docs: bug bounty

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>

.github/ISSUE_TEMPLATE/security_logs.md

@@ -0,0 +1,19 @@
+---
+name: Security log
+about: Propose adding security-related logs or tagging existing logs with security fields
+title: "seclog: [Event Description]"
+labels: security-log
+assignees: notfromstatefarm
+---
+# Event to be logged
+
+Specify the event that needs to be logged or existing logs that need to be tagged.
+
+# Proposed level
+
+What security level should these events be logged under? Refer to https://argo-cd.readthedocs.io/en/latest/operator-manual/security/#security-field for more info.
+
+# Common Weakness Enumeration
+
+Is there an associated [CWE](https://cwe.mitre.org/) that could be tagged as well?
+

.github/workflows/ci-build.yaml

@@ -18,15 +18,18 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   check-go:
     name: Ensure Go modules synchronicity
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: Setup Golang
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@v3
         with:
           go-version: ${{ env.GOLANG_VERSION }}
       - name: Download all Go modules
@@ -39,12 +42,12 @@ jobs:
 
   build-go:
     name: Build & cache Go code
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: Setup Golang
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@v3
         with:
           go-version: ${{ env.GOLANG_VERSION }}
       - name: Restore go build cache
@@ -59,24 +62,27 @@ jobs:
         run: make build-local
 
   lint-go:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for golangci/golangci-lint-action to fetch pull requests
     name: Lint Go code
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: Setup Golang
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@v3
         with:
           go-version: ${{ env.GOLANG_VERSION }}
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v3
         with:
-          version: v1.45.2
+          version: v1.46.2
           args: --timeout 10m --exclude SA5011 --verbose
 
   test-go:
     name: Run unit tests for Go packages
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     needs:
       - build-go
     env:
@@ -86,11 +92,11 @@ jobs:
       - name: Create checkout directory
         run: mkdir -p ~/go/src/github.com/argoproj
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: Create symlink in GOPATH
         run: ln -s $(pwd) ~/go/src/github.com/argoproj/argo-cd
       - name: Setup Golang
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@v3
         with:
           go-version: ${{ env.GOLANG_VERSION }}
       - name: Install required packages
@@ -139,7 +145,7 @@ jobs:
 
   test-go-race:
     name: Run unit tests with -race, for Go packages
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     needs:
       - build-go
     env:
@@ -149,11 +155,11 @@ jobs:
       - name: Create checkout directory
         run: mkdir -p ~/go/src/github.com/argoproj
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: Create symlink in GOPATH
         run: ln -s $(pwd) ~/go/src/github.com/argoproj/argo-cd
       - name: Setup Golang
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@v3
         with:
           go-version: ${{ env.GOLANG_VERSION }}
       - name: Install required packages
@@ -197,12 +203,12 @@ jobs:
 
   codegen:
     name: Check changes to generated code
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: Setup Golang
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@v3
         with:
           go-version: ${{ env.GOLANG_VERSION }}
       - name: Create symlink in GOPATH
@@ -241,10 +247,10 @@ jobs:
 
   build-ui:
     name: Build, test & lint UI code
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: Setup NodeJS
         uses: actions/setup-node@v1
         with:
@@ -273,7 +279,7 @@ jobs:
 
   analyze:
     name: Process & analyze test artifacts
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     needs:
       - test-go
       - build-ui
@@ -281,7 +287,7 @@ jobs:
       sonar_secret: ${{ secrets.SONAR_TOKEN }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
       - name: Restore node dependency cache
@@ -339,10 +345,10 @@ jobs:
 
   test-e2e:
     name: Run end-to-end tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     strategy:
       matrix:
-        k3s-version: [v1.23.3, v1.22.6, v1.21.2]
+        k3s-version: [v1.24.3, v1.23.3, v1.22.6]
     needs: 
       - build-go
     env:
@@ -354,14 +360,15 @@ jobs:
       ARGOCD_E2E_K3S: "true"
       ARGOCD_IN_CI: "true"
       ARGOCD_E2E_APISERVER_PORT: "8088"
+      ARGOCD_APPLICATION_NAMESPACES: "argocd-e2e-external"
       ARGOCD_SERVER: "127.0.0.1:8088"
       GITHUB_TOKEN: ${{ secrets.E2E_TEST_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
       GITLAB_TOKEN: ${{ secrets.E2E_TEST_GITLAB_TOKEN }}  
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: Setup Golang
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@v3
         with:
           go-version: ${{ env.GOLANG_VERSION }}
       - name: GH actions workaround - Kill XSP4 process
@@ -405,9 +412,9 @@ jobs:
           git config --global user.email "john.doe@example.com"
       - name: Pull Docker image required for tests
         run: |
-          docker pull quay.io/dexidp/dex:v2.25.0
+          docker pull ghcr.io/dexidp/dex:v2.35.3-distroless
           docker pull argoproj/argo-cd-ci-builder:v1.0.0
-          docker pull redis:7.0.0-alpine
+          docker pull redis:7.0.5-alpine
       - name: Create target directory for binaries in the build-process
         run: |
           mkdir -p dist

.github/workflows/codeql.yml

@@ -13,20 +13,27 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   CodeQL-Build:
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/autobuild to send a status report
     if: github.repository == 'argoproj/argo-cd'
 
     # CodeQL runs on ubuntu-latest and windows-latest
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
       
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@v2
       # Override language selection by uncommenting this and choosing your languages
       # with:
       #   languages: go, javascript, csharp, python, cpp, java
@@ -34,7 +41,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@v2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -48,4 +55,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@v2

.github/workflows/image.yaml

@@ -16,14 +16,19 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   publish:
+    permissions:
+      contents: write  # for git to push upgrade commit if not already deployed
     if: github.repository == 'argoproj/argo-cd'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     env:
       GOPATH: /home/runner/work/argo-cd/argo-cd
     steps:
-      - uses: actions/setup-go@v1
+      - uses: actions/setup-go@v3
         with:
           go-version: ${{ env.GOLANG_VERSION }}
       - uses: actions/checkout@master
@@ -47,39 +52,8 @@ jobs:
           DOCKER_TOKEN: ${{ secrets.RELEASE_QUAY_TOKEN }}
 
       # build
-      - uses: docker/setup-qemu-action@v1
-      - uses: docker/setup-buildx-action@v1
-
-      - name: Setup cache for argocd-ui docker layer
-        uses: actions/cache@v2
-        with:
-          path: /tmp/.buildx-cache
-          key: ${{ runner.os }}-single-buildx-${{ github.sha }}
-          restore-keys: |
-            ${{ runner.os }}-single-buildx
-
-      - name: Build cache for argocd-ui stage
-        uses: docker/build-push-action@v2
-        with:
-          context: ./src/github.com/argoproj/argo-cd
-          target: argocd-ui
-          push: false
-          cache-from: type=local,src=/tmp/.buildx-cache
-          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
-        if: github.event_name == 'push' || contains(github.event.pull_request.labels.*.name, 'test-arm-image')
-
-      - name: Run non-container Snyk scans
-        if: github.event_name == 'push'
-        working-directory: ./src/github.com/argoproj/argo-cd
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        run: |
-          npm install -g snyk
-
-          # Run with high threshold to fail build.
-          snyk test --org=argoproj --all-projects --exclude=docs,site --severity-threshold=high --policy-path=.snyk
-          snyk iac test manifests/install.yaml --org=argoproj --severity-threshold=high --policy-path=.snyk
-
+      - uses: docker/setup-qemu-action@v2
+      - uses: docker/setup-buildx-action@v2
       - run: |
           IMAGE_PLATFORMS=linux/amd64
           if [[ "${{ github.event_name }}" == "push" || "${{ contains(github.event.pull_request.labels.*.name, 'test-arm-image') }}" == "true" ]]
@@ -88,27 +62,25 @@ jobs:
           fi
           echo "Building image for platforms: $IMAGE_PLATFORMS"
           docker buildx build --platform $IMAGE_PLATFORMS --push="${{ github.event_name == 'push' }}" \
-            --cache-from "type=local,src=/tmp/.buildx-cache" \
             -t ghcr.io/argoproj/argocd:${{ steps.image.outputs.tag }} \
             -t quay.io/argoproj/argocd:latest .
         working-directory: ./src/github.com/argoproj/argo-cd
 
-      - name: Run container Snyk scan
-        if: github.event_name == 'push'
-        working-directory: ./src/github.com/argoproj/argo-cd
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        run: |
-          snyk container test quay.io/argoproj/argocd:latest --org=argoproj --file=Dockerfile --severity-threshold=high
+      # sign container images
+      - name: Install cosign
+        uses: sigstore/cosign-installer@main
+        with:
+          cosign-release: 'v1.13.0'
 
-        # Temp fix
-        # https://github.com/docker/build-push-action/issues/252
-        # https://github.com/moby/buildkit/issues/1896
-      - name: Clean up build cache
+      - name: Sign Argo CD latest image
         run: |
-          rm -rf /tmp/.buildx-cache
-          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
-        if: github.event_name == 'push' || contains(github.event.pull_request.labels.*.name, 'test-arm-image')
+          cosign sign --key env://COSIGN_PRIVATE_KEY quay.io/argoproj/argocd:latest
+          # Displays the public key to share.
+          cosign public-key --key env://COSIGN_PRIVATE_KEY
+        env:
+          COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
+          COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
+        if: ${{ github.event_name == 'push' }}
 
       # deploy
       - run: git clone "https://$TOKEN@github.com/argoproj/argoproj-deployments"

.github/workflows/release.yaml

@@ -14,11 +14,16 @@ on:
 env:
     GOLANG_VERSION: '1.18'
 
+permissions:
+  contents: read
+
 jobs:
   prepare-release:
+    permissions:
+      contents: write # To push changes to release branch
     name: Perform automatic release on trigger ${{ github.ref }}
     if: github.repository == 'argoproj/argo-cd'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     env:
       # The name of the tag as supplied by the GitHub event
       SOURCE_TAG: ${{ github.ref }}
@@ -38,7 +43,7 @@ jobs:
       GIT_EMAIL: argoproj@gmail.com
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -142,7 +147,7 @@ jobs:
           echo "RELEASE_NOTES=${RELEASE_NOTES}" >> $GITHUB_ENV
 
       - name: Setup Golang
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v3
         with:
           go-version: ${{ env.GOLANG_VERSION }}
 
@@ -195,8 +200,8 @@ jobs:
           docker login --username "${DOCKER_USERNAME}" --password "${DOCKER_TOKEN}"
         if: ${{ env.DRY_RUN != 'true' }}
 
-      - uses: docker/setup-qemu-action@v1
-      - uses: docker/setup-buildx-action@v1
+      - uses: docker/setup-qemu-action@v2
+      - uses: docker/setup-buildx-action@v2
       - name: Build and push Docker image for release
         run: |
           set -ue
@@ -209,6 +214,22 @@ jobs:
           ./dist/argocd-linux-amd64 version --client
         if: ${{ env.DRY_RUN != 'true' }}
 
+      - name: Install cosign
+        uses: sigstore/cosign-installer@main
+        with:
+          cosign-release: 'v1.13.0'
+
+      - name: Sign Argo CD container images and assets
+        run: |
+          cosign sign --key env://COSIGN_PRIVATE_KEY ${IMAGE_NAMESPACE}/argocd:v${TARGET_VERSION}
+          cosign sign-blob --key env://COSIGN_PRIVATE_KEY ./dist/argocd-${TARGET_VERSION}-checksums.txt > ./dist/argocd-${TARGET_VERSION}-checksums.sig
+          # Retrieves the public key to release as an asset
+          cosign public-key --key env://COSIGN_PRIVATE_KEY > ./dist/argocd-cosign.pub
+        env:
+          COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
+          COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
+        if: ${{ env.DRY_RUN != 'true' }}
+
       - name: Read release notes file
         id: release-notes
         uses: juliangruber/read-file-action@v1
@@ -265,6 +286,14 @@ jobs:
           cd /tmp && tar -zcf sbom.tar.gz *.spdx
         if: ${{ env.DRY_RUN != 'true' }}
 
+      - name: Sign sbom
+        run: |
+          cosign sign-blob --key env://COSIGN_PRIVATE_KEY /tmp/sbom.tar.gz > /tmp/sbom.tar.gz.sig
+        env:
+          COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
+          COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
+        if: ${{ env.DRY_RUN != 'true' }}
+
       - name: Create GitHub release
         uses: softprops/action-gh-release@v1
         env:
@@ -274,10 +303,12 @@ jobs:
           tag_name: ${{ env.RELEASE_TAG }}
           draft: ${{ env.DRAFT_RELEASE }}
           prerelease: ${{ env.PRE_RELEASE }}
-          body: ${{ steps.release-notes.outputs.content }}
+          generate_release_notes: true
+          body: ${{ steps.release-notes.outputs.content }}  # Pre-pended to the generated notes
           files: |
             dist/argocd-*
             /tmp/sbom.tar.gz
+            /tmp/sbom.tar.gz.sig
         if: ${{ env.DRY_RUN != 'true' }}
 
       - name: Update homebrew formula

.github/workflows/update-snyk.yaml

@@ -0,0 +1,36 @@
+name: Snyk report update
+on:
+  workflow_dispatch: {}
+  schedule:
+    - cron: '0 0 * * 0' # midnight every Sunday
+
+permissions:
+  contents: read
+
+jobs:
+  snyk-report:
+    permissions:
+      contents: write
+      pull-requests: write
+    if: github.repository == 'argoproj/argo-cd'
+    name: Update Snyk report in the docs directory
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build reports
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        run: |
+          make snyk-report
+          pr_branch="snyk-update-$(echo $RANDOM | md5sum | head -c 20)"
+          git checkout -b "$pr_branch"
+          git config --global user.email 'ci@argoproj.com'
+          git config --global user.name 'CI'
+          git add docs/snyk
+          git commit -m "[Bot] Update Snyk reports" --signoff
+          git push --set-upstream origin "$pr_branch"
+          gh pr create -B master -H "$pr_branch" --title '[Bot] docs: Update Snyk report' --body ''

.gitignore

@@ -17,6 +17,7 @@ test-results
 node_modules/
 .kube/
 ./test/cmp/*.sock
+.envrc.remote
 
 # ignore built binaries
 cmd/argocd/argocd

.gitpod.Dockerfile

@@ -5,13 +5,15 @@ USER root
 RUN curl -o /usr/local/bin/kubectl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" && \
     chmod +x /usr/local/bin/kubectl
 
-RUN curl -L https://go.kubebuilder.io/dl/2.3.1/$(go env GOOS)/$(go env GOARCH) | \
+RUN curl -L https://github.com/kubernetes-sigs/kubebuilder/releases/download/v2.3.1/kubebuilder_2.3.1_$(go env GOOS)_$(go env GOARCH).tar.gz | \
     tar -xz -C /tmp/ && mv /tmp/kubebuilder_2.3.1_$(go env GOOS)_$(go env GOARCH) /usr/local/kubebuilder
 
+ENV GOCACHE=/go-build-cache
+
 RUN apt-get install redis-server -y
 RUN go install github.com/mattn/goreman@latest
 
 USER gitpod
 
 ENV ARGOCD_REDIS_LOCAL=true
-ENV KUBECONFIG=/tmp/kubeconfig
+ENV KUBECONFIG=/tmp/kubeconfig

.snyk

@@ -18,5 +18,23 @@ ignore:
     - '*':
         reason: >-
           Code is only run client-side. No risk of directory traversal.
+  SNYK-GOLANG-GITHUBCOMEMICKLEIGORESTFUL-2435653:
+    - '*':
+        reason: >-
+          Argo CD uses go-restful as a transitive dependency of kube-openapi. kube-openapi is used to generate openapi
+          specs. We do not use go-restul at runtime and are therefore not vulnerable to this CORS misconfiguration
+          issue in go-restful.
+  SNYK-JS-FORMIDABLE-2838956:
+    - '*':
+        reason: >-
+          Code is only run client-side. No risk of arbitrary file upload.
+  SNYK-JS-PARSEPATH-2936439:
+    - '*':
+        reason: >-
+          The issue is that, for specific URLs, parse-path may incorrectly identify the "resource" (domain name)
+          portion. For example, in "http://127.0.0.1#@example.com", it identifies "example.com" as the "resource".
+
+          We use parse-path on the client side, but permissions for git URLs are checked server-side. This is a
+          potential usability issue, but it is not a security issue.
 patch: {}
 

CHANGELOG.md

@@ -1,33 +1,208 @@
 # Changelog
 
-## v2.4.0 (Unreleased)
+## v2.4.8 (2022-07-29)
 
-### Web Terminal In Argo CD UI
+### Bug fixes
+
+- feat: support application level extensions (#9923)
+- feat: support multiple extensions per resource group/kind (#9834)
+- fix: extensions is not loading for ConfigMap/Pods (#10010)
+- fix: upgrade moment from 2.29.2 to 2.29.3 (#9330)
+- fix: skip redirect url validation when it's the base href (#10058) (#10116)
+- fix: avoid CVE-2022-28948 (#10093)
+- fix: Set HOST_ARCH for yarn build from platform (#10018)
+
+### Other changes
+
+- chore(deps): bump moment from 2.29.3 to 2.29.4 in /ui (#9897)
+- docs: add OpenSSH breaking change notes (#10104)
+- chore: update parse-url (#10101)
+- docs: add api field example in the appset security doc (#10087)
+- chore: update redis to 7.0.4 avoid CVE-2022-30065 (#10059)
+- docs: add argocd-server grpc metric usage (#10007)
+- chore: upgrade Dex to 2.32.0 (#10036) (#10042)
+- chore: update redis to avoid CVE-2022-2097 (#10031)
+- chore: update haproxy to 2.0.29 for redis-ha (#10045)
+
+## v2.4.7 (2022-07-18)
+
+### Bug fixes
+
+fix: Support files in argocd.argoproj.io/manifest-generate-paths annotation (#9908)
+fix: terminal websocket write lock to avoid races (#10011)
+fix: updated all a tags to Link tags in app summary (#9777)
+fix: e2e test to use func from clusterauth instead creating one with old logic (#9989)
+fix: add missing download CLI tool URL response for ppc64le, s390x (#9983)
+
+### Other
+
+chore: upgrade parse-url to avoid SNYK-JS-PARSEURL-2936249 (#9826)
+docs: use quotes to emphasize that ConfigMap value is a string (#9995)
+docs: document directory app include/exclude fields (#9997)
+docs: simplify Docker toolchain docs (#9966) (#10006)
+docs: supported versions (#9876)
+
+## v2.4.6 (2022-07-12)
+
+### Features
+
+* feat: Treat connection reset as a retryable error (#9739)
+
+### Bug fixes
+
+* fix: 'unexpected reserved bits' breaking web terminal (#9605) (#9895)
+* fix: argocd login just hangs on 2.4.0 #9679 (#9935)
+* fix: CMP manifest generation fails with ENHANCE_YOUR_CALM if over 40s (#9922)
+* fix: NotAfter is not set when ValidFor is set (#9911)
+* fix: add missing download CLI tool link for ppc64le, s390x (#9649)
+* fix: Check tracking annotation for being self-referencing (#9791)
+* fix: Make change of tracking method work at runtime (#9820)
+* fix: argo-cd git submodule is using SSH auth instead of HTTPs (#3118) (#9821)
+
+### Other
+
+* docs: fix typo in Generators-Git.md (#9949)
+* docs: add terminal documentation (#9948)
+* test: Use dedicated multi-arch workloads in e2e tests (#9921)
+* docs: Adding blank line so list is formatted correctly (#9880)
+* docs: small fix for plugin stream filtering (#9871)
+* docs: Document the possibility of rendering Helm charts with Kustomize (#9841)
+* docs: getting started notes on self-signed cert (#9429) (#9784)
+* test: check for error messages from CI env (#9953)
+
+## v2.4.5 (2022-07-12)
+
+### Security fixes
+
+* HIGH: Certificate verification is skipped for connections to OIDC providers ([GHSA-7943-82jg-wmw5](https://github.com/argoproj/argo-cd/security/advisories/GHSA-7943-82jg-wmw5))
+* LOW: A leaked API server encryption key can allow XSS for SSO users ([GHSA-pmjg-52h9-72qv](https://github.com/argoproj/argo-cd/security/advisories/GHSA-pmjg-52h9-72qv))
+
+### Potentially-breaking changes
+
+The fix for GHSA-7943-82jg-wmw5 enables TLS certificate validation by default for connections to OIDC providers. If
+connections to your OIDC provider fails validation, SSO will be broken for your Argo CD instance. You should test 2.4.5
+before upgrading it to production. From the new documentation:
+
+> By default, all connections made by the API server to OIDC providers (either external providers or the bundled Dex
+> instance) must pass certificate validation. These connections occur when getting the OIDC provider's well-known
+> configuration, when getting the OIDC provider's keys, and  when exchanging an authorization code or verifying an ID
+> token as part of an OIDC login flow.
+>
+> Disabling certificate verification might make sense if:
+> * You are using the bundled Dex instance **and** your Argo CD instance has TLS configured with a self-signed certificate
+    >   **and** you understand and accept the risks of skipping OIDC provider cert verification.
+> * You are using an external OIDC provider **and** that provider uses an invalid certificate **and** you cannot solve
+    >   the problem by setting `oidcConfig.rootCA` **and** you understand and accept the risks of skipping OIDC provider cert
+    >   verification.
+>
+> If either of those two applies, then you can disable OIDC provider certificate verification by setting
+> `oidc.tls.insecure.skip.verify` to `"true"` in the `argocd-cm` ConfigMap.
+
+### Bug fixes
+
+* fix: webhook typo in case of error in GetManifests (#9671)
+
+## v2.4.4 (2022-07-07)
+
+### Bug fixes
+
+- fix: missing path segments for git file generator (#9839)
+- fix: make sure api server informer does not stop after setting change (#9842)
+- fix: support resource logs and exec (#9833)
+- fix: configurable CMP tar exclusions (#9675) (#9789)
+- fix: prune any deleted refs before fetching (#9504)
+
+### Other
+
+- test: Remove circular symlinks from testdata (#9886)
+- docs: custom secret must be labeled (#9835)
+- docs: update archlinux install with official package (#9718)
+- docs: explain rightmost git generator path parameter behavior (#9799)
+
+## v2.4.3 (2022-06-27)
+
+### Bug fixes
+
+- fix: respect OIDC providers' supported token signing algorithms (#9433) (#9761)
+- fix websockets for terminal not working on subPath (#9795)
+- fix: avoid closing and re-opening port of api server settings change (#9778)
+- fix: [ArgoCD] Fixing webhook typo in case of error in GetManifests (#9671)
+- fix: overrides should not appear in the manifest cache key (#9601)
+
+## v2.4.2 (2022-06-21)
+
+### Bug fixes
+
+* fix: project filter (#9651) (#9709)
+* fix: broken symlink in Dockerfile (#9674)
+* fix: updated baseHRefRegex to perform lazy match (#9724)
+* fix: updated config file permission requirements for windows (#9666)
+
+### Other
+
+* docs: Update sync-options.md (#9687)
+* test/remote: Allow override of base image (#9734)
+
+## v2.4.1 (2022-06-21)
+
+### Security fixes
+
+* CRITICAL: External URLs for Deployments can include javascript ([GHSA-h4w9-6x78-8vrj](https://github.com/argoproj/argo-cd/security/advisories/GHSA-h4w9-6x78-8vrj))
+* HIGH: Insecure entropy in PKCE/Oauth2/OIDC params ([GHSA-2m7h-86qq-fp4v](https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v))
+* MODERATE: DoS through large directory app manifest files ([GHSA-jhqp-vf4w-rpwq](https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhqp-vf4w-rpwq))
+* MODERATE: Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server ([GHSA-q4w5-4gq2-98vm](https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm))
+
+### Potentially-breaking changes
+
+From the [GHSA-2m7h-86qq-fp4v](https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v) description:
+
+> The patch introduces a new `reposerver.max.combined.directory.manifests.size` config parameter, which you should tune before upgrading in production. It caps the maximum total file size of .yaml/.yml/.json files in directory-type (raw manifest) Applications. The default max is 10M per Application. This max is designed to keep any single app from consuming more than 3G of memory in the repo-server (manifests consume more space in memory than on disk). The 300x ratio assumes a maliciously-crafted manifest file. If you only want to protect against accidental excessive memory use, it is probably safe to use a smaller ratio.
+>
+> If your organization uses directory-type Applications with very many manifests or very large manifests then check the size of those manifests and tune the config parameter before deploying this change to production. When testing, make sure to do a "hard refresh" in either the CLI or UI to test your directory-type App. That will make sure you're using the new max logic instead of relying on cached manifest responses from Redis.
+
+### Other
+
+* test: directory app manifest generation (#9503)
+* chore: Implement tests to validate aws auth retry (#9627)
+* chore: Implement a retry in aws auth command (#9618)
+* test: Remove temp directories from repo server tests (#9501)
+* test: Make context tests idempodent (#9502)
+* test: fix plugin var test for OSX (#9590)
+* docs: Document how to deploy from the root of the git repository (#9632)
+* docs: added environment variables documentation (#8680)
+
+## v2.4.0 (2022-06-10)
+
+### Web Terminal In Argo CD UI
 
 Feature enables engineers to start a shell in the running application container without leaving the web interface. Just find the required Kubernetes
 Pod using the Application Details page, click on it and select the Terminal tab. The shell starts automatically and enables you to execute the required
 commands, and helps to troubleshoot the application state.
 
-### Access Control For Pod Logs & Web Terminal
+### Access Control For Pod Logs & Web Terminal
 
 Argo CD is used to manage the critical infrastructure of multiple organizations, which makes security the top priority of the project. We've listened to
 your feedback and introduced additional access control settings that control access to Kubernetes Pod logs and the new Web Terminal feature.
 
-#### Known UI Issue for Pod Logs Access
+#### Pod Logs UI
 
-Currently, upon pressing the "LOGS" tab in pod view by users who don't have an explicit allow get logs policy, the red "unable to load data: Internal error" is received in the bottom of the screen, and "Failed to load data, please try again" is displayed.
+Since 2.4.9, the LOGS tab in pod view is visible in the UI only for users with explicit allow get logs policy.
+
+#### Known pod logs UI issue prior to 2.4.9
+
+Upon pressing the "LOGS" tab in pod view by users who don't have an explicit allow get logs policy, the red "unable to load data: Internal error" is received in the bottom of the screen, and "Failed to load data, please try again" is displayed.
 
 ### OpenTelemetry Tracing Integration
 
 The new feature allows emitting richer telemetry data that might make identifying performance bottlenecks easier. The new feature is available for argocd-server
 and argocd-repo-server components and can be enabled using the --otlp-address flag.
 
-### Power PC and IBM Z Support
+### Power PC and IBM Z Support
 
 The list of supported architectures has been expanded, and now includes IBM Z (s390x) and PowerPC (ppc64le). Starting with the v2.4 release the official quay.io
 repository is going to have images for amd64, arm64, ppc64le, and s390x architectures.
 
-### Other Notable Changes
+### Other Notable Changes
 
 Overall v2.4 release includes more than 300 hundred commits from nearly 90 contributors. Here is a short sample of the contributions:
 
@@ -36,6 +211,116 @@ Overall v2.4 release includes more than 300 hundred commits from nearly 90 contr
 * Secured Redis connection
 * ApplicationSet Gitea support
 
+## v2.3.7 (2022-07-29)
+
+### Notes
+
+This is mainly a security related release and updates compatibility with Kubernetes 1.24.
+
+**Attention:** The base image for 2.3.x reached end-of-life on July 14, 2022. This release upgraded the base image to Ubuntu 22.04 LTS. The change should have no effect on the majority of users. But if any of your git providers only supports now-deprecated key hash algorithms, then Application syncing might break. See the [2.2-to-2.3 upgrade notes](https://argo-cd.readthedocs.io/en/latest/operator-manual/upgrading/2.2-2.3/#support-for-private-repo-ssh-keys-using-the-sha-1-signature-hash-algorithm-is-removed-in-237) for details and workaround instructions.
+
+### Bug fixes
+
+- fix: skip redirect url validation when it's the base href (#10058) (#10116)
+- fix: upgrade moment from 2.29.2 to 2.29.3 (#9330)
+- fix: avoid CVE-2022-28948 (#10093)
+- fix: use serviceaccount name instead of struct (#9614)
+- fix: create serviceaccount token for v1.24 clusters (#9546)
+
+### Other changes
+
+- test: Remove cluster e2e tests not intended for release-2.3
+- test: Remove circular symlinks from testdata (#9886)
+- chore(deps): bump moment from 2.29.3 to 2.29.4 in /ui (#9897)
+- chore: upgrade moment to latest version to fix CVE (#9005)
+- chore: move dependencies to dev dependencies (#8541)
+- docs: add OpenSSH breaking change notes (#10104)
+- chore: update parse-url (#10101)
+- chore: upgrade base image to 22.04 (#10103)
+- docs: simplify Docker toolchain docs (#9966) (#10006)
+- chore: update redis to 6.2.7 avoid CVE-2022-30065/CVE-2022-2097 (#10062)
+- chore: upgrade Dex to 2.32.0 (#10036) (#10042)
+- chore: update haproxy to 2.0.29 for redis-ha (#10045)
+- test: check for error messages from CI env (#9953)
+
+## v2.3.6 (2022-07-12)
+
+### Security fixes
+
+* HIGH: Certificate verification is skipped for connections to OIDC providers ([GHSA-7943-82jg-wmw5](https://github.com/argoproj/argo-cd/security/advisories/GHSA-7943-82jg-wmw5))
+* LOW: A leaked API server encryption key can allow XSS for SSO users ([GHSA-pmjg-52h9-72qv](https://github.com/argoproj/argo-cd/security/advisories/GHSA-pmjg-52h9-72qv))
+
+### Potentially-breaking changes
+
+The fix for GHSA-7943-82jg-wmw5 enables TLS certificate validation by default for connections to OIDC providers. If
+connections to your OIDC provider fails validation, SSO will be broken for your Argo CD instance. You should test 2.3.6
+before upgrading it to production. From the new documentation:
+
+> By default, all connections made by the API server to OIDC providers (either external providers or the bundled Dex
+> instance) must pass certificate validation. These connections occur when getting the OIDC provider's well-known
+> configuration, when getting the OIDC provider's keys, and  when exchanging an authorization code or verifying an ID
+> token as part of an OIDC login flow.
+>
+> Disabling certificate verification might make sense if:
+> * You are using the bundled Dex instance **and** your Argo CD instance has TLS configured with a self-signed certificate
+    >   **and** you understand and accept the risks of skipping OIDC provider cert verification.
+> * You are using an external OIDC provider **and** that provider uses an invalid certificate **and** you cannot solve
+    >   the problem by setting `oidcConfig.rootCA` **and** you understand and accept the risks of skipping OIDC provider cert
+    >   verification.
+>
+> If either of those two applies, then you can disable OIDC provider certificate verification by setting
+> `oidc.tls.insecure.skip.verify` to `"true"` in the `argocd-cm` ConfigMap.
+
+### Bug fixes
+
+* fix: webhook typo in case of error in GetManifests (#9671)
+
+## v2.3.5 (2022-06-21)
+
+### Security fixes
+
+* CRITICAL: External URLs for Deployments can include javascript ([GHSA-h4w9-6x78-8vrj](https://github.com/argoproj/argo-cd/security/advisories/GHSA-h4w9-6x78-8vrj))
+* HIGH: Insecure entropy in PKCE/Oauth2/OIDC params ([GHSA-2m7h-86qq-fp4v](https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v))
+* MODERATE: DoS through large directory app manifest files ([GHSA-jhqp-vf4w-rpwq](https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhqp-vf4w-rpwq))
+* MODERATE: Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server ([GHSA-q4w5-4gq2-98vm](https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm))
+
+### Potentially-breaking changes
+
+From the [GHSA-2m7h-86qq-fp4v](https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v) description:
+
+> The patch introduces a new `reposerver.max.combined.directory.manifests.size` config parameter, which you should tune before upgrading in production. It caps the maximum total file size of .yaml/.yml/.json files in directory-type (raw manifest) Applications. The default max is 10M per Application. This max is designed to keep any single app from consuming more than 3G of memory in the repo-server (manifests consume more space in memory than on disk). The 300x ratio assumes a maliciously-crafted manifest file. If you only want to protect against accidental excessive memory use, it is probably safe to use a smaller ratio.
+>
+> If your organization uses directory-type Applications with very many manifests or very large manifests then check the size of those manifests and tune the config parameter before deploying this change to production. When testing, make sure to do a "hard refresh" in either the CLI or UI to test your directory-type App. That will make sure you're using the new max logic instead of relying on cached manifest responses from Redis.
+
+### Bug fixes
+
+* fix: missing Helm params (#9565) (#9566)
+
+### Other
+
+* test: directory app manifest generation (#9503)
+* chore: eliminate go-mpatch dependency (#9045)
+* chore: Make unit tests run on platforms other than amd64 (#8995)
+* chore: remove obsolete repo-server unit test (#9559)
+* chore: update golangci-lint (#8988)
+* fix: test race (#9469)
+* chore: upgrade golangci-lint to v1.46.2 (#9448)
+* test: fix ErrorContains (#9445)
+
+## v2.3.4 (2022-05-18)
+
+### Security fixes
+
+- CRITICAL: Argo CD will trust invalid JWT claims if anonymous access is enabled (https://github.com/argoproj/argo-cd/security/advisories/GHSA-r642-gv9p-2wjj)
+- LOW: Login screen allows message spoofing if SSO is enabled (https://github.com/argoproj/argo-cd/security/advisories/GHSA-xmg8-99r8-jc2j)
+- MODERATE: Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server (https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h)
+
+### Bug Fixes
+
+- fix: Fix docs build error (#8895)
+- fix: fix broken monaco editor collapse icons (#8709)
+- chore: upgrade to go 1.17.8 (#8866) (#9004)
+- fix: allow cli/ui to follow logs (#8987) (#9065)
 
 ## v2.3.3 (2022-03-29)
 
@@ -177,6 +462,174 @@ Both bundled Helm and Kustomize binaries have been upgraded to the latest versio
 - refactor: Introduce 'byClusterName' secret index to speedup cluster server URL lookup (#8133)
 - refactor: Move project filtering to server side (#8102)
 
+## v2.2.12 (2022-07-29)
+
+### Notes
+
+This is mainly a security related release and updates compatibility with Kubernetes 1.24.
+
+**Attention:** The base image for 2.2.x reached end-of-life on January 20, 2022. This release upgraded the base image to Ubuntu 22.04 LTS. The change should have no effect on the majority of users. But if any of your git providers only supports now-deprecated key hash algorithms, then Application syncing might break. See the [2.1-to-2.2 upgrade notes](https://argo-cd.readthedocs.io/en/latest/operator-manual/upgrading/2.1-2.2/#support-for-private-repo-ssh-keys-using-the-sha-1-signature-hash-algorithm-is-removed-in-2212) for details and workaround instructions.
+
+### Bug fixes
+
+- fix: create serviceaccount token for v1.24 clusters (#9546)
+- fix: upgrade moment from 2.29.2 to 2.29.3 (#9330)
+- fix: avoid CVE-2022-28948 (#10093)
+
+### Other changes
+
+- chore: Remove deprecated K8s versions from test matrix
+- chore: Go mod tidy
+- test: Remove circular symlinks from testdata (#9886)
+- test: Fix e2e tests for release-2.2 branch
+- chore: bump redoc vesion to avoid CVE-2021-23820 (#8604)
+- chore(deps): bump moment from 2.29.3 to 2.29.4 in /ui (#9897)
+- chore: upgrade moment to latest version to fix CVE (#9005)
+- chore: move dependencies to dev dependencies (#8541)
+- docs: add OpenSSH breaking change notes (#10104)
+- chore: update parse-url (#10101)
+- chore: fix codegen
+- chore: fix codegen
+- chore: upgrade base image to 22.04 (#10105)
+- docs: simplify Docker toolchain docs (#9966) (#10006)
+- chore: update redis to 6.2.7 avoid CVE-2022-30065/CVE-2022-2097 (#10068)
+- chore: upgrade Dex to 2.32.0 (#10036) (#10042)
+- chore: update haproxy to 2.0.29 for redis-ha (#10045)
+- test: check for error messages from CI env (#9953)
+
+## v2.2.11 (2022-07-12)
+
+### Security fixes
+
+* HIGH: Certificate verification is skipped for connections to OIDC providers ([GHSA-7943-82jg-wmw5](https://github.com/argoproj/argo-cd/security/advisories/GHSA-7943-82jg-wmw5))
+* LOW: A leaked API server encryption key can allow XSS for SSO users ([GHSA-pmjg-52h9-72qv](https://github.com/argoproj/argo-cd/security/advisories/GHSA-pmjg-52h9-72qv))
+
+### Potentially-breaking changes
+
+The fix for GHSA-7943-82jg-wmw5 enables TLS certificate validation by default for connections to OIDC providers. If
+connections to your OIDC provider fails validation, SSO will be broken for your Argo CD instance. You should test 2.2.11
+before upgrading it to production. From the new documentation:
+
+> By default, all connections made by the API server to OIDC providers (either external providers or the bundled Dex
+> instance) must pass certificate validation. These connections occur when getting the OIDC provider's well-known
+> configuration, when getting the OIDC provider's keys, and  when exchanging an authorization code or verifying an ID
+> token as part of an OIDC login flow.
+>
+> Disabling certificate verification might make sense if:
+> * You are using the bundled Dex instance **and** your Argo CD instance has TLS configured with a self-signed certificate
+    >   **and** you understand and accept the risks of skipping OIDC provider cert verification.
+> * You are using an external OIDC provider **and** that provider uses an invalid certificate **and** you cannot solve
+    >   the problem by setting `oidcConfig.rootCA` **and** you understand and accept the risks of skipping OIDC provider cert
+    >   verification.
+>
+> If either of those two applies, then you can disable OIDC provider certificate verification by setting
+> `oidc.tls.insecure.skip.verify` to `"true"` in the `argocd-cm` ConfigMap.
+
+### Features
+
+* feat: enable specifying root ca for oidc (#6712)
+
+### Bug fixes
+
+* fix: webhook typo in case of error in GetManifests (#9671)
+
+## v2.2.10 (2022-06-21)
+
+### Security fixes
+
+* CRITICAL: External URLs for Deployments can include javascript ([GHSA-h4w9-6x78-8vrj](https://github.com/argoproj/argo-cd/security/advisories/GHSA-h4w9-6x78-8vrj))
+* HIGH: Insecure entropy in PKCE/Oauth2/OIDC params ([GHSA-2m7h-86qq-fp4v](https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v))
+* MODERATE: DoS through large directory app manifest files ([GHSA-jhqp-vf4w-rpwq](https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhqp-vf4w-rpwq))
+* MODERATE: Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server ([GHSA-q4w5-4gq2-98vm](https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm))
+
+### Potentially-breaking changes
+
+From the [GHSA-2m7h-86qq-fp4v](https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v) description:
+
+> The patch introduces a new `reposerver.max.combined.directory.manifests.size` config parameter, which you should tune before upgrading in production. It caps the maximum total file size of .yaml/.yml/.json files in directory-type (raw manifest) Applications. The default max is 10M per Application. This max is designed to keep any single app from consuming more than 3G of memory in the repo-server (manifests consume more space in memory than on disk). The 300x ratio assumes a maliciously-crafted manifest file. If you only want to protect against accidental excessive memory use, it is probably safe to use a smaller ratio.
+>
+> If your organization uses directory-type Applications with very many manifests or very large manifests then check the size of those manifests and tune the config parameter before deploying this change to production. When testing, make sure to do a "hard refresh" in either the CLI or UI to test your directory-type App. That will make sure you're using the new max logic instead of relying on cached manifest responses from Redis.
+
+### Bug fixes
+
+* fix: missing Helm params (#9565) (#9566)
+
+### Other
+
+* test: directory app manifest generation (#9503)
+* test: fix erroneous test change
+* chore: eliminate go-mpatch dependency (#9045)
+* chore: Make unit tests run on platforms other than amd64 (#8995)
+* chore: remove obsolete repo-server unit test (#9559)
+* chore: upgrade golangci-lint to v1.46.2 (#9448)
+* chore: update golangci-lint (#8988)
+
+## v2.2.9 (2022-05-18)
+
+### Notes
+
+This is a security release. We urge all users of the 2.2.z branch to update as soon as possible. Please refer to the _Security fixes_ section below for more details.
+
+### Security fixes
+
+- CRITICAL: Argo CD will trust invalid JWT claims if anonymous access is enabled (https://github.com/argoproj/argo-cd/security/advisories/GHSA-r642-gv9p-2wjj)
+- LOW: Login screen allows message spoofing if SSO is enabled (https://github.com/argoproj/argo-cd/security/advisories/GHSA-xmg8-99r8-jc2j)
+- MODERATE: Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server (https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h)
+
+## v2.2.8 (2022-03-22)
+
+### Special notes
+
+This release contains the fix for a security issue with critical severity. We recommend users on the 2.2 release branch to update to this release as soon as possible.
+
+More information can be found in the related
+[security advisory](https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pww).
+
+### Changes
+
+As part of the security fix, the Argo CD UI no longer automatically presents child resources of allow-listed resources unless the child resources are also allow-listed. For example, Pods are not going to show up if only Deployment is added to the allow-list.
+
+If you have [projects](https://argo-cd.readthedocs.io/en/stable/user-guide/projects/) configured with allow-lists, make sure the allow-lists include all the resources you want users to be able to view/manage through the UI. For example, if your project allows `Deployments`, you would add `ReplicaSets` and `Pods`.
+
+#### Bug Fixes
+
+- fix: application resource APIs must enforce project restrictions
+
+## v2.2.7 (2022-03-08)
+
+### Bug Fixes
+
+- fix: correct jsonnet paths resolution (#8721)
+
+## v2.2.6 (2022-03-06)
+
+### Bug Fixes
+
+- fix: prevent file traversal using helm file values param and application details api (#8606)
+- fix!: enforce app create/update privileges when getting repo details (#8558)
+- feat: support custom helm values file schemes (#8535)
+
+## v2.2.5 (2022-02-04)
+
+- fix: Resolve symlinked value files correctly (#8387)
+
+## v2.2.4 (2022-02-03)
+
+### Special notes
+
+This release contains the fix for a security issue with high severity. We recommend users on the 2.2 release branch to update to this release as soon as possible.
+
+More information can be found in the related
+[security advisory](https://github.com/argoproj/argo-cd/security/advisories/GHSA-63qx-x74g-jcr7)
+
+### Bug Fixes
+
+- fix: Prevent value files outside repository root
+
+### Other changes
+
+- chore: upgrade dex to v2.30.2 (backport of #8237) (#8257)
+
 ## v2.2.3 (2022-01-18)
 
 - fix: Application exist panic when execute api call (#8188)
@@ -234,6 +687,117 @@ as there are no conflicts with other Kubernetes tools, and you can easily instal
 * Cluster name support in project destinations (#7198)
 * around 30 more features and a total of 84 bug fixes
 
+## v2.1.16 (2022-06-21)
+
+### Security fixes
+
+* CRITICAL: External URLs for Deployments can include javascript ([GHSA-h4w9-6x78-8vrj](https://github.com/argoproj/argo-cd/security/advisories/GHSA-h4w9-6x78-8vrj))
+* HIGH: Insecure entropy in PKCE/Oauth2/OIDC params ([GHSA-2m7h-86qq-fp4v](https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v))
+* MODERATE: DoS through large directory app manifest files ([GHSA-jhqp-vf4w-rpwq](https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhqp-vf4w-rpwq))
+* MODERATE: Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server ([GHSA-q4w5-4gq2-98vm](https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm))
+
+**Note:** This will be the last security fix release in the 2.1.x series. Please [upgrade to a newer minor version](https://argo-cd.readthedocs.io/en/latest/operator-manual/upgrading/overview/) to continue to get security fixes.
+
+### Potentially-breaking changes
+
+From the [GHSA-2m7h-86qq-fp4v](https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v) description:
+
+> The patch introduces a new `reposerver.max.combined.directory.manifests.size` config parameter, which you should tune before upgrading in production. It caps the maximum total file size of .yaml/.yml/.json files in directory-type (raw manifest) Applications. The default max is 10M per Application. This max is designed to keep any single app from consuming more than 3G of memory in the repo-server (manifests consume more space in memory than on disk). The 300x ratio assumes a maliciously-crafted manifest file. If you only want to protect against accidental excessive memory use, it is probably safe to use a smaller ratio.
+>
+> If your organization uses directory-type Applications with very many manifests or very large manifests then check the size of those manifests and tune the config parameter before deploying this change to production. When testing, make sure to do a "hard refresh" in either the CLI or UI to test your directory-type App. That will make sure you're using the new max logic instead of relying on cached manifest responses from Redis.
+
+### Bug fixes
+
+* fix: missing Helm params (#9565) (#9566)
+
+### Other
+
+* test: directory app manifest generation (#9503)
+* test: fix erroneous test change
+* chore: eliminate go-mpatch dependency (#9045)
+* chore: Make unit tests run on platforms other than amd64 (#8995)
+* chore: remove obsolete repo-server unit test (#9559)
+* chore: upgrade golangci-lint to v1.46.2 (#9448)
+* chore: update golangci-lint (#8988)
+* test: fix ErrorContains (#9445)
+
+## v2.1.15 (2022-05-18)
+
+### Notes
+
+This is a security release. We urge all users of the 2.1.z branch to update as soon as possible. Please refer to the _Security fixes_ section below for more details.
+
+### Security fixes
+
+- CRITICAL: Argo CD will trust invalid JWT claims if anonymous access is enabled (https://github.com/argoproj/argo-cd/security/advisories/GHSA-r642-gv9p-2wjj)
+- LOW: Login screen allows message spoofing if SSO is enabled (https://github.com/argoproj/argo-cd/security/advisories/GHSA-xmg8-99r8-jc2j)
+- MODERATE: Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server (https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h)
+
+## v2.1.14 (2022-03-22)
+
+### Special notes
+
+This release contains the fix for a security issue with critical severity. We recommend users on the 2.1 release branch to update to this release as soon as possible.
+
+More information can be found in the related
+[security advisory](https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pww).
+
+### Changes
+
+As part of the security fix, the Argo CD UI no longer automatically presents child resources of allow-listed resources unless the child resources are also allow-listed. For example, Pods are not going to show up if only Deployment is added to the allow-list.
+
+If you have [projects](https://argo-cd.readthedocs.io/en/stable/user-guide/projects/) configured with allow-lists, make sure the allow-lists include all the resources you want users to be able to view/manage through the UI. For example, if your project allows `Deployments`, you would add `ReplicaSets` and `Pods`.
+
+#### Bug Fixes
+
+- fix: application resource APIs must enforce project restrictions
+
+## v2.1.13 (2022-03-22)
+
+Unused release number.
+
+## v2.1.12 (2022-03-08)
+
+### Bug Fixes
+
+- fix: correct jsonnet paths resolution (#8721)
+
+## v2.1.11 (2022-03-06)
+
+### Bug Fixes
+
+- fix: prevent file traversal using helm file values param and application details api (#8606)
+- fix!: enforce app create/update privileges when getting repo details (#8558)
+- feat: support custom helm values file schemes (#8535)
+
+## v2.1.10 (2022-02-04)
+
+### Bug Fixes
+
+- fix: Resolve symlinked value files correctly (#8387)
+
+## v2.1.9 (2022-02-03)
+
+### Special notes
+
+This release contains the fix for a security issue with high severity. We recommend users on the 2.1 release branch to update to this release as soon as possible.
+
+More information can be found in the related
+[security advisory](https://github.com/argoproj/argo-cd/security/advisories/GHSA-63qx-x74g-jcr7)
+
+### Bug Fixes
+
+- fix: Prevent value files outside repository root
+
+## v2.1.8 (2021-12-13)
+
+### Bug Fixes
+
+- fix: issue with keepalive (#7861)
+- fix nil pointer dereference error (#7905)
+- fix: env vars to tune cluster cache were broken (#7779)
+- fix: upgraded gitops engine to v0.4.2 (fixes #7561)
+
 ## v2.1.7 (2021-12-14)
 
 - fix: issue with keepalive (#7861)
@@ -444,7 +1008,7 @@ resources, you will have to adapt your cluster resources allow lists to explicit
 ## v1.8.4 (2021-02-05)
 
 - feat: set X-XSS-Protection while serving static content (#5412)
-- fix: version info should be avaialble if anonymous access is enabled (#5422)
+- fix: version info should be available if anonymous access is enabled (#5422)
 - fix: disable jwt claim audience validation #5381 (#5413)
 - fix: /api/version should not return tools version for unauthenticated requests (#5415)
 - fix: account tokens should be rejected if required capability is disabled (#5414)

Dockerfile

@@ -38,10 +38,11 @@ FROM $BASE_IMAGE AS argocd-base
 
 USER root
 
+ENV ARGOCD_USER_ID=999
 ENV DEBIAN_FRONTEND=noninteractive
 
-RUN groupadd -g 999 argocd && \
-    useradd -r -u 999 -g argocd argocd && \
+RUN groupadd -g $ARGOCD_USER_ID argocd && \
+    useradd -r -u $ARGOCD_USER_ID -g argocd argocd && \
     mkdir -p /home/argocd && \
     chown argocd:0 /home/argocd && \
     chmod g=u /home/argocd && \
@@ -74,7 +75,7 @@ RUN mkdir -p tls && \
 
 ENV USER=argocd
 
-USER 999
+USER $ARGOCD_USER_ID
 WORKDIR /home/argocd
 
 ####################################################################################################
@@ -92,12 +93,13 @@ COPY ["ui/", "."]
 
 ARG ARGO_VERSION=latest
 ENV ARGO_VERSION=$ARGO_VERSION
-RUN HOST_ARCH='amd64' NODE_ENV='production' NODE_ONLINE_ENV='online' NODE_OPTIONS=--max_old_space_size=8192 yarn build
+ARG TARGETARCH
+RUN HOST_ARCH=$TARGETARCH NODE_ENV='production' NODE_ONLINE_ENV='online' NODE_OPTIONS=--max_old_space_size=8192 yarn build
 
 ####################################################################################################
 # Argo CD Build stage which performs the actual build of Argo CD binaries
 ####################################################################################################
-FROM --platform=$BUILDPLATFORM  docker.io/library/golang:1.18 AS argocd-build
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.18 AS argocd-build
 
 WORKDIR /go/src/github.com/argoproj/argo-cd
 
@@ -127,4 +129,4 @@ RUN ln -s /usr/local/bin/argocd /usr/local/bin/argocd-server && \
     ln -s /usr/local/bin/argocd /usr/local/bin/argocd-applicationset-controller && \
     ln -s /usr/local/bin/argocd /usr/local/bin/argocd-k8s-auth
 
-USER 999
+USER $ARGOCD_USER_ID

Makefile

@@ -25,7 +25,7 @@ DOCKER_WORKDIR?=/go/src/github.com/argoproj/argo-cd
 
 ARGOCD_PROCFILE?=Procfile
 
-# Strict mode has been disabled in latest versions of mkdocs-material. 
+# Strict mode has been disabled in latest versions of mkdocs-material.
 # Thus pointing to the older image of mkdocs-material matching the version used by argo-cd.
 MKDOCS_DOCKER_IMAGE?=squidfunk/mkdocs-material:4.1.1
 MKDOCS_RUN_ARGS?=
@@ -47,7 +47,7 @@ ARGOCD_E2E_DEX_PORT?=5556
 ARGOCD_E2E_YARN_HOST?=localhost
 ARGOCD_E2E_DISABLE_AUTH?=
 
-ARGOCD_E2E_TEST_TIMEOUT?=30m
+ARGOCD_E2E_TEST_TIMEOUT?=45m
 
 ARGOCD_IN_CI?=false
 ARGOCD_TEST_E2E?=true
@@ -81,6 +81,8 @@ define run-in-test-server
 		-e ARGOCD_TLS_DATA_PATH=${ARGOCD_TLS_DATA_PATH:-/tmp/argocd-local/tls} \
 		-e ARGOCD_SSH_DATA_PATH=${ARGOCD_SSH_DATA_PATH:-/tmp/argocd-local/ssh} \
 		-e ARGOCD_GPG_DATA_PATH=${ARGOCD_GPG_DATA_PATH:-/tmp/argocd-local/gpg/source} \
+		-e ARGOCD_APPLICATION_NAMESPACES \
+		-e GITHUB_TOKEN \
 		-v ${DOCKER_SRC_MOUNT} \
 		-v ${GOPATH}/pkg/mod:/go/pkg/mod${VOLUME_MOUNT} \
 		-v ${GOCACHE}:/tmp/go-build-cache${VOLUME_MOUNT} \
@@ -102,6 +104,7 @@ define run-in-test-client
 		-e HOME=/home/user \
 		-e GOPATH=/go \
 		-e ARGOCD_E2E_K3S=$(ARGOCD_E2E_K3S) \
+		-e GITHUB_TOKEN \
 		-e GOCACHE=/tmp/go-build-cache \
 		-e ARGOCD_LINT_GOGC=$(ARGOCD_LINT_GOGC) \
 		-v ${DOCKER_SRC_MOUNT} \
@@ -114,9 +117,9 @@ define run-in-test-client
 		bash -c "$(1)"
 endef
 
-# 
+#
 define exec-in-test-server
-	docker exec -it -u $(shell id -u):$(shell id -g) -e ARGOCD_E2E_K3S=$(ARGOCD_E2E_K3S) argocd-test-server $(1)
+	docker exec -it -u $(shell id -u):$(shell id -g) -e ARGOCD_E2E_RECORD=$(ARGOCD_E2E_RECORD) -e ARGOCD_E2E_K3S=$(ARGOCD_E2E_K3S) argocd-test-server $(1)
 endef
 
 PATH:=$(PATH):$(PWD)/hack
@@ -205,7 +208,7 @@ clientgen: ensure-gopath
 
 .PHONY: clidocsgen
 clidocsgen: ensure-gopath
-	go run tools/cmd-docs/main.go	
+	go run tools/cmd-docs/main.go
 
 
 .PHONY: codegen-local
@@ -240,8 +243,10 @@ release-cli: clean-debug build-ui
 
 .PHONY: test-tools-image
 test-tools-image:
+ifndef SKIP_TEST_TOOLS_IMAGE
 	docker build --build-arg UID=$(shell id -u) -t $(TEST_TOOLS_PREFIX)$(TEST_TOOLS_IMAGE) -f test/container/Dockerfile .
 	docker tag $(TEST_TOOLS_PREFIX)$(TEST_TOOLS_IMAGE) $(TEST_TOOLS_PREFIX)$(TEST_TOOLS_IMAGE):$(TEST_TOOLS_TAG)
+endif
 
 .PHONY: manifests-local
 manifests-local:
@@ -281,7 +286,7 @@ ifeq ($(DEV_IMAGE), true)
 # the dist directory is under .dockerignore.
 IMAGE_TAG="dev-$(shell git describe --always --dirty)"
 image: build-ui
-	DOCKER_BUILDKIT=1 docker build -t argocd-base --target argocd-base .
+	DOCKER_BUILDKIT=1 docker build --platform=linux/amd64 -t argocd-base --target argocd-base .
 	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -v -ldflags '${LDFLAGS}' -o ${DIST_DIR}/argocd ./cmd
 	ln -sfn ${DIST_DIR}/argocd ${DIST_DIR}/argocd-server
 	ln -sfn ${DIST_DIR}/argocd ${DIST_DIR}/argocd-application-controller
@@ -289,7 +294,7 @@ image: build-ui
 	ln -sfn ${DIST_DIR}/argocd ${DIST_DIR}/argocd-cmp-server
 	ln -sfn ${DIST_DIR}/argocd ${DIST_DIR}/argocd-dex
 	cp Dockerfile.dev dist
-	docker build -t $(IMAGE_PREFIX)argocd:$(IMAGE_TAG) -f dist/Dockerfile.dev dist
+	DOCKER_BUILDKIT=1 docker build --platform=linux/amd64 -t $(IMAGE_PREFIX)argocd:$(IMAGE_TAG) -f dist/Dockerfile.dev dist
 else
 image:
 	DOCKER_BUILDKIT=1 docker build -t $(IMAGE_PREFIX)argocd:$(IMAGE_TAG) .
@@ -337,7 +342,7 @@ lint-local:
 	golangci-lint --version
 	# NOTE: If you get a "Killed" OOM message, try reducing the value of GOGC
 	# See https://github.com/golangci/golangci-lint#memory-usage-of-golangci-lint
-	GOGC=$(ARGOCD_LINT_GOGC) GOMAXPROCS=2 golangci-lint run --fix --verbose --timeout 300s
+	GOGC=$(ARGOCD_LINT_GOGC) GOMAXPROCS=2 golangci-lint run --fix --verbose --timeout 3000s
 
 .PHONY: lint-ui
 lint-ui: test-tools-image
@@ -401,7 +406,7 @@ test-e2e:
 test-e2e-local: cli-local
 	# NO_PROXY ensures all tests don't go out through a proxy if one is configured on the test system
 	export GO111MODULE=off
-	ARGOCD_GPG_ENABLED=true NO_PROXY=* ./hack/test.sh -timeout $(ARGOCD_E2E_TEST_TIMEOUT) -v ./test/e2e
+	ARGOCD_E2E_RECORD=${ARGOCD_E2E_RECORD} ARGOCD_GPG_ENABLED=true NO_PROXY=* ./hack/test.sh -timeout $(ARGOCD_E2E_TEST_TIMEOUT) -v ./test/e2e
 
 # Spawns a shell in the test server container for debugging purposes
 debug-test-server: test-tools-image
@@ -422,6 +427,7 @@ start-e2e: test-tools-image
 .PHONY: start-e2e-local
 start-e2e-local: mod-vendor-local dep-ui-local cli-local
 	kubectl create ns argocd-e2e || true
+	kubectl create ns argocd-e2e-external || true
 	kubectl config set-context --current --namespace=argocd-e2e
 	kustomize build test/manifests/base | kubectl apply -f -
 	kubectl apply -f https://raw.githubusercontent.com/open-cluster-management/api/a6845f2ebcb186ec26b832f60c988537a58f3859/cluster/v1alpha1/0000_04_clusters.open-cluster-management.io_placementdecisions.crd.yaml
@@ -442,13 +448,14 @@ start-e2e-local: mod-vendor-local dep-ui-local cli-local
 	ARGOCD_ZJWT_FEATURE_FLAG=always \
 	ARGOCD_IN_CI=$(ARGOCD_IN_CI) \
 	BIN_MODE=$(ARGOCD_BIN_MODE) \
+	ARGOCD_APPLICATION_NAMESPACES=argocd-e2e-external \
 	ARGOCD_E2E_TEST=true \
 		goreman -f $(ARGOCD_PROCFILE) start ${ARGOCD_START}
 
 # Cleans VSCode debug.test files from sub-dirs to prevent them from being included in by golang embed
 .PHONY: clean-debug
 clean-debug:
-	-find ${CURRENT_DIR} -name debug.test | xargs rm -f
+	-find ${CURRENT_DIR} -name debug.test -exec rm -f {} +
 
 .PHONY: clean
 clean: clean-debug
@@ -461,7 +468,7 @@ start: test-tools-image
 
 # Starts a local instance of ArgoCD
 .PHONY: start-local
-start-local: mod-vendor-local dep-ui-local
+start-local: mod-vendor-local dep-ui-local cli-local
 	# check we can connect to Docker to start Redis
 	killall goreman || true
 	kubectl create ns argocd || true
@@ -473,6 +480,7 @@ start-local: mod-vendor-local dep-ui-local
 	ARGOCD_IN_CI=false \
 	ARGOCD_GPG_ENABLED=$(ARGOCD_GPG_ENABLED) \
 	ARGOCD_E2E_TEST=false \
+	ARGOCD_APPLICATION_NAMESPACES=$(ARGOCD_APPLICATION_NAMESPACES) \
 		goreman -f $(ARGOCD_PROCFILE) start ${ARGOCD_START}
 
 # Run goreman start with exclude option , provide exclude env variable with list of services
@@ -568,4 +576,16 @@ applicationset-controller:
 
 .PHONY: checksums
 checksums:
-	for f in ./dist/$(BIN_NAME)-*; do openssl dgst -sha256 "$$f" | awk ' { print $$2 }' > "$$f".sha256 ; done
+	sha256sum ./dist/$(BIN_NAME)-* | awk -F './dist/' '{print $$1 $$2}' > ./dist/$(BIN_NAME)-$(TARGET_VERSION)-checksums.txt
+
+.PHONY: snyk-container-tests
+snyk-container-tests:
+	./hack/snyk-container-tests.sh
+
+.PHONY: snyk-non-container-tests
+snyk-non-container-tests:
+	./hack/snyk-non-container-tests.sh
+
+.PHONY: snyk-report
+snyk-report:
+	./hack/snyk-report.sh $(target_branch)

Procfile

@@ -1,7 +1,7 @@
-controller: [ "$BIN_MODE" == 'true' ] && COMMAND=./dist/argocd || COMMAND='go run ./cmd/main.go' && sh -c "FORCE_LOG_COLORS=1 ARGOCD_FAKE_IN_CLUSTER=true ARGOCD_TLS_DATA_PATH=${ARGOCD_TLS_DATA_PATH:-/tmp/argocd-local/tls} ARGOCD_SSH_DATA_PATH=${ARGOCD_SSH_DATA_PATH:-/tmp/argocd-local/ssh} ARGOCD_BINARY_NAME=argocd-application-controller $COMMAND --loglevel debug --redis localhost:${ARGOCD_E2E_REDIS_PORT:-6379} --repo-server localhost:${ARGOCD_E2E_REPOSERVER_PORT:-8081} --otlp-address=${ARGOCD_OTLP_ADDRESS}"
-api-server: [ "$BIN_MODE" == 'true' ] && COMMAND=./dist/argocd || COMMAND='go run ./cmd/main.go' && sh -c "FORCE_LOG_COLORS=1 ARGOCD_FAKE_IN_CLUSTER=true ARGOCD_TLS_DATA_PATH=${ARGOCD_TLS_DATA_PATH:-/tmp/argocd-local/tls} ARGOCD_SSH_DATA_PATH=${ARGOCD_SSH_DATA_PATH:-/tmp/argocd-local/ssh} ARGOCD_BINARY_NAME=argocd-server $COMMAND --loglevel debug --redis localhost:${ARGOCD_E2E_REDIS_PORT:-6379} --disable-auth=${ARGOCD_E2E_DISABLE_AUTH:-'true'} --insecure --dex-server http://localhost:${ARGOCD_E2E_DEX_PORT:-5556} --repo-server localhost:${ARGOCD_E2E_REPOSERVER_PORT:-8081} --port ${ARGOCD_E2E_APISERVER_PORT:-8080} --otlp-address=${ARGOCD_OTLP_ADDRESS}"
-dex: sh -c "ARGOCD_BINARY_NAME=argocd-dex go run github.com/argoproj/argo-cd/v2/cmd gendexcfg -o `pwd`/dist/dex.yaml && docker run --rm -p ${ARGOCD_E2E_DEX_PORT:-5556}:${ARGOCD_E2E_DEX_PORT:-5556} -v `pwd`/dist/dex.yaml:/dex.yaml ghcr.io/dexidp/dex:v2.30.2 dex serve /dex.yaml"
-redis: bash -c "if [ \"$ARGOCD_REDIS_LOCAL\" == 'true' ]; then redis-server --save '' --appendonly no --port ${ARGOCD_E2E_REDIS_PORT:-6379}; else docker run --rm --name argocd-redis -i -p ${ARGOCD_E2E_REDIS_PORT:-6379}:${ARGOCD_E2E_REDIS_PORT:-6379} redis:7.0.0-alpine --save '' --appendonly no --port ${ARGOCD_E2E_REDIS_PORT:-6379}; fi"
+controller: [ "$BIN_MODE" == 'true' ] && COMMAND=./dist/argocd || COMMAND='go run ./cmd/main.go' && sh -c "FORCE_LOG_COLORS=1 ARGOCD_FAKE_IN_CLUSTER=true ARGOCD_TLS_DATA_PATH=${ARGOCD_TLS_DATA_PATH:-/tmp/argocd-local/tls} ARGOCD_SSH_DATA_PATH=${ARGOCD_SSH_DATA_PATH:-/tmp/argocd-local/ssh} ARGOCD_BINARY_NAME=argocd-application-controller $COMMAND --loglevel debug --redis localhost:${ARGOCD_E2E_REDIS_PORT:-6379} --repo-server localhost:${ARGOCD_E2E_REPOSERVER_PORT:-8081} --otlp-address=${ARGOCD_OTLP_ADDRESS} --application-namespaces=${ARGOCD_APPLICATION_NAMESPACES:-''}"
+api-server: [ "$BIN_MODE" == 'true' ] && COMMAND=./dist/argocd || COMMAND='go run ./cmd/main.go' && sh -c "FORCE_LOG_COLORS=1 ARGOCD_FAKE_IN_CLUSTER=true ARGOCD_TLS_DATA_PATH=${ARGOCD_TLS_DATA_PATH:-/tmp/argocd-local/tls} ARGOCD_SSH_DATA_PATH=${ARGOCD_SSH_DATA_PATH:-/tmp/argocd-local/ssh} ARGOCD_BINARY_NAME=argocd-server $COMMAND --loglevel debug --redis localhost:${ARGOCD_E2E_REDIS_PORT:-6379} --disable-auth=${ARGOCD_E2E_DISABLE_AUTH:-'true'} --insecure --dex-server http://localhost:${ARGOCD_E2E_DEX_PORT:-5556} --repo-server localhost:${ARGOCD_E2E_REPOSERVER_PORT:-8081} --port ${ARGOCD_E2E_APISERVER_PORT:-8080} --otlp-address=${ARGOCD_OTLP_ADDRESS} --application-namespaces=${ARGOCD_APPLICATION_NAMESPACES:-''}"
+dex: sh -c "ARGOCD_BINARY_NAME=argocd-dex go run github.com/argoproj/argo-cd/v2/cmd gendexcfg -o `pwd`/dist/dex.yaml && docker run --rm -p ${ARGOCD_E2E_DEX_PORT:-5556}:${ARGOCD_E2E_DEX_PORT:-5556} -v `pwd`/dist/dex.yaml:/dex.yaml ghcr.io/dexidp/dex:$(grep "image: ghcr.io/dexidp/dex" manifests/base/dex/argocd-dex-server-deployment.yaml | cut -d':' -f3) dex serve /dex.yaml"
+redis: bash -c "if [ \"$ARGOCD_REDIS_LOCAL\" == 'true' ]; then redis-server --save '' --appendonly no --port ${ARGOCD_E2E_REDIS_PORT:-6379}; else docker run --rm --name argocd-redis -i -p ${ARGOCD_E2E_REDIS_PORT:-6379}:${ARGOCD_E2E_REDIS_PORT:-6379} redis:$(grep "image: redis" manifests/base/redis/argocd-redis-deployment.yaml | cut -d':' -f3) --save '' --appendonly no --port ${ARGOCD_E2E_REDIS_PORT:-6379}; fi"
 repo-server: [ "$BIN_MODE" == 'true' ] && COMMAND=./dist/argocd || COMMAND='go run ./cmd/main.go' && sh -c "FORCE_LOG_COLORS=1 ARGOCD_FAKE_IN_CLUSTER=true ARGOCD_GNUPGHOME=${ARGOCD_GNUPGHOME:-/tmp/argocd-local/gpg/keys} ARGOCD_PLUGINSOCKFILEPATH=${ARGOCD_PLUGINSOCKFILEPATH:-./test/cmp}  ARGOCD_GPG_DATA_PATH=${ARGOCD_GPG_DATA_PATH:-/tmp/argocd-local/gpg/source} ARGOCD_TLS_DATA_PATH=${ARGOCD_TLS_DATA_PATH:-/tmp/argocd-local/tls} ARGOCD_SSH_DATA_PATH=${ARGOCD_SSH_DATA_PATH:-/tmp/argocd-local/ssh} ARGOCD_BINARY_NAME=argocd-repo-server ARGOCD_GPG_ENABLED=${ARGOCD_GPG_ENABLED:-false} $COMMAND --loglevel debug --port ${ARGOCD_E2E_REPOSERVER_PORT:-8081} --redis localhost:${ARGOCD_E2E_REDIS_PORT:-6379} --otlp-address=${ARGOCD_OTLP_ADDRESS}"
 cmp-server: [ "$ARGOCD_E2E_TEST" == 'true' ] && exit 0 || [ "$BIN_MODE" == 'true' ] && COMMAND=./dist/argocd || COMMAND='go run ./cmd/main.go' && sh -c "FORCE_LOG_COLORS=1 ARGOCD_FAKE_IN_CLUSTER=true ARGOCD_BINARY_NAME=argocd-cmp-server ARGOCD_PLUGINSOCKFILEPATH=${ARGOCD_PLUGINSOCKFILEPATH:-./test/cmp} $COMMAND --config-dir-path ./test/cmp --loglevel debug --otlp-address=${ARGOCD_OTLP_ADDRESS}"
 ui: sh -c 'cd ui && ${ARGOCD_E2E_YARN_CMD:-yarn} start'

README.md

@@ -1,4 +1,5 @@
 [![Integration tests](https://github.com/argoproj/argo-cd/workflows/Integration%20tests/badge.svg?branch=master)](https://github.com/argoproj/argo-cd/actions?query=workflow%3A%22Integration+tests%22) [![slack](https://img.shields.io/badge/slack-argoproj-brightgreen.svg?logo=slack)](https://argoproj.github.io/community/join-slack) [![codecov](https://codecov.io/gh/argoproj/argo-cd/branch/master/graph/badge.svg)](https://codecov.io/gh/argoproj/argo-cd) [![Release Version](https://img.shields.io/github/v/release/argoproj/argo-cd?label=argo-cd)](https://github.com/argoproj/argo-cd/releases/latest) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/4486/badge)](https://bestpractices.coreinfrastructure.org/projects/4486) [![Twitter Follow](https://img.shields.io/twitter/follow/argoproj?style=social)](https://twitter.com/argoproj)
+[![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/argo-cd)](https://artifacthub.io/packages/helm/argo/argo-cd)
 
 # Argo CD - Declarative Continuous Delivery for Kubernetes
 

USERS.md

@@ -1,6 +1,7 @@
 ## Who uses Argo CD?
 
-As the Argo Community grows, we'd like to keep track of our users. Please send a PR with your organization name if you are using Argo CD.
+As the Argo Community grows, we'd like to keep track of our users. Please send a
+PR with your organization name if you are using Argo CD.
 
 Currently, the following organizations are **officially** using Argo CD:
 
@@ -8,6 +9,7 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [3Rein](https://www.3rein.com/)
 1. [7shifts](https://www.7shifts.com/)
 1. [Adevinta](https://www.adevinta.com/)
+1. [Adfinis](https://adfinis.com)
 1. [Adventure](https://jp.adventurekk.com/)
 1. [Akuity](https://akuity.io/)
 1. [Alibaba Group](https://www.alibabagroup.com/)
@@ -17,7 +19,7 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Ant Group](https://www.antgroup.com/)
 1. [AppDirect](https://www.appdirect.com)
 1. [Arctiq Inc.](https://www.arctiq.ca)
-1. [ARZ Allgemeines Rechenzentrum GmbH ](https://www.arz.at/)
+1. [ARZ Allgemeines Rechenzentrum GmbH](https://www.arz.at/)
 1. [Axual B.V.](https://axual.com)
 1. [Baloise](https://www.baloise.com)
 1. [BCDevExchange DevOps Platform](https://bcdevexchange.org/DevOpsPlatform)
@@ -29,17 +31,21 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [BMW Group](https://www.bmwgroup.com/)
 1. [Boozt](https://www.booztgroup.com/)
 1. [Boticario](https://www.boticario.com.br/)
+1. [Bulder Bank](https://bulderbank.no)
 1. [Camptocamp](https://camptocamp.com)
 1. [Capital One](https://www.capitalone.com)
 1. [CARFAX](https://www.carfax.com)
 1. [Casavo](https://casavo.com)
 1. [Celonis](https://www.celonis.com/)
+1. [CERN](https://home.cern/)
 1. [Chargetrip](https://chargetrip.com)
 1. [Chime](https://www.chime.com)
 1. [Cisco ET&I](https://eti.cisco.com/)
+1. [Cobalt](https://www.cobalt.io/)
 1. [Codefresh](https://www.codefresh.io/)
 1. [Codility](https://www.codility.com/)
 1. [Commonbond](https://commonbond.co/)
+1. [Coralogix](https://coralogix.com/)
 1. [CROZ d.o.o.](https://croz.net/)
 1. [Crédit Agricole CIB](https://www.ca-cib.com)
 1. [CyberAgent](https://www.cyberagent.co.jp/en/)
@@ -47,32 +53,43 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [D2iQ](https://www.d2iq.com)
 1. [Datarisk](https://www.datarisk.io/)
 1. [Deloitte](https://www.deloitte.com/)
+1. [Deutsche Telekom AG](https://telekom.com)
 1. [Devopsi - Poland Software/DevOps Consulting](https://devopsi.pl/)
 1. [Devtron Labs](https://github.com/devtron-labs/devtron)
 1. [EDF Renewables](https://www.edf-re.com/)
 1. [edX](https://edx.org)
-1. [Electronic Arts Inc. ](https://www.ea.com)
+1. [Elastic](https://elastic.co/)
+1. [Electronic Arts Inc.](https://www.ea.com)
+1. [Elementor](https://elementor.com/)
 1. [Elium](https://www.elium.com)
 1. [END.](https://www.endclothing.com/)
 1. [Energisme](https://energisme.com/)
+1. [enigmo](https://enigmo.co.jp/)
 1. [Faro](https://www.faro.com/)
 1. [Fave](https://myfave.com)
 1. [Flip](https://flip.id)
 1. [Fonoa](https://www.fonoa.com/)
 1. [freee](https://corp.freee.co.jp/en/company/)
+1. [Freshop, Inc](https://www.freshop.com/)
 1. [Future PLC](https://www.futureplc.com/)
 1. [G DATA CyberDefense AG](https://www.gdata-software.com/)
 1. [Garner](https://www.garnercorp.com)
 1. [Generali Deutschland AG](https://www.generali.de/)
+2. [Gepardec](https://gepardec.com/)
 1. [Gitpod](https://www.gitpod.io)
 1. [Gllue](https://gllue.com)
+1. [gloat](https://gloat.com/)
+1. [GLOBIS](https://globis.com)
 1. [Glovo](https://www.glovoapp.com)
 1. [GMETRI](https://gmetri.com/)
 1. [Gojek](https://www.gojek.io/)
 1. [Greenpass](https://www.greenpass.com.br/)
+1. [Gridfuse](https://gridfuse.com/)
+1. [Grupo MasMovil](https://grupomasmovil.com/en/)
 1. [Handelsbanken](https://www.handelsbanken.se)
 1. [Healy](https://www.healyworld.net)
 1. [Helio](https://helio.exchange)
+1. [Hetki](https://hetki.ai)
 1. [hipages](https://hipages.com.au/)
 1. [Hiya](https://hiya.com)
 1. [Honestbank](https://honestbank.com)
@@ -86,6 +103,7 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Joblift](https://joblift.com/)
 1. [JovianX](https://www.jovianx.com/)
 1. [Kaltura](https://corp.kaltura.com/)
+1. [Kandji](https://www.kandji.io/)
 1. [KarrotPay](https://www.daangnpay.com/)
 1. [Karrot](https://www.daangn.com/)
 1. [Kasa](https://kasa.co.kr/)
@@ -95,10 +113,13 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [KintoHub](https://www.kintohub.com/)
 1. [KompiTech GmbH](https://www.kompitech.com/)
 1. [KubeSphere](https://github.com/kubesphere)
+1. [Kurly](https://www.kurly.com/)
 1. [LexisNexis](https://www.lexisnexis.com/)
+1. [Lian Chu Securities](https://lczq.com)
 1. [Lightricks](https://www.lightricks.com/)
 1. [LINE](https://linecorp.com/en/)
 1. [Lytt](https://www.lytt.co/)
+1. [Magic Leap](https://www.magicleap.com/)
 1. [Majid Al Futtaim](https://www.majidalfuttaim.com/)
 1. [Major League Baseball](https://mlb.com)
 1. [Mambu](https://www.mambu.com/)
@@ -106,6 +127,7 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Mattermost](https://www.mattermost.com)
 1. [Max Kelsen](https://www.maxkelsen.com/)
 1. [MeDirect](https://medirect.com.mt/)
+1. [Meican](https://meican.com/)
 1. [Metanet](http://www.metanet.co.kr/en/)
 1. [MindSpore](https://mindspore.cn)
 1. [Mirantis](https://mirantis.com/)
@@ -115,10 +137,12 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [MOO Print](https://www.moo.com/)
 1. [MTN Group](https://www.mtn.com/)
 1. [Natura &Co](https://naturaeco.com/)
+1. [Nethopper](https://nethopper.io)
 1. [New Relic](https://newrelic.com/)
 1. [Nextdoor](https://nextdoor.com/)
 1. [Nikkei](https://www.nikkei.co.jp/nikkeiinfo/en/)
 1. [Nitro](https://gonitro.com)
+1. [OCCMundial](https://occ.com.mx)
 1. [Octadesk](https://octadesk.com)
 1. [omegaUp](https://omegaUp.com)
 1. [openEuler](https://openeuler.org)
@@ -126,22 +150,29 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [openLooKeng](https://openlookeng.io)
 1. [OpenSaaS Studio](https://opensaas.studio)
 1. [Opensurvey](https://www.opensurvey.co.kr/)
+1. [OpsVerse](https://opsverse.io)
 1. [Optoro](https://www.optoro.com/)
 1. [Orbital Insight](https://orbitalinsight.com/)
 1. [p3r](https://www.p3r.one/)
 1. [Packlink](https://www.packlink.com/)
+1. [Pandosearch](https://www.pandosearch.com/en/home)
+1. [PagerDuty](https://www.pagerduty.com/)
 1. [PayPay](https://paypay.ne.jp/)
 1. [Peloton Interactive](https://www.onepeloton.com/)
 1. [Pipefy](https://www.pipefy.com/)
+1. [Pismo](https://pismo.io/)
 1. [Polarpoint.io](https://polarpoint.io)
 1. [Preferred Networks](https://preferred.jp/en/)
+1. [Productboard](https://www.productboard.com/)
 1. [Prudential](https://prudential.com.sg)
 1. [PUBG](https://www.pubg.com)
 1. [Qonto](https://qonto.com)
 1. [QuintoAndar](https://quintoandar.com.br)
 1. [Quipper](https://www.quipper.com/)
+1. [RapidAPI](https://www.rapidapi.com/)
 1. [Recreation.gov](https://www.recreation.gov/)
 1. [Red Hat](https://www.redhat.com/)
+1. [reev.com](https://www.reev.com/)
 1. [RightRev](https://rightrev.com/)
 1. [Rise](https://www.risecard.eu/)
 1. [Riskified](https://www.riskified.com/)
@@ -156,8 +187,11 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Smilee.io](https://smilee.io)
 1. [Snapp](https://snapp.ir/)
 1. [Snyk](https://snyk.io/)
+1. [Softway Medical](https://www.softwaymedical.fr/)
+1. [South China Morning Post (SCMP)](https://www.scmp.com/)
 1. [Speee](https://speee.jp/)
 1. [Spendesk](https://spendesk.com/)
+1. [Splunk](https://splunk.com/)
 1. [Spores Labs](https://spores.app)
 1. [Stuart](https://stuart.com/)
 1. [Sumo Logic](https://sumologic.com/)
@@ -169,6 +203,7 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [TableCheck](https://tablecheck.com/)
 1. [Tailor Brands](https://www.tailorbrands.com)
 1. [Tamkeen Technologies](https://tamkeentech.sa/)
+1. [Techcombank](https://www.techcombank.com.vn/trang-chu)
 1. [Technacy](https://www.technacy.it/)
 1. [Tesla](https://tesla.com/)
 1. [ThousandEyes](https://www.thousandeyes.com/)
@@ -176,6 +211,7 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Tiger Analytics](https://www.tigeranalytics.com/)
 1. [Tigera](https://www.tigera.io/)
 1. [Toss](https://toss.im/en)
+1. [Trendyol](https://www.trendyol.com/)
 1. [tru.ID](https://tru.id)
 1. [Twilio SendGrid](https://sendgrid.com)
 1. [tZERO](https://www.tzero.com/)
@@ -192,6 +228,7 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Walkbase](https://www.walkbase.com/)
 1. [Webstores](https://www.webstores.nl)
 1. [Wehkamp](https://www.wehkamp.nl/)
+1. [WeMaintain](https://www.wemaintain.com/)
 1. [WeMo Scooter](https://www.wemoscooter.com/)
 1. [Whitehat Berlin](https://whitehat.berlin) by Guido Maria Serra +Fenaroli
 1. [Witick](https://witick.io/)
@@ -203,5 +240,3 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Yubo](https://www.yubo.live/)
 1. [Zimpler](https://www.zimpler.com/)
 1. [ZOZO](https://corp.zozo.com/)
-1. [Trendyol](https://www.trendyol.com/)
-1. [RapidAPI](https://www.rapidapi.com/)

VERSION

@@ -1 +1 @@
-2.4.2
+2.5.0

applicationset/controllers/applicationset_controller.go

@@ -19,12 +19,16 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/go-logr/logr"
+	log "github.com/sirupsen/logrus"
 	corev1 "k8s.io/api/core/v1"
+	apierr "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/tools/record"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/source"
@@ -32,19 +36,11 @@ import (
 	"github.com/argoproj/argo-cd/v2/applicationset/generators"
 	"github.com/argoproj/argo-cd/v2/applicationset/utils"
 	"github.com/argoproj/argo-cd/v2/common"
-	argov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 	"github.com/argoproj/argo-cd/v2/util/db"
 
-	log "github.com/sirupsen/logrus"
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 	appclientset "github.com/argoproj/argo-cd/v2/pkg/client/clientset/versioned"
 	argoutil "github.com/argoproj/argo-cd/v2/util/argo"
-
-	apierr "k8s.io/apimachinery/pkg/api/errors"
 )
 
 const (
@@ -55,10 +51,16 @@ const (
 	ReconcileRequeueOnValidationError = time.Minute * 3
 )
 
+var (
+	preservedAnnotations = []string{
+		NotifiedAnnotationKey,
+		argov1alpha1.AnnotationKeyRefresh,
+	}
+)
+
 // ApplicationSetReconciler reconciles a ApplicationSet object
 type ApplicationSetReconciler struct {
 	client.Client
-	Log              logr.Logger
 	Scheme           *runtime.Scheme
 	Recorder         record.EventRecorder
 	Generators       map[string]generators.Generator
@@ -73,15 +75,14 @@ type ApplicationSetReconciler struct {
 // +kubebuilder:rbac:groups=argoproj.io,resources=applicationsets/status,verbs=get;update;patch
 
 func (r *ApplicationSetReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	_ = r.Log.WithValues("applicationset", req.NamespacedName)
-	_ = log.WithField("applicationset", req.NamespacedName)
+	logCtx := log.WithField("applicationset", req.NamespacedName)
 
-	var applicationSetInfo argoprojiov1alpha1.ApplicationSet
+	var applicationSetInfo argov1alpha1.ApplicationSet
 	parametersGenerated := false
 
 	if err := r.Get(ctx, req.NamespacedName, &applicationSetInfo); err != nil {
 		if client.IgnoreNotFound(err) != nil {
-			log.WithError(err).Infof("unable to get ApplicationSet: '%v' ", err)
+			logCtx.WithError(err).Infof("unable to get ApplicationSet: '%v' ", err)
 		}
 		return ctrl.Result{}, client.IgnoreNotFound(err)
 	}
@@ -92,17 +93,17 @@ func (r *ApplicationSetReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 	}
 
 	// Log a warning if there are unrecognized generators
-	utils.CheckInvalidGenerators(&applicationSetInfo)
+	_ = utils.CheckInvalidGenerators(&applicationSetInfo)
 	// desiredApplications is the main list of all expected Applications from all generators in this appset.
 	desiredApplications, applicationSetReason, err := r.generateApplications(applicationSetInfo)
 	if err != nil {
 		_ = r.setApplicationSetStatusCondition(ctx,
 			&applicationSetInfo,
-			argoprojiov1alpha1.ApplicationSetCondition{
-				Type:    argoprojiov1alpha1.ApplicationSetConditionErrorOccurred,
+			argov1alpha1.ApplicationSetCondition{
+				Type:    argov1alpha1.ApplicationSetConditionErrorOccurred,
 				Message: err.Error(),
 				Reason:  string(applicationSetReason),
-				Status:  argoprojiov1alpha1.ApplicationSetConditionStatusTrue,
+				Status:  argov1alpha1.ApplicationSetConditionStatusTrue,
 			}, parametersGenerated,
 		)
 		return ctrl.Result{}, err
@@ -119,15 +120,15 @@ func (r *ApplicationSetReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 		//
 		// Changes to watched resources will cause this to be reconciled sooner than
 		// the RequeueAfter time.
-		log.Errorf("error occurred during application validation: %s", err.Error())
+		logCtx.Errorf("error occurred during application validation: %s", err.Error())
 
 		_ = r.setApplicationSetStatusCondition(ctx,
 			&applicationSetInfo,
-			argoprojiov1alpha1.ApplicationSetCondition{
-				Type:    argoprojiov1alpha1.ApplicationSetConditionErrorOccurred,
+			argov1alpha1.ApplicationSetCondition{
+				Type:    argov1alpha1.ApplicationSetConditionErrorOccurred,
 				Message: err.Error(),
-				Reason:  argoprojiov1alpha1.ApplicationSetReasonApplicationValidationError,
-				Status:  argoprojiov1alpha1.ApplicationSetConditionStatusTrue,
+				Reason:  argov1alpha1.ApplicationSetReasonApplicationValidationError,
+				Status:  argov1alpha1.ApplicationSetConditionStatusTrue,
 			}, parametersGenerated,
 		)
 		return ctrl.Result{RequeueAfter: ReconcileRequeueOnValidationError}, nil
@@ -144,7 +145,7 @@ func (r *ApplicationSetReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 		var message string
 		for _, v := range validateErrors {
 			message = v.Error()
-			log.Errorf("validation error found during application validation: %s", message)
+			logCtx.Errorf("validation error found during application validation: %s", message)
 		}
 		if len(validateErrors) > 1 {
 			// Only the last message gets added to the appset status, to keep the size reasonable.
@@ -152,11 +153,11 @@ func (r *ApplicationSetReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 		}
 		_ = r.setApplicationSetStatusCondition(ctx,
 			&applicationSetInfo,
-			argoprojiov1alpha1.ApplicationSetCondition{
-				Type:    argoprojiov1alpha1.ApplicationSetConditionErrorOccurred,
+			argov1alpha1.ApplicationSetCondition{
+				Type:    argov1alpha1.ApplicationSetConditionErrorOccurred,
 				Message: message,
-				Reason:  argoprojiov1alpha1.ApplicationSetReasonApplicationValidationError,
-				Status:  argoprojiov1alpha1.ApplicationSetConditionStatusTrue,
+				Reason:  argov1alpha1.ApplicationSetReasonApplicationValidationError,
+				Status:  argov1alpha1.ApplicationSetConditionStatusTrue,
 			}, parametersGenerated,
 		)
 	}
@@ -166,11 +167,11 @@ func (r *ApplicationSetReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 		if err != nil {
 			_ = r.setApplicationSetStatusCondition(ctx,
 				&applicationSetInfo,
-				argoprojiov1alpha1.ApplicationSetCondition{
-					Type:    argoprojiov1alpha1.ApplicationSetConditionErrorOccurred,
+				argov1alpha1.ApplicationSetCondition{
+					Type:    argov1alpha1.ApplicationSetConditionErrorOccurred,
 					Message: err.Error(),
-					Reason:  argoprojiov1alpha1.ApplicationSetReasonUpdateApplicationError,
-					Status:  argoprojiov1alpha1.ApplicationSetConditionStatusTrue,
+					Reason:  argov1alpha1.ApplicationSetReasonUpdateApplicationError,
+					Status:  argov1alpha1.ApplicationSetConditionStatusTrue,
 				}, parametersGenerated,
 			)
 			return ctrl.Result{}, err
@@ -180,11 +181,11 @@ func (r *ApplicationSetReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 		if err != nil {
 			_ = r.setApplicationSetStatusCondition(ctx,
 				&applicationSetInfo,
-				argoprojiov1alpha1.ApplicationSetCondition{
-					Type:    argoprojiov1alpha1.ApplicationSetConditionErrorOccurred,
+				argov1alpha1.ApplicationSetCondition{
+					Type:    argov1alpha1.ApplicationSetConditionErrorOccurred,
 					Message: err.Error(),
-					Reason:  argoprojiov1alpha1.ApplicationSetReasonCreateApplicationError,
-					Status:  argoprojiov1alpha1.ApplicationSetConditionStatusTrue,
+					Reason:  argov1alpha1.ApplicationSetReasonCreateApplicationError,
+					Status:  argov1alpha1.ApplicationSetConditionStatusTrue,
 				}, parametersGenerated,
 			)
 			return ctrl.Result{}, err
@@ -196,11 +197,11 @@ func (r *ApplicationSetReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 		if err != nil {
 			_ = r.setApplicationSetStatusCondition(ctx,
 				&applicationSetInfo,
-				argoprojiov1alpha1.ApplicationSetCondition{
-					Type:    argoprojiov1alpha1.ApplicationSetConditionResourcesUpToDate,
+				argov1alpha1.ApplicationSetCondition{
+					Type:    argov1alpha1.ApplicationSetConditionResourcesUpToDate,
 					Message: err.Error(),
-					Reason:  argoprojiov1alpha1.ApplicationSetReasonDeleteApplicationError,
-					Status:  argoprojiov1alpha1.ApplicationSetConditionStatusTrue,
+					Reason:  argov1alpha1.ApplicationSetReasonDeleteApplicationError,
+					Status:  argov1alpha1.ApplicationSetConditionStatusTrue,
 				}, parametersGenerated,
 			)
 			return ctrl.Result{}, err
@@ -211,14 +212,14 @@ func (r *ApplicationSetReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 		delete(applicationSetInfo.Annotations, common.AnnotationApplicationSetRefresh)
 		err := r.Client.Update(ctx, &applicationSetInfo)
 		if err != nil {
-			log.Warnf("error occurred while updating ApplicationSet: %v", err)
+			logCtx.Warnf("error occurred while updating ApplicationSet: %v", err)
 			_ = r.setApplicationSetStatusCondition(ctx,
 				&applicationSetInfo,
-				argoprojiov1alpha1.ApplicationSetCondition{
-					Type:    argoprojiov1alpha1.ApplicationSetConditionErrorOccurred,
+				argov1alpha1.ApplicationSetCondition{
+					Type:    argov1alpha1.ApplicationSetConditionErrorOccurred,
 					Message: err.Error(),
-					Reason:  argoprojiov1alpha1.ApplicationSetReasonRefreshApplicationError,
-					Status:  argoprojiov1alpha1.ApplicationSetConditionStatusTrue,
+					Reason:  argov1alpha1.ApplicationSetReasonRefreshApplicationError,
+					Status:  argov1alpha1.ApplicationSetConditionStatusTrue,
 				}, parametersGenerated,
 			)
 			return ctrl.Result{}, err
@@ -226,16 +227,16 @@ func (r *ApplicationSetReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 	}
 
 	requeueAfter := r.getMinRequeueAfter(&applicationSetInfo)
-	log.WithField("requeueAfter", requeueAfter).Info("end reconcile")
+	logCtx.WithField("requeueAfter", requeueAfter).Info("end reconcile")
 
 	if len(validateErrors) == 0 {
 		if err := r.setApplicationSetStatusCondition(ctx,
 			&applicationSetInfo,
-			argoprojiov1alpha1.ApplicationSetCondition{
-				Type:    argoprojiov1alpha1.ApplicationSetConditionResourcesUpToDate,
+			argov1alpha1.ApplicationSetCondition{
+				Type:    argov1alpha1.ApplicationSetConditionResourcesUpToDate,
 				Message: "All applications have been generated successfully",
-				Reason:  argoprojiov1alpha1.ApplicationSetReasonApplicationSetUpToDate,
-				Status:  argoprojiov1alpha1.ApplicationSetConditionStatusTrue,
+				Reason:  argov1alpha1.ApplicationSetReasonApplicationSetUpToDate,
+				Status:  argov1alpha1.ApplicationSetConditionStatusTrue,
 			}, parametersGenerated,
 		); err != nil {
 			return ctrl.Result{}, err
@@ -247,67 +248,67 @@ func (r *ApplicationSetReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 	}, nil
 }
 
-func getParametersGeneratedCondition(parametersGenerated bool, message string) argoprojiov1alpha1.ApplicationSetCondition {
-	var paramtersGeneratedCondition argoprojiov1alpha1.ApplicationSetCondition
+func getParametersGeneratedCondition(parametersGenerated bool, message string) argov1alpha1.ApplicationSetCondition {
+	var paramtersGeneratedCondition argov1alpha1.ApplicationSetCondition
 	if parametersGenerated {
-		paramtersGeneratedCondition = argoprojiov1alpha1.ApplicationSetCondition{
-			Type:    argoprojiov1alpha1.ApplicationSetConditionParametersGenerated,
+		paramtersGeneratedCondition = argov1alpha1.ApplicationSetCondition{
+			Type:    argov1alpha1.ApplicationSetConditionParametersGenerated,
 			Message: "Successfully generated parameters for all Applications",
-			Reason:  argoprojiov1alpha1.ApplicationSetReasonParametersGenerated,
-			Status:  argoprojiov1alpha1.ApplicationSetConditionStatusTrue,
+			Reason:  argov1alpha1.ApplicationSetReasonParametersGenerated,
+			Status:  argov1alpha1.ApplicationSetConditionStatusTrue,
 		}
 	} else {
-		paramtersGeneratedCondition = argoprojiov1alpha1.ApplicationSetCondition{
-			Type:    argoprojiov1alpha1.ApplicationSetConditionParametersGenerated,
+		paramtersGeneratedCondition = argov1alpha1.ApplicationSetCondition{
+			Type:    argov1alpha1.ApplicationSetConditionParametersGenerated,
 			Message: message,
-			Reason:  argoprojiov1alpha1.ApplicationSetReasonErrorOccurred,
-			Status:  argoprojiov1alpha1.ApplicationSetConditionStatusFalse,
+			Reason:  argov1alpha1.ApplicationSetReasonErrorOccurred,
+			Status:  argov1alpha1.ApplicationSetConditionStatusFalse,
 		}
 	}
 	return paramtersGeneratedCondition
 }
 
-func getResourceUpToDateