluster.onAppUpdated = func(appName string, fullRefresh bool) {
+		updatesReceived = append(updatesReceived, fmt.Sprintf("%s: %v", appName, fullRefresh))
 	}
 
 	err := cluster.ensureSynced()
 	assert.Nil(t, err)
 
-	cluster.processEvent(watch.Modified, mustToUnstructured(testPod))
+	err = cluster.processEvent(watch.Modified, mustToUnstructured(testPod))
+	assert.Nil(t, err)
 
 	assert.Contains(t, updatesReceived, "helm-guestbook: false")
 }
@@ -477,8 +297,8 @@ func TestCircularReference(t *testing.T) {
 
 	assert.Nil(t, err)
 
-	children := getChildren(cluster, dep)
-	assert.Len(t, children, 2)
+	children := cluster.getChildren(dep)
+	assert.Len(t, children, 1)
 
 	node := cluster.nodes[kube.GetResourceKey(dep)]
 	assert.NotNil(t, node)
@@ -504,8 +324,7 @@ func TestWatchCacheUpdated(t *testing.T) {
 
 	podGroupKind := testPod.GroupVersionKind().GroupKind()
 
-	cluster.lock.Lock()
-	cluster.replaceResourceCache(podGroupKind, "updated-list-version", []unstructured.Unstructured{*updated, *added}, "")
+	cluster.replaceResourceCache(podGroupKind, "updated-list-version", []unstructured.Unstructured{*updated, *added})
 
 	_, ok := cluster.nodes[kube.GetResourceKey(removed)]
 	assert.False(t, ok)
@@ -516,45 +335,4 @@ func TestWatchCacheUpdated(t *testing.T) {
 
 	_, ok = cluster.nodes[kube.GetResourceKey(added)]
 	assert.True(t, ok)
-	cluster.lock.Unlock()
-}
-
-func TestNamespaceModeReplace(t *testing.T) {
-	ns1Pod := testPod.DeepCopy()
-	ns1Pod.SetNamespace("ns1")
-	ns1Pod.SetName("pod1")
-
-	ns2Pod := testPod.DeepCopy()
-	ns2Pod.SetNamespace("ns2")
-	podGroupKind := testPod.GroupVersionKind().GroupKind()
-
-	cluster := newCluster(ns1Pod, ns2Pod)
-	err := cluster.ensureSynced()
-	assert.Nil(t, err)
-
-	cluster.replaceResourceCache(podGroupKind, "", nil, "ns1")
-
-	_, ok := cluster.nodes[kube.GetResourceKey(ns1Pod)]
-	assert.False(t, ok)
-
-	_, ok = cluster.nodes[kube.GetResourceKey(ns2Pod)]
-	assert.True(t, ok)
-}
-
-func TestGetDuplicatedChildren(t *testing.T) {
-	extensionsRS := testRS.DeepCopy()
-	extensionsRS.SetGroupVersionKind(schema.GroupVersionKind{Group: "extensions", Kind: kube.ReplicaSetKind, Version: "v1beta1"})
-	cluster := newCluster(testDeploy, testRS, extensionsRS)
-	err := cluster.ensureSynced()
-
-	assert.Nil(t, err)
-
-	// Get children multiple times to make sure the right child is picked up every time.
-	for i := 0; i < 5; i++ {
-		children := getChildren(cluster, testDeploy)
-		assert.Len(t, children, 1)
-		assert.Equal(t, "apps", children[0].Group)
-		assert.Equal(t, kube.ReplicaSetKind, children[0].Kind)
-		assert.Equal(t, testRS.GetName(), children[0].Name)
-	}
 }

controller/cache/info.go

@@ -9,160 +9,23 @@ import (
 	k8snode "k8s.io/kubernetes/pkg/util/node"
 
 	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	"github.com/argoproj/argo-cd/util"
 	"github.com/argoproj/argo-cd/util/kube"
-	"github.com/argoproj/argo-cd/util/resource"
 )
 
-func populateNodeInfo(un *unstructured.Unstructured, node *node) {
-
+func getNodeInfo(un *unstructured.Unstructured) []v1alpha1.InfoItem {
 	gvk := un.GroupVersionKind()
-	revision := resource.GetRevision(un)
-	if revision > 0 {
-		node.info = append(node.info, v1alpha1.InfoItem{Name: "Revision", Value: fmt.Sprintf("Rev:%v", revision)})
-	}
-	switch gvk.Group {
-	case "":
-		switch gvk.Kind {
-		case kube.PodKind:
-			populatePodInfo(un, node)
-			return
-		case kube.ServiceKind:
-			populateServiceInfo(un, node)
-			return
-		}
-	case "extensions", "networking.k8s.io":
-		switch gvk.Kind {
-		case kube.IngressKind:
-			populateIngressInfo(un, node)
-			return
-		}
+
+	if gvk.Kind == kube.PodKind && gvk.Group == "" {
+		return getPodInfo(un)
 	}
+	return []v1alpha1.InfoItem{}
 }
 
-func getIngress(un *unstructured.Unstructured) []v1.LoadBalancerIngress {
-	ingress, ok, err := unstructured.NestedSlice(un.Object, "status", "loadBalancer", "ingress")
-	if !ok || err != nil {
-		return nil
-	}
-	res := make([]v1.LoadBalancerIngress, 0)
-	for _, item := range ingress {
-		if lbIngress, ok := item.(map[string]interface{}); ok {
-			if hostname := lbIngress["hostname"]; hostname != nil {
-				res = append(res, v1.LoadBalancerIngress{Hostname: fmt.Sprintf("%s", hostname)})
-			} else if ip := lbIngress["ip"]; ip != nil {
-				res = append(res, v1.LoadBalancerIngress{IP: fmt.Sprintf("%s", ip)})
-			}
-		}
-	}
-	return res
-}
-
-func populateServiceInfo(un *unstructured.Unstructured, node *node) {
-	targetLabels, _, _ := unstructured.NestedStringMap(un.Object, "spec", "selector")
-	ingress := make([]v1.LoadBalancerIngress, 0)
-	if serviceType, ok, err := unstructured.NestedString(un.Object, "spec", "type"); ok && err == nil && serviceType == string(v1.ServiceTypeLoadBalancer) {
-		ingress = getIngress(un)
-	}
-	node.networkingInfo = &v1alpha1.ResourceNetworkingInfo{TargetLabels: targetLabels, Ingress: ingress}
-}
-
-func populateIngressInfo(un *unstructured.Unstructured, node *node) {
-	ingress := getIngress(un)
-	targetsMap := make(map[v1alpha1.ResourceRef]bool)
-	if backend, ok, err := unstructured.NestedMap(un.Object, "spec", "backend"); ok && err == nil {
-		targetsMap[v1alpha1.ResourceRef{
-			Group:     "",
-			Kind:      kube.ServiceKind,
-			Namespace: un.GetNamespace(),
-			Name:      fmt.Sprintf("%s", backend["serviceName"]),
-		}] = true
-	}
-	urlsSet := make(map[string]bool)
-	if rules, ok, err := unstructured.NestedSlice(un.Object, "spec", "rules"); ok && err == nil {
-		for i := range rules {
-			rule, ok := rules[i].(map[string]interface{})
-			if !ok {
-				continue
-			}
-			host := rule["host"]
-			if host == nil || host == "" {
-				for i := range ingress {
-					host = util.FirstNonEmpty(ingress[i].Hostname, ingress[i].IP)
-					if host != "" {
-						break
-					}
-				}
-			}
-			paths, ok, err := unstructured.NestedSlice(rule, "http", "paths")
-			if !ok || err != nil {
-				continue
-			}
-			for i := range paths {
-				path, ok := paths[i].(map[string]interface{})
-				if !ok {
-					continue
-				}
-
-				if serviceName, ok, err := unstructured.NestedString(path, "backend", "serviceName"); ok && err == nil {
-					targetsMap[v1alpha1.ResourceRef{
-						Group:     "",
-						Kind:      kube.ServiceKind,
-						Namespace: un.GetNamespace(),
-						Name:      serviceName,
-					}] = true
-				}
-
-				if port, ok, err := unstructured.NestedFieldNoCopy(path, "backend", "servicePort"); ok && err == nil && host != "" && host != nil {
-					stringPort := ""
-					switch typedPod := port.(type) {
-					case int64:
-						stringPort = fmt.Sprintf("%d", typedPod)
-					case float64:
-						stringPort = fmt.Sprintf("%d", int64(typedPod))
-					case string:
-						stringPort = typedPod
-					default:
-						stringPort = fmt.Sprintf("%v", port)
-					}
-
-					var externalURL string
-					switch stringPort {
-					case "80", "http":
-						externalURL = fmt.Sprintf("http://%s", host)
-					case "443", "https":
-						externalURL = fmt.Sprintf("https://%s", host)
-					default:
-						externalURL = fmt.Sprintf("http://%s:%s", host, stringPort)
-					}
-
-					subPath := ""
-					if nestedPath, ok, err := unstructured.NestedString(path, "path"); ok && err == nil {
-						subPath = nestedPath
-					}
-
-					externalURL += subPath
-					urlsSet[externalURL] = true
-				}
-			}
-		}
-	}
-	targets := make([]v1alpha1.ResourceRef, 0)
-	for target := range targetsMap {
-		targets = append(targets, target)
-	}
-	urls := make([]string, 0)
-	for url := range urlsSet {
-		urls = append(urls, url)
-	}
-	node.networkingInfo = &v1alpha1.ResourceNetworkingInfo{TargetRefs: targets, Ingress: ingress, ExternalURLs: urls}
-}
-
-func populatePodInfo(un *unstructured.Unstructured, node *node) {
+func getPodInfo(un *unstructured.Unstructured) []v1alpha1.InfoItem {
 	pod := v1.Pod{}
 	err := runtime.DefaultUnstructuredConverter.FromUnstructured(un.Object, &pod)
 	if err != nil {
-		return
+		return []v1alpha1.InfoItem{}
 	}
 	restarts := 0
 	totalContainers := len(pod.Spec.Containers)
@@ -173,19 +36,6 @@ func populatePodInfo(un *unstructured.Unstructured, node *node) {
 		reason = pod.Status.Reason
 	}
 
-	imagesSet := make(map[string]bool)
-	for _, container := range pod.Spec.InitContainers {
-		imagesSet[container.Image] = true
-	}
-	for _, container := range pod.Spec.Containers {
-		imagesSet[container.Image] = true
-	}
-
-	node.images = nil
-	for image := range imagesSet {
-		node.images = append(node.images, image)
-	}
-
 	initializing := false
 	for i := range pod.Status.InitContainerStatuses {
 		container := pod.Status.InitContainerStatuses[i]
@@ -249,9 +99,9 @@ func populatePodInfo(un *unstructured.Unstructured, node *node) {
 		reason = "Terminating"
 	}
 
+	info := make([]v1alpha1.InfoItem, 0)
 	if reason != "" {
-		node.info = append(node.info, v1alpha1.InfoItem{Name: "Status Reason", Value: reason})
+		info = append(info, v1alpha1.InfoItem{Name: "Status Reason", Value: reason})
 	}
-	node.info = append(node.info, v1alpha1.InfoItem{Name: "Containers", Value: fmt.Sprintf("%d/%d", readyContainers, totalContainers)})
-	node.networkingInfo = &v1alpha1.ResourceNetworkingInfo{Labels: un.GetLabels()}
+	return append(info, v1alpha1.InfoItem{Name: "Containers", Value: fmt.Sprintf("%d/%d", readyContainers, totalContainers)})
 }

controller/cache/info_test.go

@@ -1,222 +0,0 @@
-package cache
-
-import (
-	"sort"
-	"strings"
-	"testing"
-
-	v1 "k8s.io/api/core/v1"
-
-	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	"github.com/argoproj/argo-cd/util/kube"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetPodInfo(t *testing.T) {
-	pod := strToUnstructured(`
-  apiVersion: v1
-  kind: Pod
-  metadata:
-    name: helm-guestbook-pod
-    namespace: default
-    ownerReferences:
-    - apiVersion: extensions/v1beta1
-      kind: ReplicaSet
-      name: helm-guestbook-rs
-    resourceVersion: "123"
-    labels:
-      app: guestbook
-  spec:
-    containers:
-    - image: bar`)
-
-	node := &node{}
-	populateNodeInfo(pod, node)
-	assert.Equal(t, []v1alpha1.InfoItem{{Name: "Containers", Value: "0/1"}}, node.info)
-	assert.Equal(t, []string{"bar"}, node.images)
-	assert.Equal(t, &v1alpha1.ResourceNetworkingInfo{Labels: map[string]string{"app": "guestbook"}}, node.networkingInfo)
-}
-
-func TestGetServiceInfo(t *testing.T) {
-	node := &node{}
-	populateNodeInfo(testService, node)
-	assert.Equal(t, 0, len(node.info))
-	assert.Equal(t, &v1alpha1.ResourceNetworkingInfo{
-		TargetLabels: map[string]string{"app": "guestbook"},
-		Ingress:      []v1.LoadBalancerIngress{{Hostname: "localhost"}},
-	}, node.networkingInfo)
-}
-
-func TestGetIngressInfo(t *testing.T) {
-	node := &node{}
-	populateNodeInfo(testIngress, node)
-	assert.Equal(t, 0, len(node.info))
-	sort.Slice(node.networkingInfo.TargetRefs, func(i, j int) bool {
-		return strings.Compare(node.networkingInfo.TargetRefs[j].Name, node.networkingInfo.TargetRefs[i].Name) < 0
-	})
-	assert.Equal(t, &v1alpha1.ResourceNetworkingInfo{
-		Ingress: []v1.LoadBalancerIngress{{IP: "107.178.210.11"}},
-		TargetRefs: []v1alpha1.ResourceRef{{
-			Namespace: "default",
-			Group:     "",
-			Kind:      kube.ServiceKind,
-			Name:      "not-found-service",
-		}, {
-			Namespace: "default",
-			Group:     "",
-			Kind:      kube.ServiceKind,
-			Name:      "helm-guestbook",
-		}},
-		ExternalURLs: []string{"https://helm-guestbook.com/"},
-	}, node.networkingInfo)
-}
-
-func TestGetIngressInfoNoHost(t *testing.T) {
-	ingress := strToUnstructured(`
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    name: helm-guestbook
-    namespace: default
-  spec:
-    rules:
-    - http:
-        paths:
-        - backend:
-            serviceName: helm-guestbook
-            servicePort: 443
-          path: /
-  status:
-    loadBalancer:
-      ingress:
-      - ip: 107.178.210.11`)
-
-	node := &node{}
-	populateNodeInfo(ingress, node)
-
-	assert.Equal(t, &v1alpha1.ResourceNetworkingInfo{
-		Ingress: []v1.LoadBalancerIngress{{IP: "107.178.210.11"}},
-		TargetRefs: []v1alpha1.ResourceRef{{
-			Namespace: "default",
-			Group:     "",
-			Kind:      kube.ServiceKind,
-			Name:      "helm-guestbook",
-		}},
-		ExternalURLs: []string{"https://107.178.210.11/"},
-	}, node.networkingInfo)
-}
-func TestExternalUrlWithSubPath(t *testing.T) {
-	ingress := strToUnstructured(`
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    name: helm-guestbook
-    namespace: default
-  spec:
-    rules:
-    - http:
-        paths:
-        - backend:
-            serviceName: helm-guestbook
-            servicePort: 443
-          path: /my/sub/path/
-  status:
-    loadBalancer:
-      ingress:
-      - ip: 107.178.210.11`)
-
-	node := &node{}
-	populateNodeInfo(ingress, node)
-
-	expectedExternalUrls := []string{"https://107.178.210.11/my/sub/path/"}
-	assert.Equal(t, expectedExternalUrls, node.networkingInfo.ExternalURLs)
-}
-func TestExternalUrlWithMultipleSubPaths(t *testing.T) {
-	ingress := strToUnstructured(`
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    name: helm-guestbook
-    namespace: default
-  spec:
-    rules:
-    - host: helm-guestbook.com
-      http:
-        paths:
-        - backend:
-            serviceName: helm-guestbook
-            servicePort: 443
-          path: /my/sub/path/
-        - backend:
-            serviceName: helm-guestbook-2
-            servicePort: 443
-          path: /my/sub/path/2
-        - backend:
-            serviceName: helm-guestbook-3
-            servicePort: 443
-  status:
-    loadBalancer:
-      ingress:
-      - ip: 107.178.210.11`)
-
-	node := &node{}
-	populateNodeInfo(ingress, node)
-
-	expectedExternalUrls := []string{"https://helm-guestbook.com/my/sub/path/", "https://helm-guestbook.com/my/sub/path/2", "https://helm-guestbook.com"}
-	actualURLs := node.networkingInfo.ExternalURLs
-	sort.Strings(expectedExternalUrls)
-	sort.Strings(actualURLs)
-	assert.Equal(t, expectedExternalUrls, actualURLs)
-}
-func TestExternalUrlWithNoSubPath(t *testing.T) {
-	ingress := strToUnstructured(`
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    name: helm-guestbook
-    namespace: default
-  spec:
-    rules:
-    - http:
-        paths:
-        - backend:
-            serviceName: helm-guestbook
-            servicePort: 443
-  status:
-    loadBalancer:
-      ingress:
-      - ip: 107.178.210.11`)
-
-	node := &node{}
-	populateNodeInfo(ingress, node)
-
-	expectedExternalUrls := []string{"https://107.178.210.11"}
-	assert.Equal(t, expectedExternalUrls, node.networkingInfo.ExternalURLs)
-}
-
-func TestExternalUrlWithNetworkingApi(t *testing.T) {
-	ingress := strToUnstructured(`
-  apiVersion: networking.k8s.io/v1beta1
-  kind: Ingress
-  metadata:
-    name: helm-guestbook
-    namespace: default
-  spec:
-    rules:
-    - http:
-        paths:
-        - backend:
-            serviceName: helm-guestbook
-            servicePort: 443
-  status:
-    loadBalancer:
-      ingress:
-      - ip: 107.178.210.11`)
-
-	node := &node{}
-	populateNodeInfo(ingress, node)
-
-	expectedExternalUrls := []string{"https://107.178.210.11"}
-	assert.Equal(t, expectedExternalUrls, node.networkingInfo.ExternalURLs)
-}

controller/cache/mocks/LiveStateCache.go

@@ -2,44 +2,54 @@
 
 package mocks
 
-import (
-	context "context"
-
-	metrics "github.com/argoproj/argo-cd/controller/metrics"
-	kube "github.com/argoproj/argo-cd/util/kube"
-
-	mock "github.com/stretchr/testify/mock"
-
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-
-	unstructured "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-	v1alpha1 "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-)
+import context "context"
+import kube "github.com/argoproj/argo-cd/util/kube"
+import mock "github.com/stretchr/testify/mock"
+import unstructured "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+import v1alpha1 "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
 
 // LiveStateCache is an autogenerated mock type for the LiveStateCache type
 type LiveStateCache struct {
 	mock.Mock
 }
 
-// GetClustersInfo provides a mock function with given fields:
-func (_m *LiveStateCache) GetClustersInfo() []metrics.ClusterInfo {
-	ret := _m.Called()
+// Delete provides a mock function with given fields: server, obj
+func (_m *LiveStateCache) Delete(server string, obj *unstructured.Unstructured) error {
+	ret := _m.Called(server, obj)
 
-	var r0 []metrics.ClusterInfo
-	if rf, ok := ret.Get(0).(func() []metrics.ClusterInfo); ok {
-		r0 = rf()
+	var r0 error
+	if rf, ok := ret.Get(0).(func(string, *unstructured.Unstructured) error); ok {
+		r0 = rf(server, obj)
 	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).([]metrics.ClusterInfo)
-		}
+		r0 = ret.Error(0)
 	}
 
 	return r0
 }
 
+// GetChildren provides a mock function with given fields: server, obj
+func (_m *LiveStateCache) GetChildren(server string, obj *unstructured.Unstructured) ([]v1alpha1.ResourceNode, error) {
+	ret := _m.Called(server, obj)
+
+	var r0 []v1alpha1.ResourceNode
+	if rf, ok := ret.Get(0).(func(string, *unstructured.Unstructured) []v1alpha1.ResourceNode); ok {
+		r0 = rf(server, obj)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]v1alpha1.ResourceNode)
+		}
+	}
+
+	var r1 error
+	if rf, ok := ret.Get(1).(func(string, *unstructured.Unstructured) error); ok {
+		r1 = rf(server, obj)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 // GetManagedLiveObjs provides a mock function with given fields: a, targetObjs
 func (_m *LiveStateCache) GetManagedLiveObjs(a *v1alpha1.Application, targetObjs []*unstructured.Unstructured) (map[kube.ResourceKey]*unstructured.Unstructured, error) {
 	ret := _m.Called(a, targetObjs)
@@ -63,78 +73,25 @@ func (_m *LiveStateCache) GetManagedLiveObjs(a *v1alpha1.Application, targetObjs
 	return r0, r1
 }
 
-// GetNamespaceTopLevelResources provides a mock function with given fields: server, namespace
-func (_m *LiveStateCache) GetNamespaceTopLevelResources(server string, namespace string) (map[kube.ResourceKey]v1alpha1.ResourceNode, error) {
-	ret := _m.Called(server, namespace)
-
-	var r0 map[kube.ResourceKey]v1alpha1.ResourceNode
-	if rf, ok := ret.Get(0).(func(string, string) map[kube.ResourceKey]v1alpha1.ResourceNode); ok {
-		r0 = rf(server, namespace)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(map[kube.ResourceKey]v1alpha1.ResourceNode)
-		}
-	}
-
-	var r1 error
-	if rf, ok := ret.Get(1).(func(string, string) error); ok {
-		r1 = rf(server, namespace)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// GetVersionsInfo provides a mock function with given fields: serverURL
-func (_m *LiveStateCache) GetVersionsInfo(serverURL string) (string, []v1.APIGroup, error) {
-	ret := _m.Called(serverURL)
-
-	var r0 string
-	if rf, ok := ret.Get(0).(func(string) string); ok {
-		r0 = rf(serverURL)
-	} else {
-		r0 = ret.Get(0).(string)
-	}
-
-	var r1 []v1.APIGroup
-	if rf, ok := ret.Get(1).(func(string) []v1.APIGroup); ok {
-		r1 = rf(serverURL)
-	} else {
-		if ret.Get(1) != nil {
-			r1 = ret.Get(1).([]v1.APIGroup)
-		}
-	}
-
-	var r2 error
-	if rf, ok := ret.Get(2).(func(string) error); ok {
-		r2 = rf(serverURL)
-	} else {
-		r2 = ret.Error(2)
-	}
-
-	return r0, r1, r2
-}
-
 // Invalidate provides a mock function with given fields:
 func (_m *LiveStateCache) Invalidate() {
 	_m.Called()
 }
 
-// IsNamespaced provides a mock function with given fields: server, gk
-func (_m *LiveStateCache) IsNamespaced(server string, gk schema.GroupKind) (bool, error) {
-	ret := _m.Called(server, gk)
+// IsNamespaced provides a mock function with given fields: server, obj
+func (_m *LiveStateCache) IsNamespaced(server string, obj *unstructured.Unstructured) (bool, error) {
+	ret := _m.Called(server, obj)
 
 	var r0 bool
-	if rf, ok := ret.Get(0).(func(string, schema.GroupKind) bool); ok {
-		r0 = rf(server, gk)
+	if rf, ok := ret.Get(0).(func(string, *unstructured.Unstructured) bool); ok {
+		r0 = rf(server, obj)
 	} else {
 		r0 = ret.Get(0).(bool)
 	}
 
 	var r1 error
-	if rf, ok := ret.Get(1).(func(string, schema.GroupKind) error); ok {
-		r1 = rf(server, gk)
+	if rf, ok := ret.Get(1).(func(string, *unstructured.Unstructured) error); ok {
+		r1 = rf(server, obj)
 	} else {
 		r1 = ret.Error(1)
 	}
@@ -142,30 +99,7 @@ func (_m *LiveStateCache) IsNamespaced(server string, gk schema.GroupKind) (bool
 	return r0, r1
 }
 
-// IterateHierarchy provides a mock function with given fields: server, key, action
-func (_m *LiveStateCache) IterateHierarchy(server string, key kube.ResourceKey, action func(v1alpha1.ResourceNode, string)) error {
-	ret := _m.Called(server, key, action)
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(string, kube.ResourceKey, func(v1alpha1.ResourceNode, string)) error); ok {
-		r0 = rf(server, key, action)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
 // Run provides a mock function with given fields: ctx
-func (_m *LiveStateCache) Run(ctx context.Context) error {
-	ret := _m.Called(ctx)
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(context.Context) error); ok {
-		r0 = rf(ctx)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
+func (_m *LiveStateCache) Run(ctx context.Context) {
+	_m.Called(ctx)
 }

controller/cache/node.go

@@ -18,12 +18,7 @@ type node struct {
 	ownerRefs       []metav1.OwnerReference
 	info            []appv1.InfoItem
 	appName         string
-	// available only for root application nodes
-	resource *unstructured.Unstructured
-	// networkingInfo are available only for known types involved into networking: Ingress, Service, Pod
-	networkingInfo *appv1.ResourceNetworkingInfo
-	images         []string
-	health         *appv1.HealthStatus
+	resource        *unstructured.Unstructured
 }
 
 func (n *node) isRootAppNode() bool {
@@ -35,16 +30,9 @@ func (n *node) resourceKey() kube.ResourceKey {
 }
 
 func (n *node) isParentOf(child *node) bool {
-	for i, ownerRef := range child.ownerRefs {
-
-		// backfill UID of inferred owner child references
-		if ownerRef.UID == "" && n.ref.Kind == ownerRef.Kind && n.ref.APIVersion == ownerRef.APIVersion && n.ref.Name == ownerRef.Name {
-			ownerRef.UID = n.ref.UID
-			child.ownerRefs[i] = ownerRef
-			return true
-		}
-
-		if n.ref.UID == ownerRef.UID {
+	for _, ownerRef := range child.ownerRefs {
+		ownerGvk := schema.FromAPIVersionAndKind(ownerRef.APIVersion, ownerRef.Kind)
+		if kube.NewResourceKey(ownerGvk.Group, ownerRef.Kind, n.ref.Namespace, ownerRef.Name) == n.resourceKey() {
 			return true
 		}
 	}
@@ -98,45 +86,30 @@ func newResourceKeySet(set map[kube.ResourceKey]bool, keys ...kube.ResourceKey)
 	return newSet
 }
 
-func (n *node) asResourceNode() appv1.ResourceNode {
-	gv, err := schema.ParseGroupVersion(n.ref.APIVersion)
-	if err != nil {
-		gv = schema.GroupVersion{}
-	}
-	parentRefs := make([]appv1.ResourceRef, len(n.ownerRefs))
-	for _, ownerRef := range n.ownerRefs {
-		ownerGvk := schema.FromAPIVersionAndKind(ownerRef.APIVersion, ownerRef.Kind)
-		ownerKey := kube.NewResourceKey(ownerGvk.Group, ownerRef.Kind, n.ref.Namespace, ownerRef.Name)
-		parentRefs[0] = appv1.ResourceRef{Name: ownerRef.Name, Kind: ownerKey.Kind, Namespace: n.ref.Namespace, Group: ownerKey.Group, UID: string(ownerRef.UID)}
-	}
-	return appv1.ResourceNode{
-		ResourceRef: appv1.ResourceRef{
-			UID:       string(n.ref.UID),
-			Name:      n.ref.Name,
-			Group:     gv.Group,
-			Version:   gv.Version,
-			Kind:      n.ref.Kind,
-			Namespace: n.ref.Namespace,
-		},
-		ParentRefs:      parentRefs,
-		Info:            n.info,
-		ResourceVersion: n.resourceVersion,
-		NetworkingInfo:  n.networkingInfo,
-		Images:          n.images,
-		Health:          n.health,
-	}
-}
-
-func (n *node) iterateChildren(ns map[kube.ResourceKey]*node, parents map[kube.ResourceKey]bool, action func(child appv1.ResourceNode, appName string)) {
-	for childKey, child := range ns {
+func (n *node) childResourceNodes(ns map[kube.ResourceKey]*node, parents map[kube.ResourceKey]bool) appv1.ResourceNode {
+	children := make([]appv1.ResourceNode, 0)
+	for childKey := range ns {
 		if n.isParentOf(ns[childKey]) {
 			if parents[childKey] {
 				key := n.resourceKey()
 				log.Warnf("Circular dependency detected. %s is child and parent of %s", childKey.String(), key.String())
 			} else {
-				action(child.asResourceNode(), child.getApp(ns))
-				child.iterateChildren(ns, newResourceKeySet(parents, n.resourceKey()), action)
+				children = append(children, ns[childKey].childResourceNodes(ns, newResourceKeySet(parents, n.resourceKey())))
 			}
 		}
 	}
+	gv, err := schema.ParseGroupVersion(n.ref.APIVersion)
+	if err != nil {
+		gv = schema.GroupVersion{}
+	}
+	return appv1.ResourceNode{
+		Name:            n.ref.Name,
+		Group:           gv.Group,
+		Version:         gv.Version,
+		Kind:            n.ref.Kind,
+		Namespace:       n.ref.Namespace,
+		Info:            n.info,
+		Children:        children,
+		ResourceVersion: n.resourceVersion,
+	}
 }

controller/cache/node_test.go

@@ -3,81 +3,23 @@ package cache
 import (
 	"testing"
 
-	"github.com/argoproj/argo-cd/common"
-
 	"github.com/stretchr/testify/assert"
 )
 
-var c = &clusterInfo{cacheSettingsSrc: func() *cacheSettings {
-	return &cacheSettings{AppInstanceLabelKey: common.LabelKeyAppInstance}
-}}
-
 func TestIsParentOf(t *testing.T) {
-	child := c.createObjInfo(testPod, "")
-	parent := c.createObjInfo(testRS, "")
-	grandParent := c.createObjInfo(testDeploy, "")
+	child := createObjInfo(testPod, "")
+	parent := createObjInfo(testRS, "")
+	grandParent := createObjInfo(testDeploy, "")
 
 	assert.True(t, parent.isParentOf(child))
 	assert.False(t, grandParent.isParentOf(child))
 }
 
-func TestIsParentOfSameKindDifferentGroupAndUID(t *testing.T) {
+func TestIsParentOfSameKindDifferentGroup(t *testing.T) {
 	rs := testRS.DeepCopy()
 	rs.SetAPIVersion("somecrd.io/v1")
-	rs.SetUID("123")
-	child := c.createObjInfo(testPod, "")
-	invalidParent := c.createObjInfo(rs, "")
+	child := createObjInfo(testPod, "")
+	invalidParent := createObjInfo(rs, "")
 
 	assert.False(t, invalidParent.isParentOf(child))
 }
-
-func TestIsServiceParentOfEndPointWithTheSameName(t *testing.T) {
-	nonMatchingNameEndPoint := c.createObjInfo(strToUnstructured(`
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: not-matching-name
-  namespace: default
-`), "")
-
-	matchingNameEndPoint := c.createObjInfo(strToUnstructured(`
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: helm-guestbook
-  namespace: default
-`), "")
-
-	parent := c.createObjInfo(testService, "")
-
-	assert.True(t, parent.isParentOf(matchingNameEndPoint))
-	assert.Equal(t, parent.ref.UID, matchingNameEndPoint.ownerRefs[0].UID)
-	assert.False(t, parent.isParentOf(nonMatchingNameEndPoint))
-}
-
-func TestIsServiceAccoountParentOfSecret(t *testing.T) {
-	serviceAccount := c.createObjInfo(strToUnstructured(`
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: default
-  namespace: default
-  uid: '123'
-secrets:
-- name: default-token-123
-`), "")
-	tokenSecret := c.createObjInfo(strToUnstructured(`
-apiVersion: v1
-kind: Secret
-metadata:
-  annotations:
-    kubernetes.io/service-account.name: default
-    kubernetes.io/service-account.uid: '123'
-  name: default-token-123
-  namespace: default
-  uid: '345'
-type: kubernetes.io/service-account-token
-`), "")
-
-	assert.True(t, serviceAccount.isParentOf(tokenSecret))
-}

controller/metrics/clustercollector.go

@@ -1,99 +0,0 @@
-package metrics
-
-import (
-	"context"
-	"sync"
-	"time"
-
-	"github.com/prometheus/client_golang/prometheus"
-)
-
-const (
-	metricsCollectionInterval = 30 * time.Second
-)
-
-var (
-	descClusterDefaultLabels = []string{"server"}
-
-	descClusterInfo = prometheus.NewDesc(
-		"argocd_cluster_info",
-		"Information about cluster.",
-		append(descClusterDefaultLabels, "k8s_version"),
-		nil,
-	)
-	descClusterCacheResources = prometheus.NewDesc(
-		"argocd_cluster_api_resource_objects",
-		"Number of k8s resource objects in the cache.",
-		descClusterDefaultLabels,
-		nil,
-	)
-	descClusterAPIs = prometheus.NewDesc(
-		"argocd_cluster_api_resources",
-		"Number of monitored kubernetes API resources.",
-		descClusterDefaultLabels,
-		nil,
-	)
-	descClusterCacheAgeSeconds = prometheus.NewDesc(
-		"argocd_cluster_cache_age_seconds",
-		"Cluster cache age in seconds.",
-		descClusterDefaultLabels,
-		nil,
-	)
-)
-
-type ClusterInfo struct {
-	Server            string
-	K8SVersion        string
-	ResourcesCount    int
-	APIsCount         int
-	LastCacheSyncTime *time.Time
-}
-
-type HasClustersInfo interface {
-	GetClustersInfo() []ClusterInfo
-}
-
-type clusterCollector struct {
-	infoSource HasClustersInfo
-	info       []ClusterInfo
-	lock       sync.Mutex
-}
-
-func (c *clusterCollector) Run(ctx context.Context) {
-	tick := time.Tick(metricsCollectionInterval)
-	for {
-		select {
-		case <-ctx.Done():
-			break
-		case <-tick:
-			info := c.infoSource.GetClustersInfo()
-
-			c.lock.Lock()
-			c.info = info
-			c.lock.Unlock()
-		}
-	}
-}
-
-// Describe implements the prometheus.Collector interface
-func (c *clusterCollector) Describe(ch chan<- *prometheus.Desc) {
-	ch <- descClusterInfo
-	ch <- descClusterCacheResources
-	ch <- descClusterAPIs
-	ch <- descClusterCacheAgeSeconds
-}
-
-func (c *clusterCollector) Collect(ch chan<- prometheus.Metric) {
-	now := time.Now()
-	for _, c := range c.info {
-		defaultValues := []string{c.Server}
-		ch <- prometheus.MustNewConstMetric(descClusterInfo, prometheus.GaugeValue, 1, append(defaultValues, c.K8SVersion)...)
-		ch <- prometheus.MustNewConstMetric(descClusterCacheResources, prometheus.GaugeValue, float64(c.ResourcesCount), defaultValues...)
-		ch <- prometheus.MustNewConstMetric(descClusterAPIs, prometheus.GaugeValue, float64(c.APIsCount), defaultValues...)
-		cacheAgeSeconds := -1
-		if c.LastCacheSyncTime != nil {
-			cacheAgeSeconds = int(now.Sub(*c.LastCacheSyncTime).Seconds())
-		}
-		ch <- prometheus.MustNewConstMetric(descClusterCacheAgeSeconds, prometheus.GaugeValue, float64(cacheAgeSeconds), defaultValues...)
-	}
-}

controller/metrics/metrics.go

@@ -1,10 +1,7 @@
 package metrics
 
 import (
-	"context"
 	"net/http"
-	"os"
-	"strconv"
 	"time"
 
 	"github.com/prometheus/client_golang/prometheus"
@@ -15,27 +12,17 @@ import (
 	argoappv1 "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
 	applister "github.com/argoproj/argo-cd/pkg/client/listers/application/v1alpha1"
 	"github.com/argoproj/argo-cd/util/git"
-	"github.com/argoproj/argo-cd/util/healthz"
 )
 
 type MetricsServer struct {
 	*http.Server
-	syncCounter             *prometheus.CounterVec
-	kubectlExecCounter      *prometheus.CounterVec
-	kubectlExecPendingGauge *prometheus.GaugeVec
-	k8sRequestCounter       *prometheus.CounterVec
-	clusterEventsCounter    *prometheus.CounterVec
-	redisRequestCounter     *prometheus.CounterVec
-	reconcileHistogram      *prometheus.HistogramVec
-	redisRequestHistogram   *prometheus.HistogramVec
-	registry                *prometheus.Registry
+	syncCounter        *prometheus.CounterVec
+	reconcileHistogram *prometheus.HistogramVec
 }
 
 const (
 	// MetricsPath is the endpoint to collect application metrics
 	MetricsPath = "/metrics"
-	// EnvVarLegacyControllerMetrics is a env var to re-enable deprecated prometheus metrics
-	EnvVarLegacyControllerMetrics = "ARGOCD_LEGACY_CONTROLLER_METRICS"
 )
 
 // Follow Prometheus naming practices
@@ -46,185 +33,79 @@ var (
 	descAppInfo = prometheus.NewDesc(
 		"argocd_app_info",
 		"Information about application.",
-		append(descAppDefaultLabels, "repo", "dest_server", "dest_namespace", "sync_status", "health_status", "operation"),
+		append(descAppDefaultLabels, "repo", "dest_server", "dest_namespace"),
 		nil,
 	)
-	// DEPRECATED
 	descAppCreated = prometheus.NewDesc(
 		"argocd_app_created_time",
 		"Creation time in unix timestamp for an application.",
 		descAppDefaultLabels,
 		nil,
 	)
-	// DEPRECATED: superceded by sync_status label in argocd_app_info
 	descAppSyncStatusCode = prometheus.NewDesc(
 		"argocd_app_sync_status",
 		"The application current sync status.",
 		append(descAppDefaultLabels, "sync_status"),
 		nil,
 	)
-	// DEPRECATED: superceded by health_status label in argocd_app_info
 	descAppHealthStatus = prometheus.NewDesc(
 		"argocd_app_health_status",
 		"The application current health status.",
 		append(descAppDefaultLabels, "health_status"),
 		nil,
 	)
+)
 
-	syncCounter = prometheus.NewCounterVec(
+// NewMetricsServer returns a new prometheus server which collects application metrics
+func NewMetricsServer(addr string, appLister applister.ApplicationLister) *MetricsServer {
+	mux := http.NewServeMux()
+	appRegistry := NewAppRegistry(appLister)
+	appRegistry.MustRegister(prometheus.NewProcessCollector(prometheus.ProcessCollectorOpts{}))
+	appRegistry.MustRegister(prometheus.NewGoCollector())
+	mux.Handle(MetricsPath, promhttp.HandlerFor(appRegistry, promhttp.HandlerOpts{}))
+
+	syncCounter := prometheus.NewCounterVec(
 		prometheus.CounterOpts{
 			Name: "argocd_app_sync_total",
 			Help: "Number of application syncs.",
 		},
-		append(descAppDefaultLabels, "dest_server", "phase"),
+		append(descAppDefaultLabels, "phase"),
 	)
+	appRegistry.MustRegister(syncCounter)
 
-	k8sRequestCounter = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: "argocd_app_k8s_request_total",
-			Help: "Number of kubernetes requests executed during application reconciliation.",
-		},
-		append(descAppDefaultLabels, "server", "response_code", "verb", "resource_kind", "resource_namespace"),
-	)
-
-	kubectlExecCounter = prometheus.NewCounterVec(prometheus.CounterOpts{
-		Name: "argocd_kubectl_exec_total",
-		Help: "Number of kubectl executions",
-	}, []string{"command"})
-
-	kubectlExecPendingGauge = prometheus.NewGaugeVec(prometheus.GaugeOpts{
-		Name: "argocd_kubectl_exec_pending",
-		Help: "Number of pending kubectl executions",
-	}, []string{"command"})
-
-	reconcileHistogram = prometheus.NewHistogramVec(
+	reconcileHistogram := prometheus.NewHistogramVec(
 		prometheus.HistogramOpts{
 			Name: "argocd_app_reconcile",
 			Help: "Application reconciliation performance.",
 			// Buckets chosen after observing a ~2100ms mean reconcile time
 			Buckets: []float64{0.25, .5, 1, 2, 4, 8, 16},
 		},
-		[]string{"namespace", "dest_server"},
+		append(descAppDefaultLabels),
 	)
 
-	clusterEventsCounter = prometheus.NewCounterVec(prometheus.CounterOpts{
-		Name: "argocd_cluster_events_total",
-		Help: "Number of processes k8s resource events.",
-	}, append(descClusterDefaultLabels, "group", "kind"))
-
-	redisRequestCounter = prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: "argocd_redis_request_total",
-			Help: "Number of kubernetes requests executed during application reconciliation.",
-		},
-		[]string{"initiator", "failed"},
-	)
-
-	redisRequestHistogram = prometheus.NewHistogramVec(
-		prometheus.HistogramOpts{
-			Name:    "argocd_redis_request_duration",
-			Help:    "Redis requests duration.",
-			Buckets: []float64{0.01, 0.05, 0.10, 0.25, .5, 1},
-		},
-		[]string{"initiator"},
-	)
-)
-
-// NewMetricsServer returns a new prometheus server which collects application metrics
-func NewMetricsServer(addr string, appLister applister.ApplicationLister, healthCheck func() error) *MetricsServer {
-	mux := http.NewServeMux()
-	registry := NewAppRegistry(appLister)
-	mux.Handle(MetricsPath, promhttp.HandlerFor(prometheus.Gatherers{
-		// contains app controller specific metrics
-		registry,
-		// contains process, golang and controller workqueues metrics
-		prometheus.DefaultGatherer,
-	}, promhttp.HandlerOpts{}))
-	healthz.ServeHealthCheck(mux, healthCheck)
-
-	registry.MustRegister(syncCounter)
-	registry.MustRegister(k8sRequestCounter)
-	registry.MustRegister(kubectlExecCounter)
-	registry.MustRegister(kubectlExecPendingGauge)
-	registry.MustRegister(reconcileHistogram)
-	registry.MustRegister(clusterEventsCounter)
-	registry.MustRegister(redisRequestCounter)
-	registry.MustRegister(redisRequestHistogram)
+	appRegistry.MustRegister(reconcileHistogram)
 
 	return &MetricsServer{
-		registry: registry,
 		Server: &http.Server{
 			Addr:    addr,
 			Handler: mux,
 		},
-		syncCounter:             syncCounter,
-		k8sRequestCounter:       k8sRequestCounter,
-		kubectlExecCounter:      kubectlExecCounter,
-		kubectlExecPendingGauge: kubectlExecPendingGauge,
-		reconcileHistogram:      reconcileHistogram,
-		clusterEventsCounter:    clusterEventsCounter,
-		redisRequestCounter:     redisRequestCounter,
-		redisRequestHistogram:   redisRequestHistogram,
+		syncCounter:        syncCounter,
+		reconcileHistogram: reconcileHistogram,
 	}
 }
 
-func (m *MetricsServer) RegisterClustersInfoSource(ctx context.Context, source HasClustersInfo) {
-	collector := &clusterCollector{infoSource: source}
-	go collector.Run(ctx)
-	m.registry.MustRegister(collector)
-}
-
 // IncSync increments the sync counter for an application
 func (m *MetricsServer) IncSync(app *argoappv1.Application, state *argoappv1.OperationState) {
 	if !state.Phase.Completed() {
 		return
 	}
-	m.syncCounter.WithLabelValues(app.Namespace, app.Name, app.Spec.GetProject(), app.Spec.Destination.Server, string(state.Phase)).Inc()
-}
-
-func (m *MetricsServer) IncKubectlExec(command string) {
-	m.kubectlExecCounter.WithLabelValues(command).Inc()
-}
-
-func (m *MetricsServer) IncKubectlExecPending(command string) {
-	m.kubectlExecPendingGauge.WithLabelValues(command).Inc()
-}
-
-func (m *MetricsServer) DecKubectlExecPending(command string) {
-	m.kubectlExecPendingGauge.WithLabelValues(command).Dec()
-}
-
-// IncClusterEventsCount increments the number of cluster events
-func (m *MetricsServer) IncClusterEventsCount(server, group, kind string) {
-	m.clusterEventsCounter.WithLabelValues(server, group, kind).Inc()
-}
-
-// IncKubernetesRequest increments the kubernetes requests counter for an application
-func (m *MetricsServer) IncKubernetesRequest(app *argoappv1.Application, server, statusCode, verb, resourceKind, resourceNamespace string) {
-	var namespace, name, project string
-	if app != nil {
-		namespace = app.Namespace
-		name = app.Name
-		project = app.Spec.GetProject()
-	}
-	m.k8sRequestCounter.WithLabelValues(
-		namespace, name, project, server, statusCode,
-		verb, resourceKind, resourceNamespace,
-	).Inc()
-}
-
-func (m *MetricsServer) IncRedisRequest(failed bool) {
-	m.redisRequestCounter.WithLabelValues("argocd-application-controller", strconv.FormatBool(failed)).Inc()
-}
-
-// ObserveRedisRequestDuration observes redis request duration
-func (m *MetricsServer) ObserveRedisRequestDuration(duration time.Duration) {
-	m.redisRequestHistogram.WithLabelValues("argocd-application-controller").Observe(duration.Seconds())
+	m.syncCounter.WithLabelValues(app.Namespace, app.Name, app.Spec.GetProject(), string(state.Phase)).Inc()
 }
 
 // IncReconcile increments the reconcile counter for an application
 func (m *MetricsServer) IncReconcile(app *argoappv1.Application, duration time.Duration) {
-	m.reconcileHistogram.WithLabelValues(app.Namespace, app.Spec.Destination.Server).Observe(duration.Seconds())
+	m.reconcileHistogram.WithLabelValues(app.Namespace, app.Name, app.Spec.GetProject()).Observe(duration.Seconds())
 }
 
 type appCollector struct {
@@ -248,6 +129,7 @@ func NewAppRegistry(appLister applister.ApplicationLister) *prometheus.Registry
 // Describe implements the prometheus.Collector interface
 func (c *appCollector) Describe(ch chan<- *prometheus.Desc) {
 	ch <- descAppInfo
+	ch <- descAppCreated
 	ch <- descAppSyncStatusCode
 	ch <- descAppHealthStatus
 }
@@ -281,36 +163,20 @@ func collectApps(ch chan<- prometheus.Metric, app *argoappv1.Application) {
 		addConstMetric(desc, prometheus.GaugeValue, v, lv...)
 	}
 
-	var operation string
-	if app.DeletionTimestamp != nil {
-		operation = "delete"
-	} else if app.Operation != nil && app.Operation.Sync != nil {
-		operation = "sync"
-	}
+	addGauge(descAppInfo, 1, git.NormalizeGitURL(app.Spec.Source.RepoURL), app.Spec.Destination.Server, app.Spec.Destination.Namespace)
+
+	addGauge(descAppCreated, float64(app.CreationTimestamp.Unix()))
+
 	syncStatus := app.Status.Sync.Status
-	if syncStatus == "" {
-		syncStatus = argoappv1.SyncStatusCodeUnknown
-	}
+	addGauge(descAppSyncStatusCode, boolFloat64(syncStatus == argoappv1.SyncStatusCodeSynced), string(argoappv1.SyncStatusCodeSynced))
+	addGauge(descAppSyncStatusCode, boolFloat64(syncStatus == argoappv1.SyncStatusCodeOutOfSync), string(argoappv1.SyncStatusCodeOutOfSync))
+	addGauge(descAppSyncStatusCode, boolFloat64(syncStatus == argoappv1.SyncStatusCodeUnknown || syncStatus == ""), string(argoappv1.SyncStatusCodeUnknown))
+
 	healthStatus := app.Status.Health.Status
-	if healthStatus == "" {
-		healthStatus = argoappv1.HealthStatusUnknown
-	}
-
-	addGauge(descAppInfo, 1, git.NormalizeGitURL(app.Spec.Source.RepoURL), app.Spec.Destination.Server, app.Spec.Destination.Namespace, string(syncStatus), healthStatus, operation)
-
-	// Deprecated controller metrics
-	if os.Getenv(EnvVarLegacyControllerMetrics) == "true" {
-		addGauge(descAppCreated, float64(app.CreationTimestamp.Unix()))
-
-		addGauge(descAppSyncStatusCode, boolFloat64(syncStatus == argoappv1.SyncStatusCodeSynced), string(argoappv1.SyncStatusCodeSynced))
-		addGauge(descAppSyncStatusCode, boolFloat64(syncStatus == argoappv1.SyncStatusCodeOutOfSync), string(argoappv1.SyncStatusCodeOutOfSync))
-		addGauge(descAppSyncStatusCode, boolFloat64(syncStatus == argoappv1.SyncStatusCodeUnknown || syncStatus == ""), string(argoappv1.SyncStatusCodeUnknown))
-
-		addGauge(descAppHealthStatus, boolFloat64(healthStatus == argoappv1.HealthStatusUnknown || healthStatus == ""), argoappv1.HealthStatusUnknown)
-		addGauge(descAppHealthStatus, boolFloat64(healthStatus == argoappv1.HealthStatusProgressing), argoappv1.HealthStatusProgressing)
-		addGauge(descAppHealthStatus, boolFloat64(healthStatus == argoappv1.HealthStatusSuspended), argoappv1.HealthStatusSuspended)
-		addGauge(descAppHealthStatus, boolFloat64(healthStatus == argoappv1.HealthStatusHealthy), argoappv1.HealthStatusHealthy)
-		addGauge(descAppHealthStatus, boolFloat64(healthStatus == argoappv1.HealthStatusDegraded), argoappv1.HealthStatusDegraded)
-		addGauge(descAppHealthStatus, boolFloat64(healthStatus == argoappv1.HealthStatusMissing), argoappv1.HealthStatusMissing)
-	}
+	addGauge(descAppHealthStatus, boolFloat64(healthStatus == argoappv1.HealthStatusUnknown || healthStatus == ""), argoappv1.HealthStatusUnknown)
+	addGauge(descAppHealthStatus, boolFloat64(healthStatus == argoappv1.HealthStatusProgressing), argoappv1.HealthStatusProgressing)
+	addGauge(descAppHealthStatus, boolFloat64(healthStatus == argoappv1.HealthStatusSuspended), argoappv1.HealthStatusSuspended)
+	addGauge(descAppHealthStatus, boolFloat64(healthStatus == argoappv1.HealthStatusHealthy), argoappv1.HealthStatusHealthy)
+	addGauge(descAppHealthStatus, boolFloat64(healthStatus == argoappv1.HealthStatusDegraded), argoappv1.HealthStatusDegraded)
+	addGauge(descAppHealthStatus, boolFloat64(healthStatus == argoappv1.HealthStatusMissing), argoappv1.HealthStatusMissing)
 }

controller/metrics/metrics_test.go

@@ -5,7 +5,6 @@ import (
 	"log"
 	"net/http"
 	"net/http/httptest"
-	"os"
 	"strings"
 	"testing"
 	"time"
@@ -43,52 +42,25 @@ status:
     status: Healthy
 `
 
-const fakeApp2 = `
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: my-app-2
-  namespace: argocd
-spec:
-  destination:
-    namespace: dummy-namespace
-    server: https://localhost:6443
-  project: important-project
-  source:
-    path: some/path
-    repoURL: https://github.com/argoproj/argocd-example-apps.git
-status:
-  sync:
-    status: Synced
-  health:
-    status: Healthy
-operation:
-  sync:
-    revision: 041eab7439ece92c99b043f0e171788185b8fc1d
-    syncStrategy:
-      hook: {}
-`
-
-const fakeApp3 = `
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: my-app-3
-  namespace: argocd
-  deletionTimestamp: "2020-03-16T09:17:45Z"
-spec:
-  destination:
-    namespace: dummy-namespace
-    server: https://localhost:6443
-  project: important-project
-  source:
-    path: some/path
-    repoURL: https://github.com/argoproj/argocd-example-apps.git
-status:
-  sync:
-    status: OutOfSync
-  health:
-    status: Degraded
+const expectedResponse = `# HELP argocd_app_created_time Creation time in unix timestamp for an application.
+# TYPE argocd_app_created_time gauge
+argocd_app_created_time{name="my-app",namespace="argocd",project="important-project"} -6.21355968e+10
+# HELP argocd_app_health_status The application current health status.
+# TYPE argocd_app_health_status gauge
+argocd_app_health_status{health_status="Degraded",name="my-app",namespace="argocd",project="important-project"} 0
+argocd_app_health_status{health_status="Healthy",name="my-app",namespace="argocd",project="important-project"} 1
+argocd_app_health_status{health_status="Missing",name="my-app",namespace="argocd",project="important-project"} 0
+argocd_app_health_status{health_status="Progressing",name="my-app",namespace="argocd",project="important-project"} 0
+argocd_app_health_status{health_status="Suspended",name="my-app",namespace="argocd",project="important-project"} 0
+argocd_app_health_status{health_status="Unknown",name="my-app",namespace="argocd",project="important-project"} 0
+# HELP argocd_app_info Information about application.
+# TYPE argocd_app_info gauge
+argocd_app_info{dest_namespace="dummy-namespace",dest_server="https://localhost:6443",name="my-app",namespace="argocd",project="important-project",repo="https://github.com/argoproj/argocd-example-apps"} 1
+# HELP argocd_app_sync_status The application current sync status.
+# TYPE argocd_app_sync_status gauge
+argocd_app_sync_status{name="my-app",namespace="argocd",project="important-project",sync_status="OutOfSync"} 0
+argocd_app_sync_status{name="my-app",namespace="argocd",project="important-project",sync_status="Synced"} 1
+argocd_app_sync_status{name="my-app",namespace="argocd",project="important-project",sync_status="Unknown"} 0
 `
 
 const fakeDefaultApp = `
@@ -111,26 +83,42 @@ status:
     status: Healthy
 `
 
-var noOpHealthCheck = func() error {
-	return nil
-}
+const expectedDefaultResponse = `# HELP argocd_app_created_time Creation time in unix timestamp for an application.
+# TYPE argocd_app_created_time gauge
+argocd_app_created_time{name="my-app",namespace="argocd",project="default"} -6.21355968e+10
+# HELP argocd_app_health_status The application current health status.
+# TYPE argocd_app_health_status gauge
+argocd_app_health_status{health_status="Degraded",name="my-app",namespace="argocd",project="default"} 0
+argocd_app_health_status{health_status="Healthy",name="my-app",namespace="argocd",project="default"} 1
+argocd_app_health_status{health_status="Missing",name="my-app",namespace="argocd",project="default"} 0
+argocd_app_health_status{health_status="Progressing",name="my-app",namespace="argocd",project="default"} 0
+argocd_app_health_status{health_status="Suspended",name="my-app",namespace="argocd",project="default"} 0
+argocd_app_health_status{health_status="Unknown",name="my-app",namespace="argocd",project="default"} 0
+# HELP argocd_app_info Information about application.
+# TYPE argocd_app_info gauge
+argocd_app_info{dest_namespace="dummy-namespace",dest_server="https://localhost:6443",name="my-app",namespace="argocd",project="default",repo="https://github.com/argoproj/argocd-example-apps"} 1
+# HELP argocd_app_sync_status The application current sync status.
+# TYPE argocd_app_sync_status gauge
+argocd_app_sync_status{name="my-app",namespace="argocd",project="default",sync_status="OutOfSync"} 0
+argocd_app_sync_status{name="my-app",namespace="argocd",project="default",sync_status="Synced"} 1
+argocd_app_sync_status{name="my-app",namespace="argocd",project="default",sync_status="Unknown"} 0
+`
 
-func newFakeApp(fakeAppYAML string) *argoappv1.Application {
+func newFakeApp(fakeApp string) *argoappv1.Application {
 	var app argoappv1.Application
-	err := yaml.Unmarshal([]byte(fakeAppYAML), &app)
+	err := yaml.Unmarshal([]byte(fakeApp), &app)
 	if err != nil {
 		panic(err)
 	}
 	return &app
 }
 
-func newFakeLister(fakeAppYAMLs ...string) (context.CancelFunc, applister.ApplicationLister) {
+func newFakeLister(fakeApp ...string) (context.CancelFunc, applister.ApplicationLister) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 	var fakeApps []runtime.Object
-	for _, appYAML := range fakeAppYAMLs {
-		a := newFakeApp(appYAML)
-		fakeApps = append(fakeApps, a)
+	for _, name := range fakeApp {
+		fakeApps = append(fakeApps, newFakeApp(name))
 	}
 	appClientset := appclientset.NewSimpleClientset(fakeApps...)
 	factory := appinformer.NewFilteredSharedInformerFactory(appClientset, 0, "argocd", func(options *metav1.ListOptions) {})
@@ -142,10 +130,10 @@ func newFakeLister(fakeAppYAMLs ...string) (context.CancelFunc, applister.Applic
 	return cancel, factory.Argoproj().V1alpha1().Applications().Lister()
 }
 
-func testApp(t *testing.T, fakeAppYAMLs []string, expectedResponse string) {
-	cancel, appLister := newFakeLister(fakeAppYAMLs...)
+func testApp(t *testing.T, fakeApp string, expectedResponse string) {
+	cancel, appLister := newFakeLister(fakeApp)
 	defer cancel()
-	metricsServ := NewMetricsServer("localhost:8082", appLister, noOpHealthCheck)
+	metricsServ := NewMetricsServer("localhost:8082", appLister)
 	req, err := http.NewRequest("GET", "/metrics", nil)
 	assert.NoError(t, err)
 	rr := httptest.NewRecorder()
@@ -157,74 +145,38 @@ func testApp(t *testing.T, fakeAppYAMLs []string, expectedResponse string) {
 }
 
 type testCombination struct {
-	applications     []string
+	application      string
 	expectedResponse string
 }
 
 func TestMetrics(t *testing.T) {
 	combinations := []testCombination{
 		{
-			applications: []string{fakeApp, fakeApp2, fakeApp3},
-			expectedResponse: `
-# HELP argocd_app_info Information about application.
-# TYPE argocd_app_info gauge
-argocd_app_info{dest_namespace="dummy-namespace",dest_server="https://localhost:6443",health_status="Degraded",name="my-app-3",namespace="argocd",operation="delete",project="important-project",repo="https://github.com/argoproj/argocd-example-apps",sync_status="OutOfSync"} 1
-argocd_app_info{dest_namespace="dummy-namespace",dest_server="https://localhost:6443",health_status="Healthy",name="my-app",namespace="argocd",operation="",project="important-project",repo="https://github.com/argoproj/argocd-example-apps",sync_status="Synced"} 1
-argocd_app_info{dest_namespace="dummy-namespace",dest_server="https://localhost:6443",health_status="Healthy",name="my-app-2",namespace="argocd",operation="sync",project="important-project",repo="https://github.com/argoproj/argocd-example-apps",sync_status="Synced"} 1
-`,
+			application:      fakeApp,
+			expectedResponse: expectedResponse,
 		},
 		{
-			applications: []string{fakeDefaultApp},
-			expectedResponse: `
-# HELP argocd_app_info Information about application.
-# TYPE argocd_app_info gauge
-argocd_app_info{dest_namespace="dummy-namespace",dest_server="https://localhost:6443",health_status="Healthy",name="my-app",namespace="argocd",operation="",project="default",repo="https://github.com/argoproj/argocd-example-apps",sync_status="Synced"} 1
-`,
+			application:      fakeDefaultApp,
+			expectedResponse: expectedDefaultResponse,
 		},
 	}
 
 	for _, combination := range combinations {
-		testApp(t, combination.applications, combination.expectedResponse)
+		testApp(t, combination.application, combination.expectedResponse)
 	}
 }
 
-func TestLegacyMetrics(t *testing.T) {
-	os.Setenv(EnvVarLegacyControllerMetrics, "true")
-	defer os.Unsetenv(EnvVarLegacyControllerMetrics)
-
-	expectedResponse := `
-# HELP argocd_app_created_time Creation time in unix timestamp for an application.
-# TYPE argocd_app_created_time gauge
-argocd_app_created_time{name="my-app",namespace="argocd",project="important-project"} -6.21355968e+10
-# HELP argocd_app_health_status The application current health status.
-# TYPE argocd_app_health_status gauge
-argocd_app_health_status{health_status="Degraded",name="my-app",namespace="argocd",project="important-project"} 0
-argocd_app_health_status{health_status="Healthy",name="my-app",namespace="argocd",project="important-project"} 1
-argocd_app_health_status{health_status="Missing",name="my-app",namespace="argocd",project="important-project"} 0
-argocd_app_health_status{health_status="Progressing",name="my-app",namespace="argocd",project="important-project"} 0
-argocd_app_health_status{health_status="Suspended",name="my-app",namespace="argocd",project="important-project"} 0
-argocd_app_health_status{health_status="Unknown",name="my-app",namespace="argocd",project="important-project"} 0
-# HELP argocd_app_sync_status The application current sync status.
-# TYPE argocd_app_sync_status gauge
-argocd_app_sync_status{name="my-app",namespace="argocd",project="important-project",sync_status="OutOfSync"} 0
-argocd_app_sync_status{name="my-app",namespace="argocd",project="important-project",sync_status="Synced"} 1
-argocd_app_sync_status{name="my-app",namespace="argocd",project="important-project",sync_status="Unknown"} 0
+const appSyncTotal = `# HELP argocd_app_sync_total Number of application syncs.
+# TYPE argocd_app_sync_total counter
+argocd_app_sync_total{name="my-app",namespace="argocd",phase="Error",project="important-project"} 1
+argocd_app_sync_total{name="my-app",namespace="argocd",phase="Failed",project="important-project"} 1
+argocd_app_sync_total{name="my-app",namespace="argocd",phase="Succeeded",project="important-project"} 2
 `
-	testApp(t, []string{fakeApp}, expectedResponse)
-}
 
 func TestMetricsSyncCounter(t *testing.T) {
 	cancel, appLister := newFakeLister()
 	defer cancel()
-	metricsServ := NewMetricsServer("localhost:8082", appLister, noOpHealthCheck)
-
-	appSyncTotal := `
-# HELP argocd_app_sync_total Number of application syncs.
-# TYPE argocd_app_sync_total counter
-argocd_app_sync_total{dest_server="https://localhost:6443",name="my-app",namespace="argocd",phase="Error",project="important-project"} 1
-argocd_app_sync_total{dest_server="https://localhost:6443",name="my-app",namespace="argocd",phase="Failed",project="important-project"} 1
-argocd_app_sync_total{dest_server="https://localhost:6443",name="my-app",namespace="argocd",phase="Succeeded",project="important-project"} 2
-`
+	metricsServ := NewMetricsServer("localhost:8082", appLister)
 
 	fakeApp := newFakeApp(fakeApp)
 	metricsServ.IncSync(fakeApp, &argoappv1.OperationState{Phase: argoappv1.OperationRunning})
@@ -246,31 +198,27 @@ argocd_app_sync_total{dest_server="https://localhost:6443",name="my-app",namespa
 // assertMetricsPrinted asserts every line in the expected lines appears in the body
 func assertMetricsPrinted(t *testing.T, expectedLines, body string) {
 	for _, line := range strings.Split(expectedLines, "\n") {
-		if line == "" {
-			continue
-		}
 		assert.Contains(t, body, line)
 	}
 }
 
+const appReconcileMetrics = `argocd_app_reconcile_bucket{name="my-app",namespace="argocd",project="important-project",le="0.25"} 0
+argocd_app_reconcile_bucket{name="my-app",namespace="argocd",project="important-project",le="0.5"} 0
+argocd_app_reconcile_bucket{name="my-app",namespace="argocd",project="important-project",le="1"} 0
+argocd_app_reconcile_bucket{name="my-app",namespace="argocd",project="important-project",le="2"} 0
+argocd_app_reconcile_bucket{name="my-app",namespace="argocd",project="important-project",le="4"} 0
+argocd_app_reconcile_bucket{name="my-app",namespace="argocd",project="important-project",le="8"} 1
+argocd_app_reconcile_bucket{name="my-app",namespace="argocd",project="important-project",le="16"} 1
+argocd_app_reconcile_bucket{name="my-app",namespace="argocd",project="important-project",le="+Inf"} 1
+argocd_app_reconcile_sum{name="my-app",namespace="argocd",project="important-project"} 5
+argocd_app_reconcile_count{name="my-app",namespace="argocd",project="important-project"} 1
+`
+
 func TestReconcileMetrics(t *testing.T) {
 	cancel, appLister := newFakeLister()
 	defer cancel()
-	metricsServ := NewMetricsServer("localhost:8082", appLister, noOpHealthCheck)
-	appReconcileMetrics := `
-# HELP argocd_app_reconcile Application reconciliation performance.
-# TYPE argocd_app_reconcile histogram
-argocd_app_reconcile_bucket{dest_server="https://localhost:6443",namespace="argocd",le="0.25"} 0
-argocd_app_reconcile_bucket{dest_server="https://localhost:6443",namespace="argocd",le="0.5"} 0
-argocd_app_reconcile_bucket{dest_server="https://localhost:6443",namespace="argocd",le="1"} 0
-argocd_app_reconcile_bucket{dest_server="https://localhost:6443",namespace="argocd",le="2"} 0
-argocd_app_reconcile_bucket{dest_server="https://localhost:6443",namespace="argocd",le="4"} 0
-argocd_app_reconcile_bucket{dest_server="https://localhost:6443",namespace="argocd",le="8"} 1
-argocd_app_reconcile_bucket{dest_server="https://localhost:6443",namespace="argocd",le="16"} 1
-argocd_app_reconcile_bucket{dest_server="https://localhost:6443",namespace="argocd",le="+Inf"} 1
-argocd_app_reconcile_sum{dest_server="https://localhost:6443",namespace="argocd"} 5
-argocd_app_reconcile_count{dest_server="https://localhost:6443",namespace="argocd"} 1
-`
+	metricsServ := NewMetricsServer("localhost:8082", appLister)
+
 	fakeApp := newFakeApp(fakeApp)
 	metricsServ.IncReconcile(fakeApp, 5*time.Second)
 

controller/metrics/transportwrapper.go

@@ -1,24 +0,0 @@
-package metrics
-
-import (
-	"strconv"
-
-	"github.com/argoproj/pkg/kubeclientmetrics"
-	"k8s.io/client-go/rest"
-
-	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-)
-
-// AddMetricsTransportWrapper adds a transport wrapper which increments 'argocd_app_k8s_request_total' counter on each kubernetes request
-func AddMetricsTransportWrapper(server *MetricsServer, app *v1alpha1.Application, config *rest.Config) *rest.Config {
-	inc := func(resourceInfo kubeclientmetrics.ResourceInfo) error {
-		namespace := resourceInfo.Namespace
-		kind := resourceInfo.Kind
-		statusCode := strconv.Itoa(resourceInfo.StatusCode)
-		server.IncKubernetesRequest(app, resourceInfo.Server, statusCode, string(resourceInfo.Verb), kind, namespace)
-		return nil
-	}
-
-	newConfig := kubeclientmetrics.AddMetricsTransportWrapper(config, inc)
-	return newConfig
-}

controller/state.go

@@ -7,20 +7,18 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
-	"github.com/yudai/gojsondiff"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/tools/cache"
 
 	"github.com/argoproj/argo-cd/common"
 	statecache "github.com/argoproj/argo-cd/controller/cache"
-	"github.com/argoproj/argo-cd/controller/metrics"
 	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
 	appv1 "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
 	appclientset "github.com/argoproj/argo-cd/pkg/client/clientset/versioned"
-	"github.com/argoproj/argo-cd/reposerver/apiclient"
+	"github.com/argoproj/argo-cd/reposerver"
+	"github.com/argoproj/argo-cd/reposerver/repository"
 	"github.com/argoproj/argo-cd/util"
 	"github.com/argoproj/argo-cd/util/argo"
 	"github.com/argoproj/argo-cd/util/db"
@@ -28,10 +26,7 @@ import (
 	"github.com/argoproj/argo-cd/util/health"
 	hookutil "github.com/argoproj/argo-cd/util/hook"
 	kubeutil "github.com/argoproj/argo-cd/util/kube"
-	"github.com/argoproj/argo-cd/util/resource"
-	"github.com/argoproj/argo-cd/util/resource/ignore"
 	"github.com/argoproj/argo-cd/util/settings"
-	"github.com/argoproj/argo-cd/util/stats"
 )
 
 type managedResource struct {
@@ -55,62 +50,45 @@ func GetLiveObjs(res []managedResource) []*unstructured.Unstructured {
 }
 
 type ResourceInfoProvider interface {
-	IsNamespaced(server string, gk schema.GroupKind) (bool, error)
+	IsNamespaced(server string, obj *unstructured.Unstructured) (bool, error)
 }
 
 // AppStateManager defines methods which allow to compare application spec and actual application state.
 type AppStateManager interface {
-	CompareAppState(app *v1alpha1.Application, project *appv1.AppProject, revision string, source v1alpha1.ApplicationSource, noCache bool, localObjects []string) *comparisonResult
+	CompareAppState(app *v1alpha1.Application, revision string, source v1alpha1.ApplicationSource, noCache bool) (*comparisonResult, error)
 	SyncAppState(app *v1alpha1.Application, state *v1alpha1.OperationState)
 }
 
 type comparisonResult struct {
+	reconciledAt     metav1.Time
 	syncStatus       *v1alpha1.SyncStatus
 	healthStatus     *v1alpha1.HealthStatus
 	resources        []v1alpha1.ResourceStatus
 	managedResources []managedResource
+	conditions       []v1alpha1.ApplicationCondition
 	hooks            []*unstructured.Unstructured
 	diffNormalizer   diff.Normalizer
 	appSourceType    v1alpha1.ApplicationSourceType
-	// timings maps phases of comparison to the duration it took to complete (for statistical purposes)
-	timings map[string]time.Duration
-}
-
-func (cr *comparisonResult) targetObjs() []*unstructured.Unstructured {
-	objs := cr.hooks
-	for _, r := range cr.managedResources {
-		if r.Target != nil {
-			objs = append(objs, r.Target)
-		}
-	}
-	return objs
 }
 
 // appStateManager allows to compare applications to git
 type appStateManager struct {
-	metricsServer  *metrics.MetricsServer
 	db             db.ArgoDB
-	settingsMgr    *settings.SettingsManager
+	settings       *settings.ArgoCDSettings
 	appclientset   appclientset.Interface
 	projInformer   cache.SharedIndexInformer
 	kubectl        kubeutil.Kubectl
-	repoClientset  apiclient.Clientset
+	repoClientset  reposerver.Clientset
 	liveStateCache statecache.LiveStateCache
 	namespace      string
 }
 
-func (m *appStateManager) getRepoObjs(app *v1alpha1.Application, source v1alpha1.ApplicationSource, appLabelKey, revision string, noCache bool) ([]*unstructured.Unstructured, []*unstructured.Unstructured, *apiclient.ManifestResponse, error) {
-	ts := stats.NewTimingStats()
-	helmRepos, err := m.db.ListHelmRepositories(context.Background())
+func (m *appStateManager) getRepoObjs(app *v1alpha1.Application, source v1alpha1.ApplicationSource, appLabelKey, revision string, noCache bool) ([]*unstructured.Unstructured, []*unstructured.Unstructured, *repository.ManifestResponse, error) {
+	helmRepos, err := m.db.ListHelmRepos(context.Background())
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	ts.AddCheckpoint("helm_ms")
-	repo, err := m.db.GetRepository(context.Background(), source.RepoURL)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-	ts.AddCheckpoint("repo_ms")
+	repo := m.getRepo(source.RepoURL)
 	conn, repoClient, err := m.repoClientset.NewRepoServerClient()
 	if err != nil {
 		return nil, nil, nil, err
@@ -121,33 +99,14 @@ func (m *appStateManager) getRepoObjs(app *v1alpha1.Application, source v1alpha1
 		revision = source.TargetRevision
 	}
 
-	plugins, err := m.settingsMgr.GetConfigManagementPlugins()
-	if err != nil {
-		return nil, nil, nil, err
-	}
-	ts.AddCheckpoint("plugins_ms")
-	tools := make([]*appv1.ConfigManagementPlugin, len(plugins))
-	for i := range plugins {
-		tools[i] = &plugins[i]
+	tools := make([]*appv1.ConfigManagementPlugin, len(m.settings.ConfigManagementPlugins))
+	for i := range m.settings.ConfigManagementPlugins {
+		tools[i] = &m.settings.ConfigManagementPlugins[i]
 	}
 
-	kustomizeSettings, err := m.settingsMgr.GetKustomizeSettings()
-	if err != nil {
-		return nil, nil, nil, err
-	}
-	kustomizeOptions, err := kustomizeSettings.GetOptions(app.Spec.Source)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-	ts.AddCheckpoint("build_options_ms")
-	serverVersion, apiGroups, err := m.liveStateCache.GetVersionsInfo(app.Spec.Destination.Server)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-	ts.AddCheckpoint("version_ms")
-	manifestInfo, err := repoClient.GenerateManifest(context.Background(), &apiclient.ManifestRequest{
+	manifestInfo, err := repoClient.GenerateManifest(context.Background(), &repository.ManifestRequest{
 		Repo:              repo,
-		Repos:             helmRepos,
+		HelmRepos:         helmRepos,
 		Revision:          revision,
 		NoCache:           noCache,
 		AppLabelKey:       appLabelKey,
@@ -155,38 +114,17 @@ func (m *appStateManager) getRepoObjs(app *v1alpha1.Application, source v1alpha1
 		Namespace:         app.Spec.Destination.Namespace,
 		ApplicationSource: &source,
 		Plugins:           tools,
-		KustomizeOptions:  kustomizeOptions,
-		KubeVersion:       serverVersion,
-		ApiVersions:       argo.APIGroupsToVersions(apiGroups),
 	})
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	ts.AddCheckpoint("manifests_ms")
-	targetObjs, hooks, err := unmarshalManifests(manifestInfo.Manifests)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-	ts.AddCheckpoint("unmarshal_ms")
-	logCtx := log.WithField("application", app.Name)
-	for k, v := range ts.Timings() {
-		logCtx = logCtx.WithField(k, v.Milliseconds())
-	}
-	logCtx = logCtx.WithField("time_ms", time.Since(ts.StartTime).Milliseconds())
-	logCtx.Info("getRepoObjs stats")
-	return targetObjs, hooks, manifestInfo, nil
-}
 
-func unmarshalManifests(manifests []string) ([]*unstructured.Unstructured, []*unstructured.Unstructured, error) {
 	targetObjs := make([]*unstructured.Unstructured, 0)
 	hooks := make([]*unstructured.Unstructured, 0)
-	for _, manifest := range manifests {
+	for _, manifest := range manifestInfo.Manifests {
 		obj, err := v1alpha1.UnmarshalToUnstructured(manifest)
 		if err != nil {
-			return nil, nil, err
-		}
-		if obj == nil || ignore.Ignore(obj) {
-			continue
+			return nil, nil, nil, err
 		}
 		if hookutil.IsHook(obj) {
 			hooks = append(hooks, obj)
@@ -194,7 +132,7 @@ func unmarshalManifests(manifests []string) ([]*unstructured.Unstructured, []*un
 			targetObjs = append(targetObjs, obj)
 		}
 	}
-	return targetObjs, hooks, nil
+	return targetObjs, hooks, manifestInfo, nil
 }
 
 func DeduplicateTargetObjects(
@@ -207,7 +145,7 @@ func DeduplicateTargetObjects(
 	targetByKey := make(map[kubeutil.ResourceKey][]*unstructured.Unstructured)
 	for i := range objs {
 		obj := objs[i]
-		isNamespaced, err := infoProvider.IsNamespaced(server, obj.GroupVersionKind().GroupKind())
+		isNamespaced, err := infoProvider.IsNamespaced(server, obj)
 		if err != nil {
 			return objs, nil, err
 		}
@@ -223,11 +161,9 @@ func DeduplicateTargetObjects(
 	result := make([]*unstructured.Unstructured, 0)
 	for key, targets := range targetByKey {
 		if len(targets) > 1 {
-			now := metav1.Now()
 			conditions = append(conditions, appv1.ApplicationCondition{
-				Type:               appv1.ApplicationConditionRepeatedResourceWarning,
-				Message:            fmt.Sprintf("Resource %s appeared %d times among application resources.", key.String(), len(targets)),
-				LastTransitionTime: &now,
+				Type:    appv1.ApplicationConditionRepeatedResourceWarning,
+				Message: fmt.Sprintf("Resource %s appeared %d times among application resources.", key.String(), len(targets)),
 			})
 		}
 		result = append(result, targets[len(targets)-1])
@@ -236,152 +172,47 @@ func DeduplicateTargetObjects(
 	return result, conditions, nil
 }
 
-// dedupLiveResources handles removes live resource duplicates with the same UID. Duplicates are created in a separate resource groups.
-// E.g. apps/Deployment produces duplicate in extensions/Deployment, authorization.openshift.io/ClusterRole produces duplicate in rbac.authorization.k8s.io/ClusterRole etc.
-// The method removes such duplicates unless it was defined in git ( exists in target resources list ). At least one duplicate stays.
-// If non of duplicates are in git at random one stays
-func dedupLiveResources(targetObjs []*unstructured.Unstructured, liveObjsByKey map[kubeutil.ResourceKey]*unstructured.Unstructured) {
-	targetObjByKey := make(map[kubeutil.ResourceKey]*unstructured.Unstructured)
-	for i := range targetObjs {
-		targetObjByKey[kubeutil.GetResourceKey(targetObjs[i])] = targetObjs[i]
-	}
-	liveObjsById := make(map[types.UID][]*unstructured.Unstructured)
-	for k := range liveObjsByKey {
-		obj := liveObjsByKey[k]
-		if obj != nil {
-			liveObjsById[obj.GetUID()] = append(liveObjsById[obj.GetUID()], obj)
-		}
-	}
-	for id := range liveObjsById {
-		objs := liveObjsById[id]
-
-		if len(objs) > 1 {
-			duplicatesLeft := len(objs)
-			for i := range objs {
-				obj := objs[i]
-				resourceKey := kubeutil.GetResourceKey(obj)
-				if _, ok := targetObjByKey[resourceKey]; !ok {
-					delete(liveObjsByKey, resourceKey)
-					duplicatesLeft--
-					if duplicatesLeft == 1 {
-						break
-					}
-				}
-			}
-		}
-	}
-}
-
-func (m *appStateManager) getComparisonSettings(app *appv1.Application) (string, map[string]v1alpha1.ResourceOverride, diff.Normalizer, *settings.ResourcesFilter, error) {
-	resourceOverrides, err := m.settingsMgr.GetResourceOverrides()
-	if err != nil {
-		return "", nil, nil, nil, err
-	}
-	appLabelKey, err := m.settingsMgr.GetAppInstanceLabelKey()
-	if err != nil {
-		return "", nil, nil, nil, err
-	}
-	diffNormalizer, err := argo.NewDiffNormalizer(app.Spec.IgnoreDifferences, resourceOverrides)
-	if err != nil {
-		return "", nil, nil, nil, err
-	}
-	resFilter, err := m.settingsMgr.GetResourcesFilter()
-	if err != nil {
-		return "", nil, nil, nil, err
-	}
-	return appLabelKey, resourceOverrides, diffNormalizer, resFilter, nil
-}
-
 // CompareAppState compares application git state to the live app state, using the specified
 // revision and supplied source. If revision or overrides are empty, then compares against
 // revision and overrides in the app spec.
-func (m *appStateManager) CompareAppState(app *v1alpha1.Application, project *appv1.AppProject, revision string, source v1alpha1.ApplicationSource, noCache bool, localManifests []string) *comparisonResult {
-	ts := stats.NewTimingStats()
-	appLabelKey, resourceOverrides, diffNormalizer, resFilter, err := m.getComparisonSettings(app)
-	ts.AddCheckpoint("settings_ms")
-
-	// return unknown comparison result if basic comparison settings cannot be loaded
+func (m *appStateManager) CompareAppState(app *v1alpha1.Application, revision string, source v1alpha1.ApplicationSource, noCache bool) (*comparisonResult, error) {
+	diffNormalizer, err := argo.NewDiffNormalizer(app.Spec.IgnoreDifferences, m.settings.ResourceOverrides)
 	if err != nil {
-		return &comparisonResult{
-			syncStatus: &v1alpha1.SyncStatus{
-				ComparedTo: appv1.ComparedTo{Source: source, Destination: app.Spec.Destination},
-				Status:     appv1.SyncStatusCodeUnknown,
-			},
-			healthStatus: &appv1.HealthStatus{Status: appv1.HealthStatusUnknown},
-		}
+		return nil, err
 	}
-
-	// do best effort loading live and target state to present as much information about app state as possible
-	failedToLoadObjs := false
-	conditions := make([]v1alpha1.ApplicationCondition, 0)
-
 	logCtx := log.WithField("application", app.Name)
 	logCtx.Infof("Comparing app state (cluster: %s, namespace: %s)", app.Spec.Destination.Server, app.Spec.Destination.Namespace)
-
-	var targetObjs []*unstructured.Unstructured
-	var hooks []*unstructured.Unstructured
-	var manifestInfo *apiclient.ManifestResponse
-	now := metav1.Now()
-
-	if len(localManifests) == 0 {
-		targetObjs, hooks, manifestInfo, err = m.getRepoObjs(app, source, appLabelKey, revision, noCache)
-		if err != nil {
-			targetObjs = make([]*unstructured.Unstructured, 0)
-			conditions = append(conditions, v1alpha1.ApplicationCondition{Type: v1alpha1.ApplicationConditionComparisonError, Message: err.Error(), LastTransitionTime: &now})
-			failedToLoadObjs = true
-		}
-	} else {
-		targetObjs, hooks, err = unmarshalManifests(localManifests)
-		if err != nil {
-			targetObjs = make([]*unstructured.Unstructured, 0)
-			conditions = append(conditions, v1alpha1.ApplicationCondition{Type: v1alpha1.ApplicationConditionComparisonError, Message: err.Error(), LastTransitionTime: &now})
-			failedToLoadObjs = true
-		}
-		manifestInfo = nil
+	observedAt := metav1.Now()
+	failedToLoadObjs := false
+	conditions := make([]v1alpha1.ApplicationCondition, 0)
+	appLabelKey := m.settings.GetAppInstanceLabelKey()
+	targetObjs, hooks, manifestInfo, err := m.getRepoObjs(app, source, appLabelKey, revision, noCache)
+	if err != nil {
+		targetObjs = make([]*unstructured.Unstructured, 0)
+		conditions = append(conditions, v1alpha1.ApplicationCondition{Type: v1alpha1.ApplicationConditionComparisonError, Message: err.Error()})
+		failedToLoadObjs = true
 	}
-	ts.AddCheckpoint("git_ms")
-
 	targetObjs, dedupConditions, err := DeduplicateTargetObjects(app.Spec.Destination.Server, app.Spec.Destination.Namespace, targetObjs, m.liveStateCache)
 	if err != nil {
-		conditions = append(conditions, v1alpha1.ApplicationCondition{Type: v1alpha1.ApplicationConditionComparisonError, Message: err.Error(), LastTransitionTime: &now})
+		conditions = append(conditions, v1alpha1.ApplicationCondition{Type: v1alpha1.ApplicationConditionComparisonError, Message: err.Error()})
 	}
 	conditions = append(conditions, dedupConditions...)
-	for i := len(targetObjs) - 1; i >= 0; i-- {
-		targetObj := targetObjs[i]
-		gvk := targetObj.GroupVersionKind()
-		if resFilter.IsExcludedResource(gvk.Group, gvk.Kind, app.Spec.Destination.Server) {
-			targetObjs = append(targetObjs[:i], targetObjs[i+1:]...)
-			conditions = append(conditions, v1alpha1.ApplicationCondition{
-				Type:               v1alpha1.ApplicationConditionExcludedResourceWarning,
-				Message:            fmt.Sprintf("Resource %s/%s %s is excluded in the settings", gvk.Group, gvk.Kind, targetObj.GetName()),
-				LastTransitionTime: &now,
-			})
-		}
-	}
-	ts.AddCheckpoint("dedup_ms")
 
+	logCtx.Debugf("Generated config manifests")
 	liveObjByKey, err := m.liveStateCache.GetManagedLiveObjs(app, targetObjs)
 	if err != nil {
 		liveObjByKey = make(map[kubeutil.ResourceKey]*unstructured.Unstructured)
-		conditions = append(conditions, v1alpha1.ApplicationCondition{Type: v1alpha1.ApplicationConditionComparisonError, Message: err.Error(), LastTransitionTime: &now})
+		conditions = append(conditions, v1alpha1.ApplicationCondition{Type: v1alpha1.ApplicationConditionComparisonError, Message: err.Error()})
 		failedToLoadObjs = true
 	}
-	dedupLiveResources(targetObjs, liveObjByKey)
-	// filter out all resources which are not permitted in the application project
-	for k, v := range liveObjByKey {
-		if !project.IsLiveResourcePermitted(v, app.Spec.Destination.Server) {
-			delete(liveObjByKey, k)
-		}
-	}
-
+	logCtx.Debugf("Retrieved lived manifests")
 	for _, liveObj := range liveObjByKey {
 		if liveObj != nil {
 			appInstanceName := kubeutil.GetAppInstanceLabel(liveObj, appLabelKey)
 			if appInstanceName != "" && appInstanceName != app.Name {
 				conditions = append(conditions, v1alpha1.ApplicationCondition{
-					Type:               v1alpha1.ApplicationConditionSharedResourceWarning,
-					Message:            fmt.Sprintf("%s/%s is part of a different application: %s", liveObj.GetKind(), liveObj.GetName(), appInstanceName),
-					LastTransitionTime: &now,
+					Type:    v1alpha1.ApplicationConditionSharedResourceWarning,
+					Message: fmt.Sprintf("%s/%s is part of a different application: %s", liveObj.GetKind(), liveObj.GetName(), appInstanceName),
 				})
 			}
 		}
@@ -391,7 +222,7 @@ func (m *appStateManager) CompareAppState(app *v1alpha1.Application, project *ap
 	for i, obj := range targetObjs {
 		gvk := obj.GroupVersionKind()
 		ns := util.FirstNonEmpty(obj.GetNamespace(), app.Spec.Destination.Namespace)
-		if namespaced, err := m.liveStateCache.IsNamespaced(app.Spec.Destination.Server, obj.GroupVersionKind().GroupKind()); err == nil && !namespaced {
+		if namespaced, err := m.liveStateCache.IsNamespaced(app.Spec.Destination.Server, obj); err == nil && !namespaced {
 			ns = ""
 		}
 		key := kubeutil.NewResourceKey(gvk.Group, gvk.Kind, ns, obj.GetName())
@@ -402,8 +233,7 @@ func (m *appStateManager) CompareAppState(app *v1alpha1.Application, project *ap
 			managedLiveObj[i] = nil
 		}
 	}
-	ts.AddCheckpoint("live_ms")
-
+	logCtx.Debugf("built managed objects list")
 	// Everything remaining in liveObjByKey are "extra" resources that aren't tracked in git.
 	// The following adds all the extras to the managedLiveObj list and backfills the targetObj
 	// list with nils, so that the lists are of equal lengths for comparison purposes.
@@ -415,20 +245,16 @@ func (m *appStateManager) CompareAppState(app *v1alpha1.Application, project *ap
 	// Do the actual comparison
 	diffResults, err := diff.DiffArray(targetObjs, managedLiveObj, diffNormalizer)
 	if err != nil {
-		diffResults = &diff.DiffResultList{}
-		failedToLoadObjs = true
-		conditions = append(conditions, v1alpha1.ApplicationCondition{Type: v1alpha1.ApplicationConditionComparisonError, Message: err.Error(), LastTransitionTime: &now})
+		return nil, err
 	}
-	ts.AddCheckpoint("diff_ms")
 
 	syncCode := v1alpha1.SyncStatusCodeSynced
 	managedResources := make([]managedResource, len(targetObjs))
 	resourceSummaries := make([]v1alpha1.ResourceStatus, len(targetObjs))
-	for i, targetObj := range targetObjs {
-		liveObj := managedLiveObj[i]
-		obj := liveObj
+	for i := 0; i < len(targetObjs); i++ {
+		obj := managedLiveObj[i]
 		if obj == nil {
-			obj = targetObj
+			obj = targetObjs[i]
 		}
 		if obj == nil {
 			continue
@@ -436,60 +262,35 @@ func (m *appStateManager) CompareAppState(app *v1alpha1.Application, project *ap
 		gvk := obj.GroupVersionKind()
 
 		resState := v1alpha1.ResourceStatus{
-			Namespace:       obj.GetNamespace(),
-			Name:            obj.GetName(),
-			Kind:            gvk.Kind,
-			Version:         gvk.Version,
-			Group:           gvk.Group,
-			Hook:            hookutil.IsHook(obj),
-			RequiresPruning: targetObj == nil && liveObj != nil,
+			Namespace: obj.GetNamespace(),
+			Name:      obj.GetName(),
+			Kind:      gvk.Kind,
+			Version:   gvk.Version,
+			Group:     gvk.Group,
+			Hook:      hookutil.IsHook(obj),
 		}
 
-		var diffResult diff.DiffResult
-		if i < len(diffResults.Diffs) {
-			diffResult = diffResults.Diffs[i]
-		} else {
-			diffResult = diff.DiffResult{
-				Diff:           gojsondiff.New().CompareObjects(map[string]interface{}{}, map[string]interface{}{}),
-				Modified:       false,
-				NormalizedLive: []byte("{}"),
-				PredictedLive:  []byte("{}"),
-			}
-		}
-		if resState.Hook || ignore.Ignore(obj) {
+		diffResult := diffResults.Diffs[i]
+		if resState.Hook {
 			// For resource hooks, don't store sync status, and do not affect overall sync status
-		} else if diffResult.Modified || targetObj == nil || liveObj == nil {
+		} else if diffResult.Modified || targetObjs[i] == nil || managedLiveObj[i] == nil {
 			// Set resource state to OutOfSync since one of the following is true:
 			// * target and live resource are different
 			// * target resource not defined and live resource is extra
 			// * target resource present but live resource is missing
 			resState.Status = v1alpha1.SyncStatusCodeOutOfSync
-			// we ignore the status if the obj needs pruning AND we have the annotation
-			needsPruning := targetObj == nil && liveObj != nil
-			if !(needsPruning && resource.HasAnnotationOption(obj, common.AnnotationCompareOptions, "IgnoreExtraneous")) {
-				syncCode = v1alpha1.SyncStatusCodeOutOfSync
-			}
+			syncCode = v1alpha1.SyncStatusCodeOutOfSync
 		} else {
 			resState.Status = v1alpha1.SyncStatusCodeSynced
 		}
-		// set unknown status to all resource that are not permitted in the app project
-		isNamespaced, err := m.liveStateCache.IsNamespaced(app.Spec.Destination.Server, gvk.GroupKind())
-		if !project.IsGroupKindPermitted(gvk.GroupKind(), isNamespaced && err == nil) {
-			resState.Status = v1alpha1.SyncStatusCodeUnknown
-		}
-
-		// we can't say anything about the status if we were unable to get the target objects
-		if failedToLoadObjs {
-			resState.Status = v1alpha1.SyncStatusCodeUnknown
-		}
 		managedResources[i] = managedResource{
 			Name:      resState.Name,
 			Namespace: resState.Namespace,
 			Group:     resState.Group,
 			Kind:      resState.Kind,
 			Version:   resState.Version,
-			Live:      liveObj,
-			Target:    targetObj,
+			Live:      managedLiveObj[i],
+			Target:    targetObjs[i],
 			Diff:      diffResult,
 			Hook:      resState.Hook,
 		}
@@ -509,36 +310,35 @@ func (m *appStateManager) CompareAppState(app *v1alpha1.Application, project *ap
 	if manifestInfo != nil {
 		syncStatus.Revision = manifestInfo.Revision
 	}
-	ts.AddCheckpoint("sync_ms")
-
-	healthStatus, err := health.SetApplicationHealth(resourceSummaries, GetLiveObjs(managedResources), resourceOverrides, func(obj *unstructured.Unstructured) bool {
-		return !isSelfReferencedApp(app, kubeutil.GetObjectRef(obj))
-	})
 
+	healthStatus, err := health.SetApplicationHealth(resourceSummaries, GetLiveObjs(managedResources), m.settings.ResourceOverrides)
 	if err != nil {
-		conditions = append(conditions, appv1.ApplicationCondition{Type: v1alpha1.ApplicationConditionComparisonError, Message: err.Error(), LastTransitionTime: &now})
+		conditions = append(conditions, appv1.ApplicationCondition{Type: v1alpha1.ApplicationConditionComparisonError, Message: err.Error()})
 	}
 
 	compRes := comparisonResult{
+		reconciledAt:     observedAt,
 		syncStatus:       &syncStatus,
 		healthStatus:     healthStatus,
 		resources:        resourceSummaries,
 		managedResources: managedResources,
+		conditions:       conditions,
 		hooks:            hooks,
 		diffNormalizer:   diffNormalizer,
 	}
 	if manifestInfo != nil {
 		compRes.appSourceType = v1alpha1.ApplicationSourceType(manifestInfo.SourceType)
 	}
-	app.Status.SetConditions(conditions, map[appv1.ApplicationConditionType]bool{
-		appv1.ApplicationConditionComparisonError:         true,
-		appv1.ApplicationConditionSharedResourceWarning:   true,
-		appv1.ApplicationConditionRepeatedResourceWarning: true,
-		appv1.ApplicationConditionExcludedResourceWarning: true,
-	})
-	ts.AddCheckpoint("health_ms")
-	compRes.timings = ts.Timings()
-	return &compRes
+	return &compRes, nil
+}
+
+func (m *appStateManager) getRepo(repoURL string) *v1alpha1.Repository {
+	repo, err := m.db.GetRepository(context.Background(), repoURL)
+	if err != nil {
+		// If we couldn't retrieve from the repo service, assume public repositories
+		repo = &v1alpha1.Repository{Repo: repoURL}
+	}
+	return repo
 }
 
 func (m *appStateManager) persistRevisionHistory(app *v1alpha1.Application, revision string, source v1alpha1.ApplicationSource) error {
@@ -546,18 +346,20 @@ func (m *appStateManager) persistRevisionHistory(app *v1alpha1.Application, revi
 	if len(app.Status.History) > 0 {
 		nextID = app.Status.History[len(app.Status.History)-1].ID + 1
 	}
-	app.Status.History = append(app.Status.History, v1alpha1.RevisionHistory{
+	history := append(app.Status.History, v1alpha1.RevisionHistory{
 		Revision:   revision,
 		DeployedAt: metav1.NewTime(time.Now().UTC()),
 		ID:         nextID,
 		Source:     source,
 	})
 
-	app.Status.History = app.Status.History.Trunc(app.Spec.GetRevisionHistoryLimit())
+	if len(history) > common.RevisionHistoryLimit {
+		history = history[1 : common.RevisionHistoryLimit+1]
+	}
 
 	patch, err := json.Marshal(map[string]map[string][]v1alpha1.RevisionHistory{
 		"status": {
-			"history": app.Status.History,
+			"history": history,
 		},
 	})
 	if err != nil {
@@ -571,13 +373,12 @@ func (m *appStateManager) persistRevisionHistory(app *v1alpha1.Application, revi
 func NewAppStateManager(
 	db db.ArgoDB,
 	appclientset appclientset.Interface,
-	repoClientset apiclient.Clientset,
+	repoClientset reposerver.Clientset,
 	namespace string,
 	kubectl kubeutil.Kubectl,
-	settingsMgr *settings.SettingsManager,
+	settings *settings.ArgoCDSettings,
 	liveStateCache statecache.LiveStateCache,
 	projInformer cache.SharedIndexInformer,
-	metricsServer *metrics.MetricsServer,
 ) AppStateManager {
 	return &appStateManager{
 		liveStateCache: liveStateCache,
@@ -586,8 +387,7 @@ func NewAppStateManager(
 		kubectl:        kubectl,
 		repoClientset:  repoClientset,
 		namespace:      namespace,
-		settingsMgr:    settingsMgr,
+		settings:       settings,
 		projInformer:   projInformer,
-		metricsServer:  metricsServer,
 	}
 }

controller/state_test.go

@@ -5,14 +5,12 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	v1 "k8s.io/api/apps/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 
 	"github.com/argoproj/argo-cd/common"
 	argoappv1 "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	"github.com/argoproj/argo-cd/reposerver/apiclient"
+	"github.com/argoproj/argo-cd/reposerver/repository"
 	"github.com/argoproj/argo-cd/test"
 	"github.com/argoproj/argo-cd/util/kube"
 )
@@ -21,7 +19,7 @@ import (
 func TestCompareAppStateEmpty(t *testing.T) {
 	app := newFakeApp()
 	data := fakeData{
-		manifestResponse: &apiclient.ManifestResponse{
+		manifestResponse: &repository.ManifestResponse{
 			Manifests: []string{},
 			Namespace: test.FakeDestNamespace,
 			Server:    test.FakeClusterURL,
@@ -30,22 +28,22 @@ func TestCompareAppStateEmpty(t *testing.T) {
 		managedLiveObjs: make(map[kube.ResourceKey]*unstructured.Unstructured),
 	}
 	ctrl := newFakeController(&data)
-	compRes := ctrl.appStateManager.CompareAppState(app, &defaultProj, "", app.Spec.Source, false, nil)
+	compRes, err := ctrl.appStateManager.CompareAppState(app, "", app.Spec.Source, false)
+	assert.NoError(t, err)
 	assert.NotNil(t, compRes)
-	assert.NotNil(t, compRes.syncStatus)
 	assert.Equal(t, argoappv1.SyncStatusCodeSynced, compRes.syncStatus.Status)
-	assert.Len(t, compRes.resources, 0)
-	assert.Len(t, compRes.managedResources, 0)
-	assert.Len(t, app.Status.Conditions, 0)
+	assert.Equal(t, 0, len(compRes.resources))
+	assert.Equal(t, 0, len(compRes.managedResources))
+	assert.Equal(t, 0, len(compRes.conditions))
 }
 
-// TestCompareAppStateMissing tests when there is a manifest defined in the repo which doesn't exist in live
+// TestCompareAppStateMissing tests when there is a manifest defined in git which doesn't exist in live
 func TestCompareAppStateMissing(t *testing.T) {
 	app := newFakeApp()
 	data := fakeData{
 		apps: []runtime.Object{app},
-		manifestResponse: &apiclient.ManifestResponse{
-			Manifests: []string{test.PodManifest},
+		manifestResponse: &repository.ManifestResponse{
+			Manifests: []string{string(test.PodManifest)},
 			Namespace: test.FakeDestNamespace,
 			Server:    test.FakeClusterURL,
 			Revision:  "abc123",
@@ -53,13 +51,13 @@ func TestCompareAppStateMissing(t *testing.T) {
 		managedLiveObjs: make(map[kube.ResourceKey]*unstructured.Unstructured),
 	}
 	ctrl := newFakeController(&data)
-	compRes := ctrl.appStateManager.CompareAppState(app, &defaultProj, "", app.Spec.Source, false, nil)
+	compRes, err := ctrl.appStateManager.CompareAppState(app, "", app.Spec.Source, false)
+	assert.NoError(t, err)
 	assert.NotNil(t, compRes)
-	assert.NotNil(t, compRes.syncStatus)
 	assert.Equal(t, argoappv1.SyncStatusCodeOutOfSync, compRes.syncStatus.Status)
-	assert.Len(t, compRes.resources, 1)
-	assert.Len(t, compRes.managedResources, 1)
-	assert.Len(t, app.Status.Conditions, 0)
+	assert.Equal(t, 1, len(compRes.resources))
+	assert.Equal(t, 1, len(compRes.managedResources))
+	assert.Equal(t, 0, len(compRes.conditions))
 }
 
 // TestCompareAppStateExtra tests when there is an extra object in live but not defined in git
@@ -69,7 +67,7 @@ func TestCompareAppStateExtra(t *testing.T) {
 	app := newFakeApp()
 	key := kube.ResourceKey{Group: "", Kind: "Pod", Namespace: test.FakeDestNamespace, Name: app.Name}
 	data := fakeData{
-		manifestResponse: &apiclient.ManifestResponse{
+		manifestResponse: &repository.ManifestResponse{
 			Manifests: []string{},
 			Namespace: test.FakeDestNamespace,
 			Server:    test.FakeClusterURL,
@@ -80,12 +78,13 @@ func TestCompareAppStateExtra(t *testing.T) {
 		},
 	}
 	ctrl := newFakeController(&data)
-	compRes := ctrl.appStateManager.CompareAppState(app, &defaultProj, "", app.Spec.Source, false, nil)
+	compRes, err := ctrl.appStateManager.CompareAppState(app, "", app.Spec.Source, false)
+	assert.NoError(t, err)
 	assert.NotNil(t, compRes)
 	assert.Equal(t, argoappv1.SyncStatusCodeOutOfSync, compRes.syncStatus.Status)
 	assert.Equal(t, 1, len(compRes.resources))
 	assert.Equal(t, 1, len(compRes.managedResources))
-	assert.Equal(t, 0, len(app.Status.Conditions))
+	assert.Equal(t, 0, len(compRes.conditions))
 }
 
 // TestCompareAppStateHook checks that hooks are detected during manifest generation, and not
@@ -97,7 +96,7 @@ func TestCompareAppStateHook(t *testing.T) {
 	app := newFakeApp()
 	data := fakeData{
 		apps: []runtime.Object{app},
-		manifestResponse: &apiclient.ManifestResponse{
+		manifestResponse: &repository.ManifestResponse{
 			Manifests: []string{string(podBytes)},
 			Namespace: test.FakeDestNamespace,
 			Server:    test.FakeClusterURL,
@@ -106,39 +105,13 @@ func TestCompareAppStateHook(t *testing.T) {
 		managedLiveObjs: make(map[kube.ResourceKey]*unstructured.Unstructured),
 	}
 	ctrl := newFakeController(&data)
-	compRes := ctrl.appStateManager.CompareAppState(app, &defaultProj, "", app.Spec.Source, false, nil)
+	compRes, err := ctrl.appStateManager.CompareAppState(app, "", app.Spec.Source, false)
+	assert.NoError(t, err)
 	assert.NotNil(t, compRes)
 	assert.Equal(t, argoappv1.SyncStatusCodeSynced, compRes.syncStatus.Status)
 	assert.Equal(t, 0, len(compRes.resources))
 	assert.Equal(t, 0, len(compRes.managedResources))
-	assert.Equal(t, 1, len(compRes.hooks))
-	assert.Equal(t, 0, len(app.Status.Conditions))
-}
-
-// checks that ignore resources are detected, but excluded from status
-func TestCompareAppStateCompareOptionIgnoreExtraneous(t *testing.T) {
-	pod := test.NewPod()
-	pod.SetAnnotations(map[string]string{common.AnnotationCompareOptions: "IgnoreExtraneous"})
-	app := newFakeApp()
-	data := fakeData{
-		apps: []runtime.Object{app},
-		manifestResponse: &apiclient.ManifestResponse{
-			Manifests: []string{},
-			Namespace: test.FakeDestNamespace,
-			Server:    test.FakeClusterURL,
-			Revision:  "abc123",
-		},
-		managedLiveObjs: make(map[kube.ResourceKey]*unstructured.Unstructured),
-	}
-	ctrl := newFakeController(&data)
-
-	compRes := ctrl.appStateManager.CompareAppState(app, &defaultProj, "", app.Spec.Source, false, nil)
-
-	assert.NotNil(t, compRes)
-	assert.Equal(t, argoappv1.SyncStatusCodeSynced, compRes.syncStatus.Status)
-	assert.Len(t, compRes.resources, 0)
-	assert.Len(t, compRes.managedResources, 0)
-	assert.Len(t, app.Status.Conditions, 0)
+	assert.Equal(t, 0, len(compRes.conditions))
 }
 
 // TestCompareAppStateExtraHook tests when there is an extra _hook_ object in live but not defined in git
@@ -149,7 +122,7 @@ func TestCompareAppStateExtraHook(t *testing.T) {
 	app := newFakeApp()
 	key := kube.ResourceKey{Group: "", Kind: "Pod", Namespace: test.FakeDestNamespace, Name: app.Name}
 	data := fakeData{
-		manifestResponse: &apiclient.ManifestResponse{
+		manifestResponse: &repository.ManifestResponse{
 			Manifests: []string{},
 			Namespace: test.FakeDestNamespace,
 			Server:    test.FakeClusterURL,
@@ -160,14 +133,13 @@ func TestCompareAppStateExtraHook(t *testing.T) {
 		},
 	}
 	ctrl := newFakeController(&data)
-	compRes := ctrl.appStateManager.CompareAppState(app, &defaultProj, "", app.Spec.Source, false, nil)
-
+	compRes, err := ctrl.appStateManager.CompareAppState(app, "", app.Spec.Source, false)
+	assert.NoError(t, err)
 	assert.NotNil(t, compRes)
 	assert.Equal(t, argoappv1.SyncStatusCodeSynced, compRes.syncStatus.Status)
 	assert.Equal(t, 1, len(compRes.resources))
 	assert.Equal(t, 1, len(compRes.managedResources))
-	assert.Equal(t, 0, len(compRes.hooks))
-	assert.Equal(t, 0, len(app.Status.Conditions))
+	assert.Equal(t, 0, len(compRes.conditions))
 }
 
 func toJSON(t *testing.T, obj *unstructured.Unstructured) string {
@@ -185,7 +157,7 @@ func TestCompareAppStateDuplicatedNamespacedResources(t *testing.T) {
 
 	app := newFakeApp()
 	data := fakeData{
-		manifestResponse: &apiclient.ManifestResponse{
+		manifestResponse: &repository.ManifestResponse{
 			Manifests: []string{toJSON(t, obj1), toJSON(t, obj2), toJSON(t, obj3)},
 			Namespace: test.FakeDestNamespace,
 			Server:    test.FakeClusterURL,
@@ -197,244 +169,12 @@ func TestCompareAppStateDuplicatedNamespacedResources(t *testing.T) {
 		},
 	}
 	ctrl := newFakeController(&data)
-	compRes := ctrl.appStateManager.CompareAppState(app, &defaultProj, "", app.Spec.Source, false, nil)
-
+	compRes, err := ctrl.appStateManager.CompareAppState(app, "", app.Spec.Source, false)
+	assert.NoError(t, err)
 	assert.NotNil(t, compRes)
-	assert.Equal(t, 1, len(app.Status.Conditions))
-	assert.NotNil(t, app.Status.Conditions[0].LastTransitionTime)
-	assert.Equal(t, argoappv1.ApplicationConditionRepeatedResourceWarning, app.Status.Conditions[0].Type)
-	assert.Equal(t, "Resource /Pod/fake-dest-ns/my-pod appeared 2 times among application resources.", app.Status.Conditions[0].Message)
+	assert.Contains(t, compRes.conditions, argoappv1.ApplicationCondition{
+		Message: "Resource /Pod/fake-dest-ns/my-pod appeared 2 times among application resources.",
+		Type:    argoappv1.ApplicationConditionRepeatedResourceWarning,
+	})
 	assert.Equal(t, 2, len(compRes.resources))
 }
-
-var defaultProj = argoappv1.AppProject{
-	ObjectMeta: metav1.ObjectMeta{
-		Name:      "default",
-		Namespace: test.FakeArgoCDNamespace,
-	},
-	Spec: argoappv1.AppProjectSpec{
-		SourceRepos: []string{"*"},
-		Destinations: []argoappv1.ApplicationDestination{
-			{
-				Server:    "*",
-				Namespace: "*",
-			},
-		},
-	},
-}
-
-func TestSetHealth(t *testing.T) {
-	app := newFakeApp()
-	deployment := kube.MustToUnstructured(&v1.Deployment{
-		TypeMeta: metav1.TypeMeta{
-			APIVersion: "apps/v1beta1",
-			Kind:       "Deployment",
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "demo",
-			Namespace: "default",
-		},
-	})
-	ctrl := newFakeController(&fakeData{
-		apps: []runtime.Object{app, &defaultProj},
-		manifestResponse: &apiclient.ManifestResponse{
-			Manifests: []string{},
-			Namespace: test.FakeDestNamespace,
-			Server:    test.FakeClusterURL,
-			Revision:  "abc123",
-		},
-		managedLiveObjs: map[kube.ResourceKey]*unstructured.Unstructured{
-			kube.GetResourceKey(deployment): deployment,
-		},
-	})
-
-	compRes := ctrl.appStateManager.CompareAppState(app, &defaultProj, "", app.Spec.Source, false, nil)
-
-	assert.Equal(t, compRes.healthStatus.Status, argoappv1.HealthStatusHealthy)
-}
-
-func TestSetHealthSelfReferencedApp(t *testing.T) {
-	app := newFakeApp()
-	unstructuredApp := kube.MustToUnstructured(app)
-	deployment := kube.MustToUnstructured(&v1.Deployment{
-		TypeMeta: metav1.TypeMeta{
-			APIVersion: "apps/v1beta1",
-			Kind:       "Deployment",
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "demo",
-			Namespace: "default",
-		},
-	})
-	ctrl := newFakeController(&fakeData{
-		apps: []runtime.Object{app, &defaultProj},
-		manifestResponse: &apiclient.ManifestResponse{
-			Manifests: []string{},
-			Namespace: test.FakeDestNamespace,
-			Server:    test.FakeClusterURL,
-			Revision:  "abc123",
-		},
-		managedLiveObjs: map[kube.ResourceKey]*unstructured.Unstructured{
-			kube.GetResourceKey(deployment):      deployment,
-			kube.GetResourceKey(unstructuredApp): unstructuredApp,
-		},
-	})
-
-	compRes := ctrl.appStateManager.CompareAppState(app, &defaultProj, "", app.Spec.Source, false, nil)
-
-	assert.Equal(t, compRes.healthStatus.Status, argoappv1.HealthStatusHealthy)
-}
-
-func TestSetManagedResourcesWithOrphanedResources(t *testing.T) {
-	proj := defaultProj.DeepCopy()
-	proj.Spec.OrphanedResources = &argoappv1.OrphanedResourcesMonitorSettings{}
-
-	app := newFakeApp()
-	ctrl := newFakeController(&fakeData{
-		apps: []runtime.Object{app, proj},
-		namespacedResources: map[kube.ResourceKey]namespacedResource{
-			kube.NewResourceKey("apps", kube.DeploymentKind, app.Namespace, "guestbook"): {
-				ResourceNode: argoappv1.ResourceNode{
-					ResourceRef: argoappv1.ResourceRef{Kind: kube.DeploymentKind, Name: "guestbook", Namespace: app.Namespace},
-				},
-				AppName: "",
-			},
-		},
-	})
-
-	tree, err := ctrl.setAppManagedResources(app, &comparisonResult{managedResources: make([]managedResource, 0)})
-
-	assert.NoError(t, err)
-	assert.Equal(t, len(tree.OrphanedNodes), 1)
-	assert.Equal(t, "guestbook", tree.OrphanedNodes[0].Name)
-	assert.Equal(t, app.Namespace, tree.OrphanedNodes[0].Namespace)
-}
-
-func TestSetManagedResourcesWithResourcesOfAnotherApp(t *testing.T) {
-	proj := defaultProj.DeepCopy()
-	proj.Spec.OrphanedResources = &argoappv1.OrphanedResourcesMonitorSettings{}
-
-	app1 := newFakeApp()
-	app1.Name = "app1"
-	app2 := newFakeApp()
-	app2.Name = "app2"
-
-	ctrl := newFakeController(&fakeData{
-		apps: []runtime.Object{app1, app2, proj},
-		namespacedResources: map[kube.ResourceKey]namespacedResource{
-			kube.NewResourceKey("apps", kube.DeploymentKind, app2.Namespace, "guestbook"): {
-				ResourceNode: argoappv1.ResourceNode{
-					ResourceRef: argoappv1.ResourceRef{Kind: kube.DeploymentKind, Name: "guestbook", Namespace: app2.Namespace},
-				},
-				AppName: "app2",
-			},
-		},
-	})
-
-	tree, err := ctrl.setAppManagedResources(app1, &comparisonResult{managedResources: make([]managedResource, 0)})
-
-	assert.NoError(t, err)
-	assert.Equal(t, len(tree.OrphanedNodes), 0)
-}
-
-func TestReturnUnknownComparisonStateOnSettingLoadError(t *testing.T) {
-	proj := defaultProj.DeepCopy()
-	proj.Spec.OrphanedResources = &argoappv1.OrphanedResourcesMonitorSettings{}
-
-	app := newFakeApp()
-
-	ctrl := newFakeController(&fakeData{
-		apps: []runtime.Object{app, proj},
-		configMapData: map[string]string{
-			"resource.customizations": "invalid setting",
-		},
-	})
-
-	compRes := ctrl.appStateManager.CompareAppState(app, &defaultProj, "", app.Spec.Source, false, nil)
-
-	assert.Equal(t, argoappv1.HealthStatusUnknown, compRes.healthStatus.Status)
-	assert.Equal(t, argoappv1.SyncStatusCodeUnknown, compRes.syncStatus.Status)
-}
-
-func TestSetManagedResourcesKnownOrphanedResourceExceptions(t *testing.T) {
-	proj := defaultProj.DeepCopy()
-	proj.Spec.OrphanedResources = &argoappv1.OrphanedResourcesMonitorSettings{}
-
-	app := newFakeApp()
-	app.Namespace = "default"
-
-	ctrl := newFakeController(&fakeData{
-		apps: []runtime.Object{app, proj},
-		namespacedResources: map[kube.ResourceKey]namespacedResource{
-			kube.NewResourceKey("apps", kube.DeploymentKind, app.Namespace, "guestbook"): {
-				ResourceNode: argoappv1.ResourceNode{ResourceRef: argoappv1.ResourceRef{Group: "apps", Kind: kube.DeploymentKind, Name: "guestbook", Namespace: app.Namespace}},
-			},
-			kube.NewResourceKey("", kube.ServiceAccountKind, app.Namespace, "default"): {
-				ResourceNode: argoappv1.ResourceNode{ResourceRef: argoappv1.ResourceRef{Kind: kube.ServiceAccountKind, Name: "default", Namespace: app.Namespace}},
-			},
-			kube.NewResourceKey("", kube.ServiceKind, app.Namespace, "kubernetes"): {
-				ResourceNode: argoappv1.ResourceNode{ResourceRef: argoappv1.ResourceRef{Kind: kube.ServiceAccountKind, Name: "kubernetes", Namespace: app.Namespace}},
-			},
-		},
-	})
-
-	tree, err := ctrl.setAppManagedResources(app, &comparisonResult{managedResources: make([]managedResource, 0)})
-
-	assert.NoError(t, err)
-	assert.Len(t, tree.OrphanedNodes, 1)
-	assert.Equal(t, "guestbook", tree.OrphanedNodes[0].Name)
-}
-
-func Test_comparisonResult_obs(t *testing.T) {
-	assert.Len(t, (&comparisonResult{}).targetObjs(), 0)
-	assert.Len(t, (&comparisonResult{managedResources: []managedResource{{}}}).targetObjs(), 0)
-	assert.Len(t, (&comparisonResult{managedResources: []managedResource{{Target: test.NewPod()}}}).targetObjs(), 1)
-	assert.Len(t, (&comparisonResult{hooks: []*unstructured.Unstructured{{}}}).targetObjs(), 1)
-}
-
-func Test_appStateManager_persistRevisionHistory(t *testing.T) {
-	app := newFakeApp()
-	ctrl := newFakeController(&fakeData{
-		apps: []runtime.Object{app},
-	})
-	manager := ctrl.appStateManager.(*appStateManager)
-	setRevisionHistoryLimit := func(value int) {
-		i := int64(value)
-		app.Spec.RevisionHistoryLimit = &i
-	}
-	addHistory := func() {
-		err := manager.persistRevisionHistory(app, "my-revision", argoappv1.ApplicationSource{})
-		assert.NoError(t, err)
-	}
-	addHistory()
-	assert.Len(t, app.Status.History, 1)
-	addHistory()
-	assert.Len(t, app.Status.History, 2)
-	addHistory()
-	assert.Len(t, app.Status.History, 3)
-	addHistory()
-	assert.Len(t, app.Status.History, 4)
-	addHistory()
-	assert.Len(t, app.Status.History, 5)
-	addHistory()
-	assert.Len(t, app.Status.History, 6)
-	addHistory()
-	assert.Len(t, app.Status.History, 7)
-	addHistory()
-	assert.Len(t, app.Status.History, 8)
-	addHistory()
-	assert.Len(t, app.Status.History, 9)
-	addHistory()
-	assert.Len(t, app.Status.History, 10)
-	// default limit is 10
-	addHistory()
-	assert.Len(t, app.Status.History, 10)
-	// increase limit
-	setRevisionHistoryLimit(11)
-	addHistory()
-	assert.Len(t, app.Status.History, 11)
-	// decrease limit
-	setRevisionHistoryLimit(9)
-	addHistory()
-	assert.Len(t, app.Status.History, 9)
-}

controller/sync_hook_test.go

@@ -0,0 +1,66 @@
+package controller
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+
+	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
+	"github.com/argoproj/argo-cd/test"
+	"github.com/argoproj/argo-cd/util/kube/kubetest"
+)
+
+var clusterRoleHook = `
+{
+  "apiVersion": "rbac.authorization.k8s.io/v1",
+  "kind": "ClusterRole",
+  "metadata": {
+    "name": "cluster-role-hook",
+    "annotations": {
+      "argocd.argoproj.io/hook": "PostSync"
+	}
+  }
+}`
+
+func TestSyncHookProjectPermissions(t *testing.T) {
+	syncCtx := newTestSyncCtx(&v1.APIResourceList{
+		GroupVersion: "v1",
+		APIResources: []v1.APIResource{
+			{Name: "pod", Namespaced: true, Kind: "Pod", Group: "v1"},
+		},
+	}, &v1.APIResourceList{
+		GroupVersion: "rbac.authorization.k8s.io/v1",
+		APIResources: []v1.APIResource{
+			{Name: "clusterroles", Namespaced: false, Kind: "ClusterRole", Group: "rbac.authorization.k8s.io"},
+		},
+	})
+
+	syncCtx.kubectl = kubetest.MockKubectlCmd{}
+	crHook, _ := v1alpha1.UnmarshalToUnstructured(clusterRoleHook)
+	syncCtx.compareResult = &comparisonResult{
+		hooks: []*unstructured.Unstructured{
+			crHook,
+		},
+		managedResources: []managedResource{{
+			Target: test.NewPod(),
+		}},
+	}
+	syncCtx.proj.Spec.ClusterResourceWhitelist = []v1.GroupKind{}
+
+	syncCtx.syncOp.SyncStrategy = nil
+	syncCtx.sync()
+	assert.Equal(t, v1alpha1.OperationFailed, syncCtx.opState.Phase)
+	assert.Len(t, syncCtx.syncRes.Resources, 0)
+	assert.Contains(t, syncCtx.opState.Message, "not permitted in project")
+
+	// Now add the resource to the whitelist and try again. Resource should be created
+	syncCtx.proj.Spec.ClusterResourceWhitelist = []v1.GroupKind{
+		{Group: "rbac.authorization.k8s.io", Kind: "ClusterRole"},
+	}
+	syncCtx.syncOp.SyncStrategy = nil
+	syncCtx.sync()
+	assert.Len(t, syncCtx.syncRes.Resources, 1)
+	assert.Equal(t, v1alpha1.ResultCodeSynced, syncCtx.syncRes.Resources[0].Status)
+}

controller/sync_hooks.go

@@ -2,34 +2,559 @@ package controller
 
 import (
 	"fmt"
+	"reflect"
+	"strings"
 
+	wfv1 "github.com/argoproj/argo/pkg/apis/workflow/v1alpha1"
+	apiv1 "k8s.io/api/core/v1"
+	apierr "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kubernetes/pkg/apis/batch"
 
-	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	"github.com/argoproj/argo-cd/util/health"
+	"github.com/argoproj/argo-cd/common"
+	appv1 "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
+	"github.com/argoproj/argo-cd/util"
+	hookutil "github.com/argoproj/argo-cd/util/hook"
+	"github.com/argoproj/argo-cd/util/kube"
 )
 
-// getOperationPhase returns a hook status from an _live_ unstructured object
-func (sc *syncContext) getOperationPhase(hook *unstructured.Unstructured) (v1alpha1.OperationPhase, string, error) {
-	phase := v1alpha1.OperationSucceeded
-	message := fmt.Sprintf("%s created", hook.GetName())
-
-	resHealth, err := health.GetResourceHealth(hook, sc.resourceOverrides)
-	if err != nil {
-		return "", "", err
-	}
-	if resHealth != nil {
-		switch resHealth.Status {
-		case v1alpha1.HealthStatusUnknown, v1alpha1.HealthStatusDegraded:
-			phase = v1alpha1.OperationFailed
-			message = resHealth.Message
-		case v1alpha1.HealthStatusProgressing, v1alpha1.HealthStatusSuspended:
-			phase = v1alpha1.OperationRunning
-			message = resHealth.Message
-		case v1alpha1.HealthStatusHealthy:
-			phase = v1alpha1.OperationSucceeded
-			message = resHealth.Message
+// doHookSync initiates (or continues) a hook-based sync. This method will be invoked when there may
+// already be in-flight (potentially incomplete) jobs/workflows, and should be idempotent.
+func (sc *syncContext) doHookSync(syncTasks []syncTask, hooks []*unstructured.Unstructured) {
+	if !sc.startedPreSyncPhase() {
+		if !sc.verifyPermittedHooks(hooks) {
+			return
 		}
 	}
-	return phase, message, nil
+	// 1. Run PreSync hooks
+	if !sc.runHooks(hooks, appv1.HookTypePreSync) {
+		return
+	}
+
+	// 2. Run Sync hooks (e.g. blue-green sync workflow)
+	// Before performing Sync hooks, apply any normal manifests which aren't annotated with a hook.
+	// We only want to do this once per operation.
+	shouldContinue := true
+	if !sc.startedSyncPhase() {
+		if !sc.syncNonHookTasks(syncTasks) {
+			sc.setOperationPhase(appv1.OperationFailed, "one or more objects failed to apply")
+			return
+		}
+		shouldContinue = false
+	}
+	if !sc.runHooks(hooks, appv1.HookTypeSync) {
+		shouldContinue = false
+	}
+	if !shouldContinue {
+		return
+	}
+
+	// 3. Run PostSync hooks
+	// Before running PostSync hooks, we want to make rollout is complete (app is healthy). If we
+	// already started the post-sync phase, then we do not need to perform the health check.
+	postSyncHooks, _ := sc.getHooks(appv1.HookTypePostSync)
+	if len(postSyncHooks) > 0 && !sc.startedPostSyncPhase() {
+		sc.log.Infof("PostSync application health check: %s", sc.compareResult.healthStatus.Status)
+		if sc.compareResult.healthStatus.Status != appv1.HealthStatusHealthy {
+			sc.setOperationPhase(appv1.OperationRunning, fmt.Sprintf("waiting for %s state to run %s hooks (current health: %s)",
+				appv1.HealthStatusHealthy, appv1.HookTypePostSync, sc.compareResult.healthStatus.Status))
+			return
+		}
+	}
+	if !sc.runHooks(hooks, appv1.HookTypePostSync) {
+		return
+	}
+
+	// if we get here, all hooks successfully completed
+	sc.setOperationPhase(appv1.OperationSucceeded, "successfully synced")
+}
+
+// verifyPermittedHooks verifies all hooks are permitted in the project
+func (sc *syncContext) verifyPermittedHooks(hooks []*unstructured.Unstructured) bool {
+	for _, hook := range hooks {
+		gvk := hook.GroupVersionKind()
+		serverRes, err := kube.ServerResourceForGroupVersionKind(sc.disco, gvk)
+		if err != nil {
+			sc.setOperationPhase(appv1.OperationError, fmt.Sprintf("unable to identify api resource type: %v", gvk))
+			return false
+		}
+		if !sc.proj.IsResourcePermitted(metav1.GroupKind{Group: gvk.Group, Kind: gvk.Kind}, serverRes.Namespaced) {
+			sc.setOperationPhase(appv1.OperationFailed, fmt.Sprintf("Hook resource %s:%s is not permitted in project %s", gvk.Group, gvk.Kind, sc.proj.Name))
+			return false
+		}
+
+		if serverRes.Namespaced && !sc.proj.IsDestinationPermitted(appv1.ApplicationDestination{Namespace: hook.GetNamespace(), Server: sc.server}) {
+			gvk := hook.GroupVersionKind()
+			sc.setResourceDetails(&appv1.ResourceResult{
+				Name:      hook.GetName(),
+				Group:     gvk.Group,
+				Version:   gvk.Version,
+				Kind:      hook.GetKind(),
+				Namespace: hook.GetNamespace(),
+				Message:   fmt.Sprintf("namespace %v is not permitted in project '%s'", hook.GetNamespace(), sc.proj.Name),
+				Status:    appv1.ResultCodeSyncFailed,
+			})
+			return false
+		}
+	}
+	return true
+}
+
+// getHooks returns all Argo CD hooks, optionally filtered by ones of the specific type(s)
+func (sc *syncContext) getHooks(hookTypes ...appv1.HookType) ([]*unstructured.Unstructured, error) {
+	var hooks []*unstructured.Unstructured
+	for _, hook := range sc.compareResult.hooks {
+		if hook.GetNamespace() == "" {
+			hook.SetNamespace(sc.namespace)
+		}
+		if !hookutil.IsArgoHook(hook) {
+			// TODO: in the future, if we want to map helm hooks to Argo CD lifecycles, we should
+			// include helm hooks in the returned list
+			continue
+		}
+		if len(hookTypes) > 0 {
+			match := false
+			for _, desiredType := range hookTypes {
+				if isHookType(hook, desiredType) {
+					match = true
+					break
+				}
+			}
+			if !match {
+				continue
+			}
+		}
+		hooks = append(hooks, hook)
+	}
+	return hooks, nil
+}
+
+// runHooks iterates & filters the target manifests for resources of the specified hook type, then
+// creates the resource. Updates the sc.opRes.hooks with the current status. Returns whether or not
+// we should continue to the next hook phase.
+func (sc *syncContext) runHooks(hooks []*unstructured.Unstructured, hookType appv1.HookType) bool {
+	shouldContinue := true
+	for _, hook := range hooks {
+		if hookType == appv1.HookTypeSync && isHookType(hook, appv1.HookTypeSkip) {
+			// If we get here, we are invoking all sync hooks and reached a resource that is
+			// annotated with the Skip hook. This will update the resource details to indicate it
+			// was skipped due to annotation
+			gvk := hook.GroupVersionKind()
+			sc.setResourceDetails(&appv1.ResourceResult{
+				Name:      hook.GetName(),
+				Group:     gvk.Group,
+				Version:   gvk.Version,
+				Kind:      hook.GetKind(),
+				Namespace: hook.GetNamespace(),
+				Message:   "Skipped",
+			})
+			continue
+		}
+		if !isHookType(hook, hookType) {
+			continue
+		}
+		updated, err := sc.runHook(hook, hookType)
+		if err != nil {
+			sc.setOperationPhase(appv1.OperationError, fmt.Sprintf("%s hook error: %v", hookType, err))
+			return false
+		}
+		if updated {
+			// If the result of running a hook, caused us to modify hook resource state, we should
+			// not proceed to the next hook phase. This is because before proceeding to the next
+			// phase, we want a full health assessment to happen. By returning early, we allow
+			// the application to get requeued into the controller workqueue, and on the next
+			// process iteration, a new CompareAppState() will be performed to get the most
+			// up-to-date live state. This enables us to accurately wait for an application to
+			// become Healthy before proceeding to run PostSync tasks.
+			shouldContinue = false
+		}
+	}
+	if !shouldContinue {
+		sc.log.Infof("Stopping after %s phase due to modifications to hook resource state", hookType)
+		return false
+	}
+	completed, successful := areHooksCompletedSuccessful(hookType, sc.syncRes.Resources)
+	if !completed {
+		return false
+	}
+	if !successful {
+		sc.setOperationPhase(appv1.OperationFailed, fmt.Sprintf("%s hook failed", hookType))
+		return false
+	}
+	return true
+}
+
+// syncNonHookTasks syncs or prunes the objects that are not handled by hooks using an apply sync.
+// returns true if the sync was successful
+func (sc *syncContext) syncNonHookTasks(syncTasks []syncTask) bool {
+	var nonHookTasks []syncTask
+	for _, task := range syncTasks {
+		if task.targetObj == nil {
+			nonHookTasks = append(nonHookTasks, task)
+		} else {
+			annotations := task.targetObj.GetAnnotations()
+			if annotations != nil && annotations[common.AnnotationKeyHook] != "" {
+				// we are doing a hook sync and this resource is annotated with a hook annotation
+				continue
+			}
+			// if we get here, this resource does not have any hook annotation so we
+			// should perform an `kubectl apply`
+			nonHookTasks = append(nonHookTasks, task)
+		}
+	}
+	return sc.doApplySync(nonHookTasks, false, sc.syncOp.SyncStrategy.Hook.Force, true)
+}
+
+// runHook runs the supplied hook and updates the hook status. Returns true if the result of
+// invoking this method resulted in changes to any hook status
+func (sc *syncContext) runHook(hook *unstructured.Unstructured, hookType appv1.HookType) (bool, error) {
+	// Hook resources names are deterministic, whether they are defined by the user (metadata.name),
+	// or formulated at the time of the operation (metadata.generateName). If user specifies
+	// metadata.generateName, then we will generate a formulated metadata.name before submission.
+	if hook.GetName() == "" {
+		postfix := strings.ToLower(fmt.Sprintf("%s-%s-%d", sc.syncRes.Revision[0:7], hookType, sc.opState.StartedAt.UTC().Unix()))
+		generatedName := hook.GetGenerateName()
+		hook = hook.DeepCopy()
+		hook.SetName(fmt.Sprintf("%s%s", generatedName, postfix))
+	}
+	// Check our hook statuses to see if we already completed this hook.
+	// If so, this method is a noop
+	prevStatus := sc.getHookStatus(hook, hookType)
+	if prevStatus != nil && prevStatus.HookPhase.Completed() {
+		return false, nil
+	}
+
+	gvk := hook.GroupVersionKind()
+	apiResource, err := kube.ServerResourceForGroupVersionKind(sc.disco, gvk)
+	if err != nil {
+		return false, err
+	}
+	resource := kube.ToGroupVersionResource(gvk.GroupVersion().String(), apiResource)
+	resIf := kube.ToResourceInterface(sc.dynamicIf, apiResource, resource, hook.GetNamespace())
+
+	var liveObj *unstructured.Unstructured
+	existing, err := resIf.Get(hook.GetName(), metav1.GetOptions{})
+	if err != nil {
+		if !apierr.IsNotFound(err) {
+			return false, fmt.Errorf("Failed to get status of %s hook %s '%s': %v", hookType, gvk, hook.GetName(), err)
+		}
+		_, err := sc.kubectl.ApplyResource(sc.config, hook, hook.GetNamespace(), false, false)
+		if err != nil {
+			return false, fmt.Errorf("Failed to create %s hook %s '%s': %v", hookType, gvk, hook.GetName(), err)
+		}
+		created, err := resIf.Get(hook.GetName(), metav1.GetOptions{})
+		if err != nil {
+			return true, fmt.Errorf("Failed to get status of %s hook %s '%s': %v", hookType, gvk, hook.GetName(), err)
+		}
+		sc.log.Infof("%s hook %s '%s' created", hookType, gvk, created.GetName())
+		sc.setOperationPhase(appv1.OperationRunning, fmt.Sprintf("running %s hooks", hookType))
+		liveObj = created
+	} else {
+		liveObj = existing
+	}
+	hookStatus := newHookStatus(liveObj, hookType)
+	if hookStatus.HookPhase.Completed() {
+		if enforceHookDeletePolicy(hook, hookStatus.HookPhase) {
+			err = sc.deleteHook(hook.GetName(), hook.GetNamespace(), hook.GroupVersionKind())
+			if err != nil {
+				hookStatus.HookPhase = appv1.OperationFailed
+				hookStatus.Message = fmt.Sprintf("failed to delete %s hook: %v", hookStatus.HookPhase, err)
+			}
+		}
+	}
+	return sc.updateHookStatus(hookStatus), nil
+}
+
+// enforceHookDeletePolicy examines the hook deletion policy of a object and deletes it based on the status
+func enforceHookDeletePolicy(hook *unstructured.Unstructured, phase appv1.OperationPhase) bool {
+	annotations := hook.GetAnnotations()
+	if annotations == nil {
+		return false
+	}
+	deletePolicies := strings.Split(annotations[common.AnnotationKeyHookDeletePolicy], ",")
+	for _, dp := range deletePolicies {
+		policy := appv1.HookDeletePolicy(strings.TrimSpace(dp))
+		if policy == appv1.HookDeletePolicyHookSucceeded && phase == appv1.OperationSucceeded {
+			return true
+		}
+		if policy == appv1.HookDeletePolicyHookFailed && phase == appv1.OperationFailed {
+			return true
+		}
+	}
+	return false
+}
+
+// isHookType tells whether or not the supplied object is a hook of the specified type
+func isHookType(hook *unstructured.Unstructured, hookType appv1.HookType) bool {
+	annotations := hook.GetAnnotations()
+	if annotations == nil {
+		return false
+	}
+	resHookTypes := strings.Split(annotations[common.AnnotationKeyHook], ",")
+	for _, ht := range resHookTypes {
+		if string(hookType) == strings.TrimSpace(ht) {
+			return true
+		}
+	}
+	return false
+}
+
+// newHookStatus returns a hook status from an _live_ unstructured object
+func newHookStatus(hook *unstructured.Unstructured, hookType appv1.HookType) appv1.ResourceResult {
+	gvk := hook.GroupVersionKind()
+	hookStatus := appv1.ResourceResult{
+		Name:      hook.GetName(),
+		Kind:      hook.GetKind(),
+		Group:     gvk.Group,
+		Version:   gvk.Version,
+		HookType:  hookType,
+		HookPhase: appv1.OperationRunning,
+		Namespace: hook.GetNamespace(),
+	}
+	if isBatchJob(gvk) {
+		updateStatusFromBatchJob(hook, &hookStatus)
+	} else if isArgoWorkflow(gvk) {
+		updateStatusFromArgoWorkflow(hook, &hookStatus)
+	} else if isPod(gvk) {
+		updateStatusFromPod(hook, &hookStatus)
+	} else {
+		hookStatus.HookPhase = appv1.OperationSucceeded
+		hookStatus.Message = fmt.Sprintf("%s created", hook.GetName())
+	}
+	return hookStatus
+}
+
+// isRunnable returns if the resource object is a runnable type which needs to be terminated
+func isRunnable(res *appv1.ResourceResult) bool {
+	gvk := res.GroupVersionKind()
+	return isBatchJob(gvk) || isArgoWorkflow(gvk) || isPod(gvk)
+}
+
+func isBatchJob(gvk schema.GroupVersionKind) bool {
+	return gvk.Group == "batch" && gvk.Kind == "Job"
+}
+
+func updateStatusFromBatchJob(hook *unstructured.Unstructured, hookStatus *appv1.ResourceResult) {
+	var job batch.Job
+	err := runtime.DefaultUnstructuredConverter.FromUnstructured(hook.Object, &job)
+	if err != nil {
+		hookStatus.HookPhase = appv1.OperationError
+		hookStatus.Message = err.Error()
+		return
+	}
+	failed := false
+	var failMsg string
+	complete := false
+	var message string
+	for _, condition := range job.Status.Conditions {
+		switch condition.Type {
+		case batch.JobFailed:
+			failed = true
+			complete = true
+			failMsg = condition.Message
+		case batch.JobComplete:
+			complete = true
+			message = condition.Message
+		}
+	}
+	if !complete {
+		hookStatus.HookPhase = appv1.OperationRunning
+		hookStatus.Message = message
+	} else if failed {
+		hookStatus.HookPhase = appv1.OperationFailed
+		hookStatus.Message = failMsg
+	} else {
+		hookStatus.HookPhase = appv1.OperationSucceeded
+		hookStatus.Message = message
+	}
+}
+
+func isArgoWorkflow(gvk schema.GroupVersionKind) bool {
+	return gvk.Group == "argoproj.io" && gvk.Kind == "Workflow"
+}
+
+func updateStatusFromArgoWorkflow(hook *unstructured.Unstructured, hookStatus *appv1.ResourceResult) {
+	var wf wfv1.Workflow
+	err := runtime.DefaultUnstructuredConverter.FromUnstructured(hook.Object, &wf)
+	if err != nil {
+		hookStatus.HookPhase = appv1.OperationError
+		hookStatus.Message = err.Error()
+		return
+	}
+	switch wf.Status.Phase {
+	case wfv1.NodePending, wfv1.NodeRunning:
+		hookStatus.HookPhase = appv1.OperationRunning
+	case wfv1.NodeSucceeded:
+		hookStatus.HookPhase = appv1.OperationSucceeded
+	case wfv1.NodeFailed:
+		hookStatus.HookPhase = appv1.OperationFailed
+	case wfv1.NodeError:
+		hookStatus.HookPhase = appv1.OperationError
+	}
+	hookStatus.Message = wf.Status.Message
+}
+
+func isPod(gvk schema.GroupVersionKind) bool {
+	return gvk.Group == "" && gvk.Kind == "Pod"
+}
+
+func updateStatusFromPod(hook *unstructured.Unstructured, hookStatus *appv1.ResourceResult) {
+	var pod apiv1.Pod
+	err := runtime.DefaultUnstructuredConverter.FromUnstructured(hook.Object, &pod)
+	if err != nil {
+		hookStatus.HookPhase = appv1.OperationError
+		hookStatus.Message = err.Error()
+		return
+	}
+	getFailMessage := func(ctr *apiv1.ContainerStatus) string {
+		if ctr.State.Terminated != nil {
+			if ctr.State.Terminated.Message != "" {
+				return ctr.State.Terminated.Message
+			}
+			if ctr.State.Terminated.Reason == "OOMKilled" {
+				return ctr.State.Terminated.Reason
+			}
+			if ctr.State.Terminated.ExitCode != 0 {
+				return fmt.Sprintf("container %q failed with exit code %d", ctr.Name, ctr.State.Terminated.ExitCode)
+			}
+		}
+		return ""
+	}
+
+	switch pod.Status.Phase {
+	case apiv1.PodPending, apiv1.PodRunning:
+		hookStatus.HookPhase = appv1.OperationRunning
+	case apiv1.PodSucceeded:
+		hookStatus.HookPhase = appv1.OperationSucceeded
+	case apiv1.PodFailed:
+		hookStatus.HookPhase = appv1.OperationFailed
+		if pod.Status.Message != "" {
+			// Pod has a nice error message. Use that.
+			hookStatus.Message = pod.Status.Message
+			return
+		}
+		for _, ctr := range append(pod.Status.InitContainerStatuses, pod.Status.ContainerStatuses...) {
+			if msg := getFailMessage(&ctr); msg != "" {
+				hookStatus.Message = msg
+				return
+			}
+		}
+	case apiv1.PodUnknown:
+		hookStatus.HookPhase = appv1.OperationError
+	}
+}
+
+func (sc *syncContext) getHookStatus(hookObj *unstructured.Unstructured, hookType appv1.HookType) *appv1.ResourceResult {
+	for _, hr := range sc.syncRes.Resources {
+		if !hr.IsHook() {
+			continue
+		}
+		ns := util.FirstNonEmpty(hookObj.GetNamespace(), sc.namespace)
+		if hookEqual(hr, hookObj.GroupVersionKind().Group, hookObj.GetKind(), ns, hookObj.GetName(), hookType) {
+			return hr
+		}
+	}
+	return nil
+}
+
+func hookEqual(hr *appv1.ResourceResult, group, kind, namespace, name string, hookType appv1.HookType) bool {
+	return bool(
+		hr.Group == group &&
+			hr.Kind == kind &&
+			hr.Namespace == namespace &&
+			hr.Name == name &&
+			hr.HookType == hookType)
+}
+
+// updateHookStatus updates the status of a hook. Returns true if the hook was modified
+func (sc *syncContext) updateHookStatus(hookStatus appv1.ResourceResult) bool {
+	sc.lock.Lock()
+	defer sc.lock.Unlock()
+	for i, prev := range sc.syncRes.Resources {
+		if !prev.IsHook() {
+			continue
+		}
+		if hookEqual(prev, hookStatus.Group, hookStatus.Kind, hookStatus.Namespace, hookStatus.Name, hookStatus.HookType) {
+			if reflect.DeepEqual(prev, hookStatus) {
+				return false
+			}
+			if prev.HookPhase != hookStatus.HookPhase {
+				sc.log.Infof("Hook %s %s/%s hookPhase: %s -> %s", hookStatus.HookType, prev.Kind, prev.Name, prev.HookPhase, hookStatus.HookPhase)
+			}
+			if prev.Status != hookStatus.Status {
+				sc.log.Infof("Hook %s %s/%s status: %s -> %s", hookStatus.HookType, prev.Kind, prev.Name, prev.Status, hookStatus.Status)
+			}
+			if prev.Message != hookStatus.Message {
+				sc.log.Infof("Hook %s %s/%s message: '%s' -> '%s'", hookStatus.HookType, prev.Kind, prev.Name, prev.Message, hookStatus.Message)
+			}
+			sc.syncRes.Resources[i] = &hookStatus
+			return true
+		}
+	}
+	sc.syncRes.Resources = append(sc.syncRes.Resources, &hookStatus)
+	sc.log.Infof("Set new hook %s %s/%s. phase: %s, message: %s", hookStatus.HookType, hookStatus.Kind, hookStatus.Name, hookStatus.HookPhase, hookStatus.Message)
+	return true
+}
+
+// areHooksCompletedSuccessful checks if all the hooks of the specified type are completed and successful
+func areHooksCompletedSuccessful(hookType appv1.HookType, hookStatuses []*appv1.ResourceResult) (bool, bool) {
+	isSuccessful := true
+	for _, hookStatus := range hookStatuses {
+		if !hookStatus.IsHook() {
+			continue
+		}
+		if hookStatus.HookType != hookType {
+			continue
+		}
+		if !hookStatus.HookPhase.Completed() {
+			return false, false
+		}
+		if !hookStatus.HookPhase.Successful() {
+			isSuccessful = false
+		}
+	}
+	return true, isSuccessful
+}
+
+// terminate looks for any running jobs/workflow hooks and deletes the resource
+func (sc *syncContext) terminate() {
+	terminateSuccessful := true
+	for _, hookStatus := range sc.syncRes.Resources {
+		if !hookStatus.IsHook() {
+			continue
+		}
+		if hookStatus.HookPhase.Completed() {
+			continue
+		}
+		if isRunnable(hookStatus) {
+			hookStatus.HookPhase = appv1.OperationFailed
+			err := sc.deleteHook(hookStatus.Name, hookStatus.Namespace, hookStatus.GroupVersionKind())
+			if err != nil {
+				hookStatus.Message = fmt.Sprintf("Failed to delete %s hook %s/%s: %v", hookStatus.HookType, hookStatus.Kind, hookStatus.Name, err)
+				terminateSuccessful = false
+			} else {
+				hookStatus.Message = fmt.Sprintf("Deleted %s hook %s/%s", hookStatus.HookType, hookStatus.Kind, hookStatus.Name)
+			}
+			sc.updateHookStatus(*hookStatus)
+		}
+	}
+	if terminateSuccessful {
+		sc.setOperationPhase(appv1.OperationFailed, "Operation terminated")
+	} else {
+		sc.setOperationPhase(appv1.OperationError, "Operation termination had errors")
+	}
+}
+
+func (sc *syncContext) deleteHook(name, namespace string, gvk schema.GroupVersionKind) error {
+	apiResource, err := kube.ServerResourceForGroupVersionKind(sc.disco, gvk)
+	if err != nil {
+		return err
+	}
+	resource := kube.ToGroupVersionResource(gvk.GroupVersion().String(), apiResource)
+	resIf := kube.ToResourceInterface(sc.dynamicIf, apiResource, resource, namespace)
+	propagationPolicy := metav1.DeletePropagationForeground
+	return resIf.Delete(name, &metav1.DeleteOptions{PropagationPolicy: &propagationPolicy})
 }

controller/sync_phase.go

@@ -1,29 +0,0 @@
-package controller
-
-import (
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-
-	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	"github.com/argoproj/argo-cd/util/hook"
-)
-
-func syncPhases(obj *unstructured.Unstructured) []v1alpha1.SyncPhase {
-	if hook.Skip(obj) {
-		return nil
-	} else if hook.IsHook(obj) {
-		phasesMap := make(map[v1alpha1.SyncPhase]bool)
-		for _, hookType := range hook.Types(obj) {
-			switch hookType {
-			case v1alpha1.HookTypePreSync, v1alpha1.HookTypeSync, v1alpha1.HookTypePostSync, v1alpha1.HookTypeSyncFail:
-				phasesMap[v1alpha1.SyncPhase(hookType)] = true
-			}
-		}
-		var phases []v1alpha1.SyncPhase
-		for phase := range phasesMap {
-			phases = append(phases, phase)
-		}
-		return phases
-	} else {
-		return []v1alpha1.SyncPhase{v1alpha1.SyncPhaseSync}
-	}
-}

controller/sync_phase_test.go

@@ -1,57 +0,0 @@
-package controller
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-
-	. "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	"github.com/argoproj/argo-cd/test"
-)
-
-func TestSyncPhaseNone(t *testing.T) {
-	assert.Equal(t, []SyncPhase{SyncPhaseSync}, syncPhases(&unstructured.Unstructured{}))
-}
-
-func TestSyncPhasePreSync(t *testing.T) {
-	assert.Equal(t, []SyncPhase{SyncPhasePreSync}, syncPhases(pod("PreSync")))
-}
-
-func TestSyncPhaseSync(t *testing.T) {
-	assert.Equal(t, []SyncPhase{SyncPhaseSync}, syncPhases(pod("Sync")))
-}
-
-func TestSyncPhaseSkip(t *testing.T) {
-	assert.Nil(t, syncPhases(pod("Skip")))
-}
-
-// garbage hooks are still hooks, but have no phases, because some user spelled something wrong
-func TestSyncPhaseGarbage(t *testing.T) {
-	assert.Nil(t, syncPhases(pod("Garbage")))
-}
-
-func TestSyncPhasePost(t *testing.T) {
-	assert.Equal(t, []SyncPhase{SyncPhasePostSync}, syncPhases(pod("PostSync")))
-}
-
-func TestSyncPhaseFail(t *testing.T) {
-	assert.Equal(t, []SyncPhase{SyncPhaseSyncFail}, syncPhases(pod("SyncFail")))
-}
-
-func TestSyncPhaseTwoPhases(t *testing.T) {
-	assert.ElementsMatch(t, []SyncPhase{SyncPhasePreSync, SyncPhasePostSync}, syncPhases(pod("PreSync,PostSync")))
-}
-
-func TestSyncDuplicatedPhases(t *testing.T) {
-	assert.ElementsMatch(t, []SyncPhase{SyncPhasePreSync}, syncPhases(pod("PreSync,PreSync")))
-	assert.ElementsMatch(t, []SyncPhase{SyncPhasePreSync}, syncPhases(podWithHelmHook("pre-install,pre-upgrade")))
-}
-
-func pod(hookType string) *unstructured.Unstructured {
-	return test.Annotate(test.NewPod(), "argocd.argoproj.io/hook", hookType)
-}
-
-func podWithHelmHook(hookType string) *unstructured.Unstructured {
-	return test.Annotate(test.NewPod(), "helm.sh/hook", hookType)
-}

controller/sync_task.go

@@ -1,130 +0,0 @@
-package controller
-
-import (
-	"fmt"
-
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-
-	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	"github.com/argoproj/argo-cd/util/hook"
-	"github.com/argoproj/argo-cd/util/resource/syncwaves"
-)
-
-// syncTask holds the live and target object. At least one should be non-nil. A targetObj of nil
-// indicates the live object needs to be pruned. A liveObj of nil indicates the object has yet to
-// be deployed
-type syncTask struct {
-	phase          v1alpha1.SyncPhase
-	liveObj        *unstructured.Unstructured
-	targetObj      *unstructured.Unstructured
-	skipDryRun     bool
-	syncStatus     v1alpha1.ResultCode
-	operationState v1alpha1.OperationPhase
-	message        string
-}
-
-func ternary(val bool, a, b string) string {
-	if val {
-		return a
-	} else {
-		return b
-	}
-}
-
-func (t *syncTask) String() string {
-	return fmt.Sprintf("%s/%d %s %s/%s:%s/%s %s->%s (%s,%s,%s)",
-		t.phase, t.wave(),
-		ternary(t.isHook(), "hook", "resource"), t.group(), t.kind(), t.namespace(), t.name(),
-		ternary(t.liveObj != nil, "obj", "nil"), ternary(t.targetObj != nil, "obj", "nil"),
-		t.syncStatus, t.operationState, t.message,
-	)
-}
-
-func (t *syncTask) isPrune() bool {
-	return t.targetObj == nil
-}
-
-// return the target object (if this exists) otherwise the live object
-// some caution - often you explicitly want the live object not the target object
-func (t *syncTask) obj() *unstructured.Unstructured {
-	return obj(t.targetObj, t.liveObj)
-}
-
-func (t *syncTask) wave() int {
-	return syncwaves.Wave(t.obj())
-}
-
-func (t *syncTask) isHook() bool {
-	return hook.IsHook(t.obj())
-}
-
-func (t *syncTask) group() string {
-	return t.groupVersionKind().Group
-}
-func (t *syncTask) kind() string {
-	return t.groupVersionKind().Kind
-}
-
-func (t *syncTask) version() string {
-	return t.groupVersionKind().Version
-}
-
-func (t *syncTask) groupVersionKind() schema.GroupVersionKind {
-	return t.obj().GroupVersionKind()
-}
-
-func (t *syncTask) name() string {
-	return t.obj().GetName()
-}
-
-func (t *syncTask) namespace() string {
-	return t.obj().GetNamespace()
-}
-
-func (t *syncTask) pending() bool {
-	return t.operationState == ""
-}
-
-func (t *syncTask) running() bool {
-	return t.operationState.Running()
-}
-
-func (t *syncTask) completed() bool {
-	return t.operationState.Completed()
-}
-
-func (t *syncTask) successful() bool {
-	return t.operationState.Successful()
-}
-
-func (t *syncTask) failed() bool {
-	return t.operationState.Failed()
-}
-
-func (t *syncTask) hookType() v1alpha1.HookType {
-	if t.isHook() {
-		return v1alpha1.HookType(t.phase)
-	} else {
-		return ""
-	}
-}
-
-func (t *syncTask) hasHookDeletePolicy(policy v1alpha1.HookDeletePolicy) bool {
-	// cannot have a policy if it is not a hook, it is meaningless
-	if !t.isHook() {
-		return false
-	}
-	for _, p := range hook.DeletePolicies(t.obj()) {
-		if p == policy {
-			return true
-		}
-	}
-	return false
-}
-
-func (t *syncTask) needsDeleting() bool {
-	return t.liveObj != nil && (t.pending() && t.hasHookDeletePolicy(v1alpha1.HookDeletePolicyBeforeHookCreation) ||
-		t.successful() && t.hasHookDeletePolicy(v1alpha1.HookDeletePolicyHookSucceeded) ||
-		t.failed() && t.hasHookDeletePolicy(v1alpha1.HookDeletePolicyHookFailed))
-}

controller/sync_task_test.go

@@ -1,66 +0,0 @@
-package controller
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-
-	. "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	. "github.com/argoproj/argo-cd/test"
-)
-
-func Test_syncTask_hookType(t *testing.T) {
-	type fields struct {
-		phase   SyncPhase
-		liveObj *unstructured.Unstructured
-	}
-	tests := []struct {
-		name   string
-		fields fields
-		want   HookType
-	}{
-		{"Empty", fields{SyncPhaseSync, NewPod()}, ""},
-		{"PreSyncHook", fields{SyncPhasePreSync, NewHook(HookTypePreSync)}, HookTypePreSync},
-		{"SyncHook", fields{SyncPhaseSync, NewHook(HookTypeSync)}, HookTypeSync},
-		{"PostSyncHook", fields{SyncPhasePostSync, NewHook(HookTypePostSync)}, HookTypePostSync},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			task := &syncTask{
-				phase:   tt.fields.phase,
-				liveObj: tt.fields.liveObj,
-			}
-			hookType := task.hookType()
-			assert.EqualValues(t, tt.want, hookType)
-		})
-	}
-}
-
-func Test_syncTask_hasHookDeletePolicy(t *testing.T) {
-	assert.False(t, (&syncTask{targetObj: NewPod()}).hasHookDeletePolicy(HookDeletePolicyBeforeHookCreation))
-	assert.False(t, (&syncTask{targetObj: NewPod()}).hasHookDeletePolicy(HookDeletePolicyHookSucceeded))
-	assert.False(t, (&syncTask{targetObj: NewPod()}).hasHookDeletePolicy(HookDeletePolicyHookFailed))
-	// must be hook
-	assert.False(t, (&syncTask{targetObj: Annotate(NewPod(), "argocd.argoproj.io/hook-delete-policy", "BeforeHookCreation")}).hasHookDeletePolicy(HookDeletePolicyBeforeHookCreation))
-	assert.True(t, (&syncTask{targetObj: Annotate(Annotate(NewPod(), "argocd.argoproj.io/hook", "Sync"), "argocd.argoproj.io/hook-delete-policy", "BeforeHookCreation")}).hasHookDeletePolicy(HookDeletePolicyBeforeHookCreation))
-	assert.True(t, (&syncTask{targetObj: Annotate(Annotate(NewPod(), "argocd.argoproj.io/hook", "Sync"), "argocd.argoproj.io/hook-delete-policy", "HookSucceeded")}).hasHookDeletePolicy(HookDeletePolicyHookSucceeded))
-	assert.True(t, (&syncTask{targetObj: Annotate(Annotate(NewPod(), "argocd.argoproj.io/hook", "Sync"), "argocd.argoproj.io/hook-delete-policy", "HookFailed")}).hasHookDeletePolicy(HookDeletePolicyHookFailed))
-}
-
-func Test_syncTask_needsDeleting(t *testing.T) {
-	assert.False(t, (&syncTask{liveObj: NewPod()}).needsDeleting())
-	// must be hook
-	assert.False(t, (&syncTask{liveObj: Annotate(NewPod(), "argocd.argoproj.io/hook-delete-policy", "BeforeHookCreation")}).needsDeleting())
-	// no need to delete if no live obj
-	assert.False(t, (&syncTask{targetObj: Annotate(Annotate(NewPod(), "argoocd.argoproj.io/hook", "Sync"), "argocd.argoproj.io/hook-delete-policy", "BeforeHookCreation")}).needsDeleting())
-	assert.True(t, (&syncTask{liveObj: Annotate(Annotate(NewPod(), "argocd.argoproj.io/hook", "Sync"), "argocd.argoproj.io/hook-delete-policy", "BeforeHookCreation")}).needsDeleting())
-	assert.True(t, (&syncTask{liveObj: Annotate(Annotate(NewPod(), "argocd.argoproj.io/hook", "Sync"), "argocd.argoproj.io/hook-delete-policy", "BeforeHookCreation")}).needsDeleting())
-	assert.True(t, (&syncTask{operationState: OperationSucceeded, liveObj: Annotate(Annotate(NewPod(), "argocd.argoproj.io/hook", "Sync"), "argocd.argoproj.io/hook-delete-policy", "HookSucceeded")}).needsDeleting())
-	assert.True(t, (&syncTask{operationState: OperationFailed, liveObj: Annotate(Annotate(NewPod(), "argocd.argoproj.io/hook", "Sync"), "argocd.argoproj.io/hook-delete-policy", "HookFailed")}).needsDeleting())
-}
-
-func Test_syncTask_wave(t *testing.T) {
-	assert.Equal(t, 0, (&syncTask{targetObj: NewPod()}).wave())
-	assert.Equal(t, 1, (&syncTask{targetObj: Annotate(NewPod(), "argocd.argoproj.io/sync-wave", "1")}).wave())
-}

controller/sync_tasks.go

@@ -1,185 +0,0 @@
-package controller
-
-import (
-	"strings"
-
-	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-)
-
-// kindOrder represents the correct order of Kubernetes resources within a manifest
-var syncPhaseOrder = map[v1alpha1.SyncPhase]int{
-	v1alpha1.SyncPhasePreSync:  -1,
-	v1alpha1.SyncPhaseSync:     0,
-	v1alpha1.SyncPhasePostSync: 1,
-	v1alpha1.SyncPhaseSyncFail: 2,
-}
-
-// kindOrder represents the correct order of Kubernetes resources within a manifest
-// https://github.com/helm/helm/blob/master/pkg/tiller/kind_sorter.go
-var kindOrder = map[string]int{}
-
-func init() {
-	kinds := []string{
-		"Namespace",
-		"ResourceQuota",
-		"LimitRange",
-		"PodSecurityPolicy",
-		"PodDisruptionBudget",
-		"Secret",
-		"ConfigMap",
-		"StorageClass",
-		"PersistentVolume",
-		"PersistentVolumeClaim",
-		"ServiceAccount",
-		"CustomResourceDefinition",
-		"ClusterRole",
-		"ClusterRoleBinding",
-		"Role",
-		"RoleBinding",
-		"Service",
-		"DaemonSet",
-		"Pod",
-		"ReplicationController",
-		"ReplicaSet",
-		"Deployment",
-		"StatefulSet",
-		"Job",
-		"CronJob",
-		"Ingress",
-		"APIService",
-	}
-	for i, kind := range kinds {
-		// make sure none of the above entries are zero, we need that for custom resources
-		kindOrder[kind] = i - len(kinds)
-	}
-}
-
-type syncTasks []*syncTask
-
-func (s syncTasks) Len() int {
-	return len(s)
-}
-
-func (s syncTasks) Swap(i, j int) {
-	s[i], s[j] = s[j], s[i]
-}
-
-// order is
-// 1. phase
-// 2. wave
-// 3. kind
-// 4. name
-func (s syncTasks) Less(i, j int) bool {
-
-	tA := s[i]
-	tB := s[j]
-
-	d := syncPhaseOrder[tA.phase] - syncPhaseOrder[tB.phase]
-	if d != 0 {
-		return d < 0
-	}
-
-	d = tA.wave() - tB.wave()
-	if d != 0 {
-		return d < 0
-	}
-
-	a := tA.obj()
-	b := tB.obj()
-
-	// we take advantage of the fact that if the kind is not in the kindOrder map,
-	// then it will return the default int value of zero, which is the highest value
-	d = kindOrder[a.GetKind()] - kindOrder[b.GetKind()]
-	if d != 0 {
-		return d < 0
-	}
-
-	return a.GetName() < b.GetName()
-}
-
-func (s syncTasks) Filter(predicate func(task *syncTask) bool) (tasks syncTasks) {
-	for _, task := range s {
-		if predicate(task) {
-			tasks = append(tasks, task)
-		}
-	}
-	return tasks
-}
-
-func (s syncTasks) Split(predicate func(task *syncTask) bool) (trueTasks, falseTasks syncTasks) {
-	for _, task := range s {
-		if predicate(task) {
-			trueTasks = append(trueTasks, task)
-		} else {
-			falseTasks = append(falseTasks, task)
-		}
-	}
-	return trueTasks, falseTasks
-}
-
-func (s syncTasks) All(predicate func(task *syncTask) bool) bool {
-	for _, task := range s {
-		if !predicate(task) {
-			return false
-		}
-	}
-	return true
-}
-
-func (s syncTasks) Any(predicate func(task *syncTask) bool) bool {
-	for _, task := range s {
-		if predicate(task) {
-			return true
-		}
-	}
-	return false
-}
-
-func (s syncTasks) Find(predicate func(task *syncTask) bool) *syncTask {
-	for _, task := range s {
-		if predicate(task) {
-			return task
-		}
-	}
-	return nil
-}
-
-func (s syncTasks) String() string {
-	var values []string
-	for _, task := range s {
-		values = append(values, task.String())
-	}
-	return "[" + strings.Join(values, ", ") + "]"
-}
-
-func (s syncTasks) phase() v1alpha1.SyncPhase {
-	if len(s) > 0 {
-		return s[0].phase
-	}
-	return ""
-}
-
-func (s syncTasks) wave() int {
-	if len(s) > 0 {
-		return s[0].wave()
-	}
-	return 0
-}
-
-func (s syncTasks) lastPhase() v1alpha1.SyncPhase {
-	if len(s) > 0 {
-		return s[len(s)-1].phase
-	}
-	return ""
-}
-
-func (s syncTasks) lastWave() int {
-	if len(s) > 0 {
-		return s[len(s)-1].wave()
-	}
-	return 0
-}
-
-func (s syncTasks) multiStep() bool {
-	return s.wave() != s.lastWave() || s.phase() != s.lastPhase()
-}

controller/sync_tasks_test.go

@@ -1,392 +0,0 @@
-package controller
-
-import (
-	"sort"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	apiv1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-
-	"github.com/argoproj/argo-cd/common"
-	. "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	. "github.com/argoproj/argo-cd/test"
-)
-
-func Test_syncTasks_kindOrder(t *testing.T) {
-	assert.Equal(t, -27, kindOrder["Namespace"])
-	assert.Equal(t, -1, kindOrder["APIService"])
-	assert.Equal(t, 0, kindOrder["MyCRD"])
-}
-
-func TestSortSyncTask(t *testing.T) {
-	sort.Sort(unsortedTasks)
-	assert.Equal(t, sortedTasks, unsortedTasks)
-}
-
-func TestAnySyncTasks(t *testing.T) {
-	res := unsortedTasks.Any(func(task *syncTask) bool {
-		return task.name() == "a"
-	})
-	assert.True(t, res)
-
-	res = unsortedTasks.Any(func(task *syncTask) bool {
-		return task.name() == "does-not-exist"
-	})
-	assert.False(t, res)
-
-}
-
-func TestAllSyncTasks(t *testing.T) {
-	res := unsortedTasks.All(func(task *syncTask) bool {
-		return task.name() != ""
-	})
-	assert.False(t, res)
-
-	res = unsortedTasks.All(func(task *syncTask) bool {
-		return task.name() == "a"
-	})
-	assert.False(t, res)
-}
-
-func TestSplitSyncTasks(t *testing.T) {
-	named, unnamed := sortedTasks.Split(func(task *syncTask) bool {
-		return task.name() != ""
-	})
-	assert.Equal(t, named, namedObjTasks)
-	assert.Equal(t, unnamed, unnamedTasks)
-}
-
-var unsortedTasks = syncTasks{
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"GroupVersion": apiv1.SchemeGroupVersion.String(),
-				"kind":         "Pod",
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"GroupVersion": apiv1.SchemeGroupVersion.String(),
-				"kind":         "Service",
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"GroupVersion": apiv1.SchemeGroupVersion.String(),
-				"kind":         "PersistentVolume",
-			},
-		},
-	},
-	{
-		phase: SyncPhaseSyncFail, targetObj: &unstructured.Unstructured{},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"metadata": map[string]interface{}{
-					"annotations": map[string]interface{}{
-						"argocd.argoproj.io/sync-wave": "1",
-					},
-				},
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"metadata": map[string]interface{}{
-					"name": "b",
-				},
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"metadata": map[string]interface{}{
-					"name": "a",
-				},
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"metadata": map[string]interface{}{
-					"annotations": map[string]interface{}{
-						"argocd.argoproj.io/sync-wave": "-1",
-					},
-				},
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"GroupVersion": apiv1.SchemeGroupVersion.String(),
-			},
-		},
-	},
-	{
-		phase:     SyncPhasePreSync,
-		targetObj: &unstructured.Unstructured{},
-	},
-	{
-		phase: SyncPhasePostSync, targetObj: &unstructured.Unstructured{},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"GroupVersion": apiv1.SchemeGroupVersion.String(),
-				"kind":         "ConfigMap",
-			},
-		},
-	},
-}
-
-var sortedTasks = syncTasks{
-	{
-		phase:     SyncPhasePreSync,
-		targetObj: &unstructured.Unstructured{},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"metadata": map[string]interface{}{
-					"annotations": map[string]interface{}{
-						"argocd.argoproj.io/sync-wave": "-1",
-					},
-				},
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"GroupVersion": apiv1.SchemeGroupVersion.String(),
-				"kind":         "ConfigMap",
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"GroupVersion": apiv1.SchemeGroupVersion.String(),
-				"kind":         "PersistentVolume",
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"GroupVersion": apiv1.SchemeGroupVersion.String(),
-				"kind":         "Service",
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"GroupVersion": apiv1.SchemeGroupVersion.String(),
-				"kind":         "Pod",
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"GroupVersion": apiv1.SchemeGroupVersion.String(),
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"metadata": map[string]interface{}{
-					"name": "a",
-				},
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"metadata": map[string]interface{}{
-					"name": "b",
-				},
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"metadata": map[string]interface{}{
-					"annotations": map[string]interface{}{
-						"argocd.argoproj.io/sync-wave": "1",
-					},
-				},
-			},
-		},
-	},
-	{
-		phase:     SyncPhasePostSync,
-		targetObj: &unstructured.Unstructured{},
-	},
-	{
-		phase:     SyncPhaseSyncFail,
-		targetObj: &unstructured.Unstructured{},
-	},
-}
-
-var namedObjTasks = syncTasks{
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"metadata": map[string]interface{}{
-					"name": "a",
-				},
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"metadata": map[string]interface{}{
-					"name": "b",
-				},
-			},
-		},
-	},
-}
-
-var unnamedTasks = syncTasks{
-	{
-		phase:     SyncPhasePreSync,
-		targetObj: &unstructured.Unstructured{},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"metadata": map[string]interface{}{
-					"annotations": map[string]interface{}{
-						"argocd.argoproj.io/sync-wave": "-1",
-					},
-				},
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"GroupVersion": apiv1.SchemeGroupVersion.String(),
-				"kind":         "ConfigMap",
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"GroupVersion": apiv1.SchemeGroupVersion.String(),
-				"kind":         "PersistentVolume",
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"GroupVersion": apiv1.SchemeGroupVersion.String(),
-				"kind":         "Service",
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"GroupVersion": apiv1.SchemeGroupVersion.String(),
-				"kind":         "Pod",
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"GroupVersion": apiv1.SchemeGroupVersion.String(),
-			},
-		},
-	},
-	{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"metadata": map[string]interface{}{
-					"annotations": map[string]interface{}{
-						"argocd.argoproj.io/sync-wave": "1",
-					},
-				},
-			},
-		},
-	},
-	{
-		phase:     SyncPhasePostSync,
-		targetObj: &unstructured.Unstructured{},
-	},
-	{
-		phase:     SyncPhaseSyncFail,
-		targetObj: &unstructured.Unstructured{},
-	},
-}
-
-func Test_syncTasks_Filter(t *testing.T) {
-	tasks := syncTasks{{phase: SyncPhaseSync}, {phase: SyncPhasePostSync}}
-
-	assert.Equal(t, syncTasks{{phase: SyncPhaseSync}}, tasks.Filter(func(t *syncTask) bool {
-		return t.phase == SyncPhaseSync
-	}))
-}
-
-func TestSyncNamespaceAgainstCRD(t *testing.T) {
-	crd := &syncTask{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"kind": "Workflow",
-			},
-		}}
-	namespace := &syncTask{
-		targetObj: &unstructured.Unstructured{
-			Object: map[string]interface{}{
-				"kind": "Namespace",
-			},
-		},
-	}
-
-	unsorted := syncTasks{crd, namespace}
-	sort.Sort(unsorted)
-
-	assert.Equal(t, syncTasks{namespace, crd}, unsorted)
-}
-
-func Test_syncTasks_multiStep(t *testing.T) {
-	t.Run("Single", func(t *testing.T) {
-		tasks := syncTasks{{liveObj: Annotate(NewPod(), common.AnnotationSyncWave, "-1"), phase: SyncPhaseSync}}
-		assert.Equal(t, SyncPhaseSync, tasks.phase())
-		assert.Equal(t, -1, tasks.wave())
-		assert.Equal(t, SyncPhaseSync, tasks.lastPhase())
-		assert.Equal(t, -1, tasks.lastWave())
-		assert.False(t, tasks.multiStep())
-	})
-	t.Run("Double", func(t *testing.T) {
-		tasks := syncTasks{
-			{liveObj: Annotate(NewPod(), common.AnnotationSyncWave, "-1"), phase: SyncPhasePreSync},
-			{liveObj: Annotate(NewPod(), common.AnnotationSyncWave, "1"), phase: SyncPhasePostSync},
-		}
-		assert.Equal(t, SyncPhasePreSync, tasks.phase())
-		assert.Equal(t, -1, tasks.wave())
-		assert.Equal(t, SyncPhasePostSync, tasks.lastPhase())
-		assert.Equal(t, 1, tasks.lastWave())
-		assert.True(t, tasks.multiStep())
-	})
-}

controller/sync_test.go

@@ -2,25 +2,24 @@ package controller
 
 import (
 	"fmt"
-	"reflect"
+	"sort"
 	"testing"
 
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
+	apiv1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 	fakedisco "k8s.io/client-go/discovery/fake"
-	"k8s.io/client-go/dynamic/fake"
 	"k8s.io/client-go/rest"
 	testcore "k8s.io/client-go/testing"
 
 	"github.com/argoproj/argo-cd/common"
 	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	. "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
-	"github.com/argoproj/argo-cd/reposerver/apiclient"
+	"github.com/argoproj/argo-cd/reposerver/repository"
 	"github.com/argoproj/argo-cd/test"
 	"github.com/argoproj/argo-cd/util/kube"
 	"github.com/argoproj/argo-cd/util/kube/kubetest"
@@ -44,12 +43,9 @@ func newTestSyncCtx(resources ...*v1.APIResourceList) *syncContext {
 		})
 	sc := syncContext{
 		config:    &rest.Config{},
-		rawConfig: &rest.Config{},
 		namespace: test.FakeArgoCDNamespace,
 		server:    test.FakeClusterURL,
-		syncRes: &v1alpha1.SyncOperationResult{
-			Revision: "FooBarBaz",
-		},
+		syncRes:   &v1alpha1.SyncOperationResult{},
 		syncOp: &v1alpha1.SyncOperation{
 			Prune: true,
 			SyncStrategy: &v1alpha1.SyncStrategy{
@@ -74,21 +70,10 @@ func newTestSyncCtx(resources ...*v1.APIResourceList) *syncContext {
 		disco:   fakeDisco,
 		log:     log.WithFields(log.Fields{"application": "fake-app"}),
 	}
-	sc.kubectl = &kubetest.MockKubectlCmd{}
+	sc.kubectl = kubetest.MockKubectlCmd{}
 	return &sc
 }
 
-func newManagedResource(live *unstructured.Unstructured) managedResource {
-	return managedResource{
-		Live:      live,
-		Group:     live.GroupVersionKind().Group,
-		Version:   live.GroupVersionKind().Version,
-		Kind:      live.GroupVersionKind().Kind,
-		Namespace: live.GetNamespace(),
-		Name:      live.GetName(),
-	}
-}
-
 func TestSyncNotPermittedNamespace(t *testing.T) {
 	syncCtx := newTestSyncCtx()
 	targetPod := test.NewPod()
@@ -119,19 +104,18 @@ func TestSyncCreateInSortedOrder(t *testing.T) {
 		}},
 	}
 	syncCtx.sync()
-	assert.Equal(t, v1alpha1.OperationSucceeded, syncCtx.opState.Phase)
 	assert.Len(t, syncCtx.syncRes.Resources, 2)
 	for i := range syncCtx.syncRes.Resources {
-		result := syncCtx.syncRes.Resources[i]
-		if result.Kind == "Pod" {
-			assert.Equal(t, v1alpha1.ResultCodeSynced, result.Status)
-			assert.Equal(t, "", result.Message)
-		} else if result.Kind == "Service" {
-			assert.Equal(t, "", result.Message)
+		if syncCtx.syncRes.Resources[i].Kind == "Pod" {
+			assert.Equal(t, v1alpha1.ResultCodeSynced, syncCtx.syncRes.Resources[i].Status)
+		} else if syncCtx.syncRes.Resources[i].Kind == "Service" {
+			assert.Equal(t, v1alpha1.ResultCodeSynced, syncCtx.syncRes.Resources[i].Status)
 		} else {
 			t.Error("Resource isn't a pod or a service")
 		}
 	}
+	syncCtx.sync()
+	assert.Equal(t, syncCtx.opState.Phase, v1alpha1.OperationSucceeded)
 }
 
 func TestSyncCreateNotWhitelistedClusterResources(t *testing.T) {
@@ -152,7 +136,7 @@ func TestSyncCreateNotWhitelistedClusterResources(t *testing.T) {
 		{Group: "argoproj.io", Kind: "*"},
 	}
 
-	syncCtx.kubectl = &kubetest.MockKubectlCmd{}
+	syncCtx.kubectl = kubetest.MockKubectlCmd{}
 	syncCtx.compareResult = &comparisonResult{
 		managedResources: []managedResource{{
 			Live: nil,
@@ -163,9 +147,8 @@ func TestSyncCreateNotWhitelistedClusterResources(t *testing.T) {
 	}
 	syncCtx.sync()
 	assert.Len(t, syncCtx.syncRes.Resources, 1)
-	result := syncCtx.syncRes.Resources[0]
-	assert.Equal(t, v1alpha1.ResultCodeSyncFailed, result.Status)
-	assert.Contains(t, result.Message, "not permitted in project")
+	assert.Equal(t, v1alpha1.ResultCodeSyncFailed, syncCtx.syncRes.Resources[0].Status)
+	assert.Contains(t, syncCtx.syncRes.Resources[0].Message, "not permitted in project")
 }
 
 func TestSyncBlacklistedNamespacedResources(t *testing.T) {
@@ -183,83 +166,73 @@ func TestSyncBlacklistedNamespacedResources(t *testing.T) {
 	}
 	syncCtx.sync()
 	assert.Len(t, syncCtx.syncRes.Resources, 1)
-	result := syncCtx.syncRes.Resources[0]
-	assert.Equal(t, v1alpha1.ResultCodeSyncFailed, result.Status)
-	assert.Contains(t, result.Message, "not permitted in project")
+	assert.Equal(t, v1alpha1.ResultCodeSyncFailed, syncCtx.syncRes.Resources[0].Status)
+	assert.Contains(t, syncCtx.syncRes.Resources[0].Message, "not permitted in project")
 }
 
 func TestSyncSuccessfully(t *testing.T) {
 	syncCtx := newTestSyncCtx()
-	pod := test.NewPod()
-	pod.SetNamespace(test.FakeArgoCDNamespace)
 	syncCtx.compareResult = &comparisonResult{
 		managedResources: []managedResource{{
 			Live:   nil,
 			Target: test.NewService(),
 		}, {
-			Live:   pod,
+			Live:   test.NewPod(),
 			Target: nil,
 		}},
 	}
 	syncCtx.sync()
-	assert.Equal(t, v1alpha1.OperationSucceeded, syncCtx.opState.Phase)
 	assert.Len(t, syncCtx.syncRes.Resources, 2)
 	for i := range syncCtx.syncRes.Resources {
-		result := syncCtx.syncRes.Resources[i]
-		if result.Kind == "Pod" {
-			assert.Equal(t, v1alpha1.ResultCodePruned, result.Status)
-			assert.Equal(t, "pruned", result.Message)
-		} else if result.Kind == "Service" {
-			assert.Equal(t, v1alpha1.ResultCodeSynced, result.Status)
-			assert.Equal(t, "", result.Message)
+		if syncCtx.syncRes.Resources[i].Kind == "Pod" {
+			assert.Equal(t, v1alpha1.ResultCodePruned, syncCtx.syncRes.Resources[i].Status)
+		} else if syncCtx.syncRes.Resources[i].Kind == "Service" {
+			assert.Equal(t, v1alpha1.ResultCodeSynced, syncCtx.syncRes.Resources[i].Status)
 		} else {
 			t.Error("Resource isn't a pod or a service")
 		}
 	}
+	syncCtx.sync()
+	assert.Equal(t, syncCtx.opState.Phase, v1alpha1.OperationSucceeded)
 }
 
 func TestSyncDeleteSuccessfully(t *testing.T) {
 	syncCtx := newTestSyncCtx()
-	svc := test.NewService()
-	svc.SetNamespace(test.FakeArgoCDNamespace)
-	pod := test.NewPod()
-	pod.SetNamespace(test.FakeArgoCDNamespace)
 	syncCtx.compareResult = &comparisonResult{
 		managedResources: []managedResource{{
-			Live:   svc,
+			Live:   test.NewService(),
 			Target: nil,
 		}, {
-			Live:   pod,
+			Live:   test.NewPod(),
 			Target: nil,
 		}},
 	}
 	syncCtx.sync()
-	assert.Equal(t, v1alpha1.OperationSucceeded, syncCtx.opState.Phase)
 	for i := range syncCtx.syncRes.Resources {
-		result := syncCtx.syncRes.Resources[i]
-		if result.Kind == "Pod" {
-			assert.Equal(t, v1alpha1.ResultCodePruned, result.Status)
-			assert.Equal(t, "pruned", result.Message)
-		} else if result.Kind == "Service" {
-			assert.Equal(t, v1alpha1.ResultCodePruned, result.Status)
-			assert.Equal(t, "pruned", result.Message)
+		if syncCtx.syncRes.Resources[i].Kind == "Pod" {
+			assert.Equal(t, v1alpha1.ResultCodePruned, syncCtx.syncRes.Resources[i].Status)
+		} else if syncCtx.syncRes.Resources[i].Kind == "Service" {
+			assert.Equal(t, v1alpha1.ResultCodePruned, syncCtx.syncRes.Resources[i].Status)
 		} else {
 			t.Error("Resource isn't a pod or a service")
 		}
 	}
+	syncCtx.sync()
+	assert.Equal(t, syncCtx.opState.Phase, v1alpha1.OperationSucceeded)
 }
 
 func TestSyncCreateFailure(t *testing.T) {
 	syncCtx := newTestSyncCtx()
-	testSvc := test.NewService()
-	syncCtx.kubectl = &kubetest.MockKubectlCmd{
+	syncCtx.kubectl = kubetest.MockKubectlCmd{
 		Commands: map[string]kubetest.KubectlOutput{
-			testSvc.GetName(): {
+			"test-service": {
 				Output: "",
-				Err:    fmt.Errorf("foo"),
+				Err:    fmt.Errorf("error: error validating \"test.yaml\": error validating data: apiVersion not set; if you choose to ignore these errors, turn validation off with --validate=false"),
 			},
 		},
 	}
+	testSvc := test.NewService()
+	testSvc.SetAPIVersion("")
 	syncCtx.compareResult = &comparisonResult{
 		managedResources: []managedResource{{
 			Live:   nil,
@@ -268,24 +241,21 @@ func TestSyncCreateFailure(t *testing.T) {
 	}
 	syncCtx.sync()
 	assert.Len(t, syncCtx.syncRes.Resources, 1)
-	result := syncCtx.syncRes.Resources[0]
-	assert.Equal(t, v1alpha1.ResultCodeSyncFailed, result.Status)
-	assert.Equal(t, "foo", result.Message)
+	assert.Equal(t, v1alpha1.ResultCodeSyncFailed, syncCtx.syncRes.Resources[0].Status)
 }
 
 func TestSyncPruneFailure(t *testing.T) {
 	syncCtx := newTestSyncCtx()
-	syncCtx.kubectl = &kubetest.MockKubectlCmd{
+	syncCtx.kubectl = kubetest.MockKubectlCmd{
 		Commands: map[string]kubetest.KubectlOutput{
 			"test-service": {
 				Output: "",
-				Err:    fmt.Errorf("foo"),
+				Err:    fmt.Errorf(" error: timed out waiting for \"test-service\" to be synced"),
 			},
 		},
 	}
 	testSvc := test.NewService()
 	testSvc.SetName("test-service")
-	testSvc.SetNamespace(test.FakeArgoCDNamespace)
 	syncCtx.compareResult = &comparisonResult{
 		managedResources: []managedResource{{
 			Live:   testSvc,
@@ -293,11 +263,155 @@ func TestSyncPruneFailure(t *testing.T) {
 		}},
 	}
 	syncCtx.sync()
-	assert.Equal(t, v1alpha1.OperationFailed, syncCtx.opState.Phase)
 	assert.Len(t, syncCtx.syncRes.Resources, 1)
-	result := syncCtx.syncRes.Resources[0]
-	assert.Equal(t, v1alpha1.ResultCodeSyncFailed, result.Status)
-	assert.Equal(t, "foo", result.Message)
+	assert.Equal(t, v1alpha1.ResultCodeSyncFailed, syncCtx.syncRes.Resources[0].Status)
+}
+
+func unsortedManifest() []syncTask {
+	return []syncTask{
+		{
+			targetObj: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"GroupVersion": apiv1.SchemeGroupVersion.String(),
+					"kind":         "Pod",
+				},
+			},
+		},
+		{
+			targetObj: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"GroupVersion": apiv1.SchemeGroupVersion.String(),
+					"kind":         "Service",
+				},
+			},
+		},
+		{
+			targetObj: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"GroupVersion": apiv1.SchemeGroupVersion.String(),
+					"kind":         "PersistentVolume",
+				},
+			},
+		},
+		{
+			targetObj: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"GroupVersion": apiv1.SchemeGroupVersion.String(),
+				},
+			},
+		},
+		{
+			targetObj: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"GroupVersion": apiv1.SchemeGroupVersion.String(),
+					"kind":         "ConfigMap",
+				},
+			},
+		},
+	}
+}
+
+func sortedManifest() []syncTask {
+	return []syncTask{
+		{
+			targetObj: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"GroupVersion": apiv1.SchemeGroupVersion.String(),
+					"kind":         "ConfigMap",
+				},
+			},
+		},
+		{
+			targetObj: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"GroupVersion": apiv1.SchemeGroupVersion.String(),
+					"kind":         "PersistentVolume",
+				},
+			},
+		},
+		{
+			targetObj: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"GroupVersion": apiv1.SchemeGroupVersion.String(),
+					"kind":         "Service",
+				},
+			},
+		},
+		{
+			targetObj: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"GroupVersion": apiv1.SchemeGroupVersion.String(),
+					"kind":         "Pod",
+				},
+			},
+		},
+		{
+			targetObj: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"GroupVersion": apiv1.SchemeGroupVersion.String(),
+				},
+			},
+		},
+	}
+}
+
+func TestSortKubernetesResourcesSuccessfully(t *testing.T) {
+	unsorted := unsortedManifest()
+	ks := newKindSorter(unsorted, resourceOrder)
+	sort.Sort(ks)
+
+	expectedOrder := sortedManifest()
+	assert.Equal(t, len(unsorted), len(expectedOrder))
+	for i, sorted := range unsorted {
+		assert.Equal(t, expectedOrder[i], sorted)
+	}
+
+}
+
+func TestSortManifestHandleNil(t *testing.T) {
+	task := syncTask{
+		targetObj: &unstructured.Unstructured{
+			Object: map[string]interface{}{
+				"GroupVersion": apiv1.SchemeGroupVersion.String(),
+				"kind":         "Service",
+			},
+		},
+	}
+	manifest := []syncTask{
+		{},
+		task,
+	}
+	ks := newKindSorter(manifest, resourceOrder)
+	sort.Sort(ks)
+	assert.Equal(t, task, manifest[0])
+	assert.Nil(t, manifest[1].targetObj)
+}
+
+func TestSyncNamespaceAgainstCRD(t *testing.T) {
+	crd := syncTask{
+		targetObj: &unstructured.Unstructured{
+			Object: map[string]interface{}{
+				"GroupVersion": "argoproj.io/alpha1",
+				"kind":         "Workflow",
+			},
+		}}
+	namespace := syncTask{
+		targetObj: &unstructured.Unstructured{
+			Object: map[string]interface{}{
+				"GroupVersion": apiv1.SchemeGroupVersion.String(),
+				"kind":         "Namespace",
+			},
+		},
+	}
+	unsorted := []syncTask{crd, namespace}
+	ks := newKindSorter(unsorted, resourceOrder)
+	sort.Sort(ks)
+
+	expectedOrder := []syncTask{namespace, crd}
+	assert.Equal(t, len(unsorted), len(expectedOrder))
+	for i, sorted := range unsorted {
+		assert.Equal(t, expectedOrder[i], sorted)
+	}
 }
 
 func TestDontSyncOrPruneHooks(t *testing.T) {
@@ -307,270 +421,23 @@ func TestDontSyncOrPruneHooks(t *testing.T) {
 	targetPod.SetAnnotations(map[string]string{common.AnnotationKeyHook: "PreSync"})
 	liveSvc := test.NewService()
 	liveSvc.SetName("dont-prune-me")
-	liveSvc.SetNamespace(test.FakeArgoCDNamespace)
 	liveSvc.SetAnnotations(map[string]string{common.AnnotationKeyHook: "PreSync"})
 
 	syncCtx.compareResult = &comparisonResult{
-		hooks: []*unstructured.Unstructured{targetPod, liveSvc},
+		managedResources: []managedResource{{
+			Live:   nil,
+			Target: targetPod,
+			Hook:   true,
+		}, {
+			Live:   liveSvc,
+			Target: nil,
+			Hook:   true,
+		}},
 	}
 	syncCtx.sync()
 	assert.Len(t, syncCtx.syncRes.Resources, 0)
 	syncCtx.sync()
-	assert.Equal(t, v1alpha1.OperationSucceeded, syncCtx.opState.Phase)
-}
-
-// make sure that we do not prune resources with Prune=false
-func TestDontPrunePruneFalse(t *testing.T) {
-	syncCtx := newTestSyncCtx()
-	pod := test.NewPod()
-	pod.SetAnnotations(map[string]string{common.AnnotationSyncOptions: "Prune=false"})
-	pod.SetNamespace(test.FakeArgoCDNamespace)
-	syncCtx.compareResult = &comparisonResult{managedResources: []managedResource{{Live: pod}}}
-
-	syncCtx.sync()
-
-	assert.Equal(t, v1alpha1.OperationSucceeded, syncCtx.opState.Phase)
-	assert.Len(t, syncCtx.syncRes.Resources, 1)
-	assert.Equal(t, v1alpha1.ResultCodePruneSkipped, syncCtx.syncRes.Resources[0].Status)
-	assert.Equal(t, "ignored (no prune)", syncCtx.syncRes.Resources[0].Message)
-
-	syncCtx.sync()
-
-	assert.Equal(t, v1alpha1.OperationSucceeded, syncCtx.opState.Phase)
-}
-
-// make sure Validate=false means we don't validate
-func TestSyncOptionValidate(t *testing.T) {
-	tests := []struct {
-		name          string
-		annotationVal string
-		want          bool
-	}{
-		{"Empty", "", true},
-		{"True", "Validate=true", true},
-		{"False", "Validate=false", false},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			syncCtx := newTestSyncCtx()
-			pod := test.NewPod()
-			pod.SetAnnotations(map[string]string{common.AnnotationSyncOptions: tt.annotationVal})
-			pod.SetNamespace(test.FakeArgoCDNamespace)
-			syncCtx.compareResult = &comparisonResult{managedResources: []managedResource{{Target: pod, Live: pod}}}
-
-			syncCtx.sync()
-
-			kubectl, _ := syncCtx.kubectl.(*kubetest.MockKubectlCmd)
-			assert.Equal(t, tt.want, kubectl.LastValidate)
-		})
-	}
-}
-
-// make sure Validate means we don't validate
-func TestSyncValidate(t *testing.T) {
-	syncCtx := newTestSyncCtx()
-	pod := test.NewPod()
-	pod.SetNamespace(test.FakeArgoCDNamespace)
-	syncCtx.compareResult = &comparisonResult{managedResources: []managedResource{{Target: pod, Live: pod}}}
-	syncCtx.syncOp.SyncOptions = SyncOptions{"Validate=false"}
-
-	syncCtx.sync()
-
-	kubectl := syncCtx.kubectl.(*kubetest.MockKubectlCmd)
-	assert.False(t, kubectl.LastValidate)
-}
-
-func TestSelectiveSyncOnly(t *testing.T) {
-	syncCtx := newTestSyncCtx()
-	pod1 := test.NewPod()
-	pod1.SetName("pod-1")
-	pod2 := test.NewPod()
-	pod2.SetName("pod-2")
-	syncCtx.compareResult = &comparisonResult{
-		managedResources: []managedResource{{Target: pod1}},
-	}
-	syncCtx.syncResources = []v1alpha1.SyncOperationResource{{Kind: "Pod", Name: "pod-1"}}
-
-	tasks, successful := syncCtx.getSyncTasks()
-
-	assert.True(t, successful)
-	assert.Len(t, tasks, 1)
-	assert.Equal(t, "pod-1", tasks[0].name())
-}
-
-func TestUnnamedHooksGetUniqueNames(t *testing.T) {
-	t.Run("Truncated revision", func(t *testing.T) {
-		syncCtx := newTestSyncCtx()
-		syncCtx.syncOp.SyncStrategy.Apply = nil
-		pod := test.NewPod()
-		pod.SetName("")
-		pod.SetAnnotations(map[string]string{common.AnnotationKeyHook: "PreSync,PostSync"})
-		syncCtx.compareResult = &comparisonResult{hooks: []*unstructured.Unstructured{pod}}
-
-		tasks, successful := syncCtx.getSyncTasks()
-
-		assert.True(t, successful)
-		assert.Len(t, tasks, 2)
-		assert.Contains(t, tasks[0].name(), "foobarb-presync-")
-		assert.Contains(t, tasks[1].name(), "foobarb-postsync-")
-		assert.Equal(t, "", pod.GetName())
-	})
-
-	t.Run("Short revision", func(t *testing.T) {
-		syncCtx := newTestSyncCtx()
-		syncCtx.syncOp.SyncStrategy.Apply = nil
-		pod := test.NewPod()
-		pod.SetName("")
-		pod.SetAnnotations(map[string]string{common.AnnotationKeyHook: "PreSync,PostSync"})
-		syncCtx.compareResult = &comparisonResult{hooks: []*unstructured.Unstructured{pod}}
-		syncCtx.syncRes.Revision = "foobar"
-		tasks, successful := syncCtx.getSyncTasks()
-
-		assert.True(t, successful)
-		assert.Len(t, tasks, 2)
-		assert.Contains(t, tasks[0].name(), "foobar-presync-")
-		assert.Contains(t, tasks[1].name(), "foobar-postsync-")
-		assert.Equal(t, "", pod.GetName())
-	})
-
-}
-
-func TestManagedResourceAreNotNamed(t *testing.T) {
-	syncCtx := newTestSyncCtx()
-	pod := test.NewPod()
-	pod.SetName("")
-	syncCtx.compareResult = &comparisonResult{managedResources: []managedResource{{Target: pod}}}
-
-	tasks, successful := syncCtx.getSyncTasks()
-
-	assert.True(t, successful)
-	assert.Len(t, tasks, 1)
-	assert.Equal(t, "", tasks[0].name())
-	assert.Equal(t, "", pod.GetName())
-}
-
-func TestDeDupingTasks(t *testing.T) {
-	syncCtx := newTestSyncCtx()
-	syncCtx.syncOp.SyncStrategy.Apply = nil
-	pod := test.NewPod()
-	pod.SetAnnotations(map[string]string{common.AnnotationKeyHook: "Sync"})
-	syncCtx.compareResult = &comparisonResult{
-		managedResources: []managedResource{{Target: pod}},
-		hooks:            []*unstructured.Unstructured{pod},
-	}
-
-	tasks, successful := syncCtx.getSyncTasks()
-
-	assert.True(t, successful)
-	assert.Len(t, tasks, 1)
-}
-
-func TestObjectsGetANamespace(t *testing.T) {
-	syncCtx := newTestSyncCtx()
-	pod := test.NewPod()
-	syncCtx.compareResult = &comparisonResult{managedResources: []managedResource{{Target: pod}}}
-
-	tasks, successful := syncCtx.getSyncTasks()
-
-	assert.True(t, successful)
-	assert.Len(t, tasks, 1)
-	assert.Equal(t, test.FakeArgoCDNamespace, tasks[0].namespace())
-	assert.Equal(t, "", pod.GetNamespace())
-}
-
-func TestSyncCustomResources(t *testing.T) {
-	type fields struct {
-		skipDryRunAnnotationPresent bool
-		crdAlreadyPresent           bool
-		crdInSameSync               bool
-	}
-
-	tests := []struct {
-		name        string
-		fields      fields
-		wantDryRun  bool
-		wantSuccess bool
-	}{
-
-		{"unknown crd", fields{
-			skipDryRunAnnotationPresent: false, crdAlreadyPresent: false, crdInSameSync: false,
-		}, true, false},
-		{"crd present in same sync", fields{
-			skipDryRunAnnotationPresent: false, crdAlreadyPresent: false, crdInSameSync: true,
-		}, false, true},
-		{"crd is already present in cluster", fields{
-			skipDryRunAnnotationPresent: false, crdAlreadyPresent: true, crdInSameSync: false,
-		}, true, true},
-		{"crd is already present in cluster, skip dry run annotated", fields{
-			skipDryRunAnnotationPresent: true, crdAlreadyPresent: true, crdInSameSync: false,
-		}, true, true},
-		{"unknown crd, skip dry run annotated", fields{
-			skipDryRunAnnotationPresent: true, crdAlreadyPresent: false, crdInSameSync: false,
-		}, false, true},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-
-			knownCustomResourceTypes := []v1.APIResource{}
-			if tt.fields.crdAlreadyPresent {
-				knownCustomResourceTypes = append(knownCustomResourceTypes, v1.APIResource{Kind: "TestCrd", Group: "argoproj.io", Version: "v1", Namespaced: true})
-			}
-
-			syncCtx := newTestSyncCtx(
-				&v1.APIResourceList{
-					GroupVersion: "argoproj.io/v1",
-					APIResources: knownCustomResourceTypes,
-				},
-				&v1.APIResourceList{
-					GroupVersion: "apiextensions.k8s.io/v1beta1",
-					APIResources: []v1.APIResource{
-						{Kind: "CustomResourceDefinition", Group: "apiextensions.k8s.io", Version: "v1beta1", Namespaced: true},
-					},
-				},
-			)
-
-			cr := test.Unstructured(`
-{
-  "apiVersion": "argoproj.io/v1",
-  "kind": "TestCrd",
-  "metadata": {
-    "name": "my-resource"
-  }
-}
-`)
-
-			if tt.fields.skipDryRunAnnotationPresent {
-				cr.SetAnnotations(map[string]string{common.AnnotationSyncOptions: "SkipDryRunOnMissingResource=true"})
-			}
-
-			resources := []managedResource{{Target: cr}}
-			if tt.fields.crdInSameSync {
-				resources = append(resources, managedResource{Target: test.NewCRD()})
-			}
-
-			syncCtx.compareResult = &comparisonResult{managedResources: resources}
-
-			tasks, successful := syncCtx.getSyncTasks()
-
-			if successful != tt.wantSuccess {
-				t.Errorf("successful = %v, want: %v", successful, tt.wantSuccess)
-				return
-			}
-
-			skipDryRun := false
-			for _, task := range tasks {
-				if task.targetObj.GetKind() == cr.GetKind() {
-					skipDryRun = task.skipDryRun
-					break
-				}
-			}
-
-			if tt.wantDryRun != !skipDryRun {
-				t.Errorf("dryRun = %v, want: %v", !skipDryRun, tt.wantDryRun)
-			}
-		})
-	}
-
+	assert.Equal(t, syncCtx.opState.Phase, v1alpha1.OperationSucceeded)
 }
 
 func TestPersistRevisionHistory(t *testing.T) {
@@ -586,7 +453,7 @@ func TestPersistRevisionHistory(t *testing.T) {
 	}
 	data := fakeData{
 		apps: []runtime.Object{app, defaultProject},
-		manifestResponse: &apiclient.ManifestResponse{
+		manifestResponse: &repository.ManifestResponse{
 			Manifests: []string{},
 			Namespace: test.FakeDestNamespace,
 			Server:    test.FakeClusterURL,
@@ -623,7 +490,7 @@ func TestPersistRevisionHistoryRollback(t *testing.T) {
 	}
 	data := fakeData{
 		apps: []runtime.Object{app, defaultProject},
-		manifestResponse: &apiclient.ManifestResponse{
+		manifestResponse: &repository.ManifestResponse{
 			Manifests: []string{},
 			Namespace: test.FakeDestNamespace,
 			Server:    test.FakeClusterURL,
@@ -659,171 +526,3 @@ func TestPersistRevisionHistoryRollback(t *testing.T) {
 	assert.Equal(t, source, updatedApp.Status.History[0].Source)
 	assert.Equal(t, "abc123", updatedApp.Status.History[0].Revision)
 }
-
-func TestSyncFailureHookWithSuccessfulSync(t *testing.T) {
-	syncCtx := newTestSyncCtx()
-	syncCtx.syncOp.SyncStrategy.Apply = nil
-	syncCtx.compareResult = &comparisonResult{
-		managedResources: []managedResource{{Target: test.NewPod()}},
-		hooks:            []*unstructured.Unstructured{test.NewHook(HookTypeSyncFail)},
-	}
-
-	syncCtx.sync()
-
-	assert.Equal(t, OperationSucceeded, syncCtx.opState.Phase)
-	// only one result, we did not run the failure failureHook
-	assert.Len(t, syncCtx.syncRes.Resources, 1)
-}
-
-func TestSyncFailureHookWithFailedSync(t *testing.T) {
-	syncCtx := newTestSyncCtx()
-	syncCtx.syncOp.SyncStrategy.Apply = nil
-	pod := test.NewPod()
-	syncCtx.compareResult = &comparisonResult{
-		managedResources: []managedResource{{Target: pod}},
-		hooks:            []*unstructured.Unstructured{test.NewHook(HookTypeSyncFail)},
-	}
-	syncCtx.kubectl = &kubetest.MockKubectlCmd{
-		Commands: map[string]kubetest.KubectlOutput{pod.GetName(): {Err: fmt.Errorf("")}},
-	}
-
-	syncCtx.sync()
-	syncCtx.sync()
-
-	assert.Equal(t, OperationFailed, syncCtx.opState.Phase)
-	assert.Len(t, syncCtx.syncRes.Resources, 2)
-}
-
-func TestBeforeHookCreation(t *testing.T) {
-	syncCtx := newTestSyncCtx()
-	syncCtx.syncOp.SyncStrategy.Apply = nil
-	hook := test.Annotate(test.Annotate(test.NewPod(), common.AnnotationKeyHook, "Sync"), common.AnnotationKeyHookDeletePolicy, "BeforeHookCreation")
-	hook.SetNamespace(test.FakeArgoCDNamespace)
-	syncCtx.compareResult = &comparisonResult{
-		managedResources: []managedResource{newManagedResource(hook)},
-		hooks:            []*unstructured.Unstructured{hook},
-	}
-	syncCtx.dynamicIf = fake.NewSimpleDynamicClient(runtime.NewScheme())
-
-	syncCtx.sync()
-	assert.Len(t, syncCtx.syncRes.Resources, 1)
-	assert.Empty(t, syncCtx.syncRes.Resources[0].Message)
-}
-
-func TestRunSyncFailHooksFailed(t *testing.T) {
-	// Tests that other SyncFail Hooks run even if one of them fail.
-
-	syncCtx := newTestSyncCtx()
-	syncCtx.syncOp.SyncStrategy.Apply = nil
-	pod := test.NewPod()
-	successfulSyncFailHook := test.NewHook(HookTypeSyncFail)
-	successfulSyncFailHook.SetName("successful-sync-fail-hook")
-	failedSyncFailHook := test.NewHook(HookTypeSyncFail)
-	failedSyncFailHook.SetName("failed-sync-fail-hook")
-	syncCtx.compareResult = &comparisonResult{
-		managedResources: []managedResource{{Target: pod}},
-		hooks:            []*unstructured.Unstructured{successfulSyncFailHook, failedSyncFailHook},
-	}
-
-	syncCtx.kubectl = &kubetest.MockKubectlCmd{
-		Commands: map[string]kubetest.KubectlOutput{
-			// Fail operation
-			pod.GetName(): {Err: fmt.Errorf("")},
-			// Fail a single SyncFail hook
-			failedSyncFailHook.GetName(): {Err: fmt.Errorf("")}},
-	}
-
-	syncCtx.sync()
-	syncCtx.sync()
-
-	fmt.Println(syncCtx.syncRes.Resources)
-	fmt.Println(syncCtx.opState.Phase)
-	// Operation as a whole should fail
-	assert.Equal(t, OperationFailed, syncCtx.opState.Phase)
-	// failedSyncFailHook should fail
-	assert.Equal(t, OperationFailed, syncCtx.syncRes.Resources[1].HookPhase)
-	assert.Equal(t, ResultCodeSyncFailed, syncCtx.syncRes.Resources[1].Status)
-	// successfulSyncFailHook should be synced running (it is an nginx pod)
-	assert.Equal(t, OperationRunning, syncCtx.syncRes.Resources[2].HookPhase)
-	assert.Equal(t, ResultCodeSynced, syncCtx.syncRes.Resources[2].Status)
-}
-
-func Test_syncContext_isSelectiveSync(t *testing.T) {
-	type fields struct {
-		compareResult *comparisonResult
-		syncResources []SyncOperationResource
-	}
-	oneSyncResource := []SyncOperationResource{{}}
-	oneResource := func(group, kind, name string, hook bool) *comparisonResult {
-		return &comparisonResult{resources: []v1alpha1.ResourceStatus{{Group: group, Kind: kind, Name: name, Hook: hook}}}
-	}
-	tests := []struct {
-		name   string
-		fields fields
-		want   bool
-	}{
-		{"Empty", fields{}, false},
-		{"OneCompareResult", fields{oneResource("", "", "", false), []SyncOperationResource{}}, true},
-		{"OneSyncResource", fields{&comparisonResult{}, oneSyncResource}, true},
-		{"Equal", fields{oneResource("", "", "", false), oneSyncResource}, false},
-		{"EqualOutOfOrder", fields{&comparisonResult{resources: []v1alpha1.ResourceStatus{{Group: "a"}, {Group: "b"}}}, []SyncOperationResource{{Group: "b"}, {Group: "a"}}}, false},
-		{"KindDifferent", fields{oneResource("foo", "", "", false), oneSyncResource}, true},
-		{"GroupDifferent", fields{oneResource("", "foo", "", false), oneSyncResource}, true},
-		{"NameDifferent", fields{oneResource("", "", "foo", false), oneSyncResource}, true},
-		{"HookIgnored", fields{oneResource("", "", "", true), []SyncOperationResource{}}, false},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			sc := &syncContext{
-				compareResult: tt.fields.compareResult,
-				syncResources: tt.fields.syncResources,
-			}
-			if got := sc.isSelectiveSync(); got != tt.want {
-				t.Errorf("syncContext.isSelectiveSync() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
-func Test_syncContext_liveObj(t *testing.T) {
-	type fields struct {
-		compareResult *comparisonResult
-	}
-	type args struct {
-		obj *unstructured.Unstructured
-	}
-	obj := test.NewPod()
-	obj.SetNamespace("my-ns")
-
-	found := test.NewPod()
-
-	tests := []struct {
-		name   string
-		fields fields
-		args   args
-		want   *unstructured.Unstructured
-	}{
-		{"None", fields{compareResult: &comparisonResult{managedResources: []managedResource{}}}, args{obj: &unstructured.Unstructured{}}, nil},
-		{"Found", fields{compareResult: &comparisonResult{managedResources: []managedResource{{Group: obj.GroupVersionKind().Group, Kind: obj.GetKind(), Namespace: obj.GetNamespace(), Name: obj.GetName(), Live: found}}}}, args{obj: obj}, found},
-		{"EmptyNamespace", fields{compareResult: &comparisonResult{managedResources: []managedResource{{Group: obj.GroupVersionKind().Group, Kind: obj.GetKind(), Name: obj.GetName(), Live: found}}}}, args{obj: obj}, found},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			sc := &syncContext{
-				compareResult: tt.fields.compareResult,
-			}
-			if got := sc.liveObj(tt.args.obj); !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("syncContext.liveObj() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
-func Test_syncContext_hasCRDOfGroupKind(t *testing.T) {
-	// target
-	assert.False(t, (&syncContext{compareResult: &comparisonResult{managedResources: []managedResource{{Target: test.NewCRD()}}}}).hasCRDOfGroupKind("", ""))
-	assert.True(t, (&syncContext{compareResult: &comparisonResult{managedResources: []managedResource{{Target: test.NewCRD()}}}}).hasCRDOfGroupKind("argoproj.io", "TestCrd"))
-	// hook
-	assert.False(t, (&syncContext{compareResult: &comparisonResult{hooks: []*unstructured.Unstructured{test.NewCRD()}}}).hasCRDOfGroupKind("", ""))
-	assert.True(t, (&syncContext{compareResult: &comparisonResult{hooks: []*unstructured.Unstructured{test.NewCRD()}}}).hasCRDOfGroupKind("argoproj.io", "TestCrd"))
-}

docs/CONTRIBUTING.md

@@ -1 +0,0 @@
-Please refer to [the Contribution Guide](https://argoproj.github.io/argo-cd/developer-guide/contributing/)

docs/README.md

@@ -0,0 +1,38 @@
+# Argo CD Documentation
+
+## [Getting Started](getting_started.md)
+
+## Concepts
+* [Architecture](architecture.md)
+* [Tracking Strategies](tracking_strategies.md)
+
+## Quick Reference
+| Name | Kind | Description |
+|------|------|-------------|
+| [`argocd-cm.yaml`](argocd-cm.yaml) | ConfigMap | General Argo CD configuration |
+| [`argocd-secret.yaml`](argocd-secret.yaml) | Secret | Password, Certificates, Signing Key |
+| [`argocd-rbac-cm.yaml`](argocd-rbac-cm.yaml) | ConfigMap | RBAC Configuration |
+| [`application.yaml`](application.yaml) | Application | Example application spec |
+| [`project.yaml`](argocd-rbac-cm.yaml) | AppProject | Example project spec |
+
+## Features
+* [Application Sources](application_sources.md)
+* [Application Parameters](parameters.md)
+* [Projects](projects.md)
+* [Automated Sync](auto_sync.md)
+* [Resource Health](health.md)
+* [Resource Hooks](resource_hooks.md)
+* [Resource Diffing](diffing.md)
+* [Single Sign On](sso.md)
+* [Webhooks](webhook.md)
+* [RBAC](rbac.md)
+* [Declarative Setup](declarative-setup.md)
+* [Prometheus Metrics](metrics.md)
+* [Custom Tooling](custom_tools.md)
+
+## Other
+* [Security](security.md)
+* [Best Practices](best_practices.md)
+* [Configuring Ingress](ingress.md)
+* [Integration with CI Pipelines](ci_automation.md)
+* [F.A.Q.](faq.md)

docs/SUPPORT.md

@@ -1,6 +0,0 @@
-# Support
-
-1. Make sure you've read [understanding the basics](understand_the_basics.md) the [getting started guide](getting_started.md).
-2. Looked for an answer [the frequently asked questions](faq.md).
-3. Ask a question in [the Argo CD Slack channel ⧉](https://argoproj.github.io/community/join-slack).
-4. [Read issues, report a bug, or request a feature ⧉](https://github.com/argoproj/argo-cd/issues)

docs/application.yaml

@@ -0,0 +1,61 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: guestbook
+spec:
+  # The project the application belongs to.
+  project: default
+
+  # Source of the application manifests
+  source:
+    repoURL: https://github.com/argoproj/argocd-example-apps.git
+    targetRevision: HEAD
+    path: guestbook
+
+    # helm specific config
+    helm:
+      valueFiles:
+      - values-prod.yaml
+
+    # kustomize specific config
+    kustomize:
+      namePrefix: prod-
+
+    # directory
+    directory:
+      recurse: true
+      jsonnet:
+        # A list of Jsonnet External Variables
+        extVars:
+        - name: foo
+          value: bar
+          # You can use "code to determine if the value is either string (false, the default) or Jsonnet code (if code is true).
+        - code: true
+          name: baz
+          value: "true"
+        # A list of Jsonnet Top-level Arguments
+        tlas:
+          - code: false
+            name: foo
+            value: bar
+
+    # plugin specific config
+    plugin:
+    - name: mypluginname
+
+  # Destination cluster and namespace to deploy the application
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: guestbook
+
+  # Sync policy
+  syncPolicy:
+    automated:
+      prune: true
+
+  # Ignore differences at the specified json pointers
+  ignoreDifferences:
+  - group: apps
+    kind: Deployment
+    jsonPointers:
+    - /spec/replicas

docs/application_sources.md

@@ -0,0 +1,136 @@
+# Application Source Types
+
+Argo CD supports several different ways in which kubernetes manifests can be defined:
+
+* [ksonnet](https://ksonnet.io) applications
+* [kustomize](https://kustomize.io) applications
+* [helm](https://helm.sh) charts
+* Directory of YAML/json/jsonnet manifests
+* Any custom config management tool configured as a config management plugin
+
+Some additional considerations should be made when deploying apps of a particular type:
+
+## Ksonnet
+
+### Environments
+Ksonnet has a first class concept of an "environment." To create an application from a ksonnet
+app directory, an environment must be specified. For example, the following command creates the
+"guestbook-default" app, which points to the `default` environment:
+
+```
+argocd app create guestbook-default --repo https://github.com/argoproj/argocd-example-apps.git --path guestbook --env default
+```
+
+### Parameters
+Ksonnet parameters all belong to a component. For example, the following are the parameters
+available in the guestbook app, all of which belong to the `guestbook-ui` component:
+
+```
+$ ks param list
+COMPONENT    PARAM         VALUE
+=========    =====         =====
+guestbook-ui containerPort 80
+guestbook-ui image         "gcr.io/heptio-images/ks-guestbook-demo:0.1"
+guestbook-ui name          "guestbook-ui"
+guestbook-ui replicas      1
+guestbook-ui servicePort   80
+guestbook-ui type          "LoadBalancer"
+```
+
+When overriding ksonnet parameters in Argo CD, the component name should also be specified in the
+`argocd app set` command, in the form of `-p COMPONENT=PARAM=VALUE`. For example:
+```
+argocd app set guestbook-default -p guestbook-ui=image=gcr.io/heptio-images/ks-guestbook-demo:0.1
+```
+
+## Helm
+
+### Values Files
+
+Helm has the ability to use a different, or even multiple "values.yaml" files to derive its
+parameters from. Alternate or multiple values file(s), can be specified using the `--values`
+flag. The flag can be repeated to support multiple values files:
+
+```
+argocd app set helm-guestbook --values values-production.yaml
+```
+
+### Helm Parameters
+
+Helm has the ability to set parameter values, which override any values in
+a `values.yaml`. For example, `service.type` is a common parameter which is exposed in a Helm chart:
+```
+helm template . --set service.type=LoadBalancer
+```
+Similarly Argo CD can override values in the `values.yaml` parameters using `argo app set` command,
+in the form of `-p PARAM=VALUE`. For example:
+```
+argocd app set helm-guestbook -p service.type=LoadBalancer
+```
+
+### Helm Hooks
+
+Helm hooks are equivalent in concept to [Argo CD resource hooks](resource_hooks.md). In helm, a hook
+is any normal kubernetes resource annotated with the `helm.sh/hook` annotation. When Argo CD deploys
+helm application which contains helm hooks, all helm hook resources are currently ignored during
+the `kubectl apply` of the manifests. There is an
+[open issue](https://github.com/argoproj/argo-cd/issues/355) to map Helm hooks to Argo CD's concept
+of Pre/Post/Sync hooks.
+
+### Random Data
+
+Helm templating has the ability to generate random data during chart rendering via the
+`randAlphaNum` function. Many helm charts from the [charts repository](https://github.com/helm/charts)
+make use of this feature. For example, the following is the secret for the
+[redis helm chart](https://github.com/helm/charts/blob/master/stable/redis/templates/secrets.yaml):
+
+```
+data:
+  {{- if .Values.password }}
+  redis-password: {{ .Values.password | b64enc | quote }}
+  {{- else }}
+  redis-password: {{ randAlphaNum 10 | b64enc | quote }}
+  {{- end }}
+```
+
+The Argo CD application controller periodically compares git state against the live state, running
+the `helm template <CHART>` command to generate the helm manifests. Because the random value is
+regenerated every time the comparison is made, any application which makes use of the `randAlphaNum`
+function will always be in an `OutOfSync` state. This can be mitigated by explicitly setting a
+value, in the values.yaml such that the value is stable between each comparison. For example:
+
+```
+argocd app set redis -p password=abc123
+```
+
+## Config Management Plugins
+
+Argo CD allows integrating more config management tools using config management plugins. Following changes are required to configure new plugin:
+
+* Make sure required binaries are available in `argocd-repo-server` pod. The binaries can be added via volume mounts or using custom image (see [custom_tools](custom_tools.md)).
+* Register a new plugin in `argocd-cm` ConfigMap:
+
+```yaml
+data:
+  configManagementPlugins: |
+    - name: pluginName
+      init:                          # Optional command to initialize application source directory
+        command: ["sample command"]
+        args: ["sample args"]
+      generate:                      # Command to generate manifests YAML
+        command: ["sample command"]
+        args: ["sample args"]
+```
+
+The `generate` command must print a valid YAML stream to stdout. Both `init` and `generate` commands are executed inside the application source directory.
+Commands have access to system environment variables and following additional variables:
+
+`ARGOCD_APP_NAME` - name of application; `ARGOCD_APP_NAMESPACE` - destination application namespace
+
+ * Create an application and specify required config management plugin name.
+
+```
+argocd app create <appName> --config-management-plugin <pluginName>
+```
+
+More config management plugin examples are available in [argocd-example-apps](https://github.com/argoproj/argocd-example-apps/tree/master/plugins).

docs/architecture.md

@@ -1,34 +1,32 @@
 
-# Architectural Overview
+# Argo CD - Architectural Overview
 
-![Argo CD Architecture](../assets/argocd_architecture.png)
+![Argo CD Architecture](argocd_architecture.png)
 
 ## Components
 
 ### API Server
 The API server is a gRPC/REST server which exposes the API consumed by the Web UI, CLI, and CI/CD 
 systems. It has the following responsibilities:
-
 * application management and status reporting
 * invoking of application operations (e.g. sync, rollback, user-defined actions)
 * repository and cluster credential management (stored as K8s secrets)
 * authentication and auth delegation to external identity providers
 * RBAC enforcement
-* listener/forwarder for Git webhook events
+* listener/forwarder for git webhook events
 
 ### Repository Server
-The repository server is an internal service which maintains a local cache of the Git repository
+The repository server is an internal service which maintains a local cache of the git repository
 holding the application manifests. It is responsible for generating and returning the Kubernetes
 manifests when provided the following inputs:
-
 * repository URL
-* revision (commit, tag, branch)
+* git revision (commit, tag, branch)
 * application path
 * template specific settings: parameters, ksonnet environments, helm values.yaml
 
 ### Application Controller
 The application controller is a Kubernetes controller which continuously monitors running
 applications and compares the current, live state against the desired target state (as specified in
-the repo). It detects `OutOfSync` application state and optionally takes corrective action. It
-is responsible for invoking any user-defined hooks for lifecycle events (PreSync, Sync, PostSync)
+the git repo). It detects `OutOfSync` application state and optionally takes corrective action. It
+is responsible for invoking any user-defined hooks for lifcecycle events (PreSync, Sync, PostSync)
 

docs/argocd-cm.yaml

@@ -0,0 +1,116 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+data:
+  # Argo CD's externally facing base URL (optional). Required when configuring SSO
+  url: https://argo-cd-demo.argoproj.io
+
+  # A dex connector configuration (optional). See SSO configuration documentation:
+  # https://github.com/argoproj/argo-cd/blob/master/docs/sso.md
+  # https://github.com/dexidp/dex/tree/master/Documentation/connectors
+  dex.config: |
+    connectors:
+      # GitHub example
+      - type: github
+        id: github
+        name: GitHub
+        config:
+          clientID: aabbccddeeff00112233
+          clientSecret: $dex.github.clientSecret
+          orgs:
+          - name: your-github-org
+            teams:
+            - red-team
+
+  # OIDC configuration as an alternative to dex (optional).
+  oidc.config: |
+    name: Okta
+    issuer: https://dev-123456.oktapreview.com
+    clientID: aaaabbbbccccddddeee
+    clientSecret: $oidc.okta.clientSecret
+
+  # Git repositories configure Argo CD with (optional).
+  # This list is updated when configuring/removing repos from the UI/CLI
+  repositories: |
+    - url: https://github.com/argoproj/my-private-repository
+      passwordSecret:
+        name: my-secret
+        key: password
+      usernameSecret:
+        name: my-secret
+        key: username
+      sshPrivateKeySecret:
+        name: my-secret
+        key: sshPrivateKey
+
+  # Non-standard and private Helm repositories (optional).
+  helm.repositories: |
+    - url: https://storage.googleapis.com/istio-prerelease/daily-build/master-latest-daily/charts
+      name: istio.io
+    - url: https://my-private-chart-repo.internal
+      name: private-repo
+      usernameSecret:
+        name: my-secret
+        key: username
+      passwordSecret:
+        name: my-secret
+        key: password
+
+  # Configuration to customize resource behavior (optional). Keys are in the form: group/Kind.
+  resource.customizations: |
+    admissionregistration.k8s.io/MutatingWebhookConfiguration:
+      # List of json pointers in the object to ignore differences
+      ignoreDifferences:
+        jsonPointers:
+        - webhooks/0/clientConfig/caBundle
+    certmanager.k8s.io/Certificate:
+      # Lua script for customizing the health status assessment
+      health.lua: |
+        hs = {}
+        if obj.status ~= nil then
+          if obj.status.conditions ~= nil then
+            for i, condition in ipairs(obj.status.conditions) do
+              if condition.type == "Ready" and condition.status == "False" then
+                hs.status = "Degraded"
+                hs.message = condition.message
+                return hs
+              end
+              if condition.type == "Ready" and condition.status == "True" then
+                hs.status = "Healthy"
+                hs.message = condition.message
+                return hs
+              end
+            end
+          end
+        end
+        hs.status = "Progressing"
+        hs.message = "Waiting for certificate"
+        return hs
+
+  # Configuration to completely ignore entire classes of resource group/kinds (optional).
+  # Excluding high-volume resources improves performance and memory usage, and reduces load and 
+  # bandwidth to the Kubernetes API server.
+  # These are globs, so a "*" will match all values.
+  # If you omit groups/kinds/clusters then they will match all groups/kind/clusters.
+  # NOTE: events.k8s.io and metrics.k8s.io are excluded by default
+  resource.exclusions: |
+    - apiGroups:
+      - repositories.stash.appscode.com
+      kinds:
+      - Snapshot
+      clusters:
+      - "*.local"
+
+  # Configuration to add a config management plugin.
+  configManagementPlugins: |
+    - name: kasane
+      init:
+        command: [kasane, update]
+      generate:
+        command: [kasane, show]
+
+  # The metadata.label key name where Argo CD injects the app name as a tracking label (optional).
+  # Tracking labels are used to determine which resources need to be deleted when pruning.
+  # If omitted, Argo CD injects the app name into the label: 'app.kubernetes.io/instance'
+  application.instanceLabelKey: mycompany.com/appname

docs/argocd-rbac-cm.yaml

@@ -2,17 +2,13 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: argocd-rbac-cm
-  namespace: argocd
-  labels:
-    app.kubernetes.io/name: argocd-rbac-cm
-    app.kubernetes.io/part-of: argocd
 data:
   # policy.csv is an file containing user-defined RBAC policies and role definitions (optional).
   # Policy rules are in the form:
   #   p, subject, resource, action, object, effect
   # Role definitions and bindings are in the form:
   #   g, subject, inherited-subject
-  # See https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/rbac.md for additional information.
+  # See https://github.com/argoproj/argo-cd/blob/master/docs/rbac.md for additional information.
   policy.csv: |
     # Grant all members of the group 'my-org:team-alpha; the ability to sync apps in 'my-project'
     p, my-org:team-alpha, applications, sync, my-project/*, allow
@@ -23,8 +19,3 @@ data:
   # authorizing API requests (optional). If omitted or empty, users may be still be able to login,
   # but will see no apps, projects, etc...
   policy.default: role:readonly
-
-  # scopes controls which OIDC scopes to examine during rbac enforcement (in addition to `sub` scope).
-  # If omitted, defaults to: '[groups]'. The scope value can be a string, or a list of strings.
-  scopes: '[cognito:groups, email]'
-

docs/argocd-secret.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: argocd-secret
+type: Opaque
+data:
+  # TLS certificate and private key for API server (required).
+  # Autogenerated with a self-signed ceritificate when keys are missing or invalid.
+  tls.crt:
+  tls.key:
+
+  # bcrypt hash of the admin password and its last modified time (required).
+  # Autogenerated to be the name of the argocd-server pod when missing.
+  admin.password:
+  admin.passwordMtime:
+
+  # random server signature key for session validation (required).
+  # Autogenerated when missing.
+  server.secretkey:
+
+  # Shared secrets for authenticating GitHub, GitLab, BitBucket webhook events (optional).
+  # See https://github.com/argoproj/argo-cd/blob/master/docs/webhook.md for additional details.
+  github.webhook.secret:
+  gitlab.webhook.secret:
+  bitbucket.webhook.uuid: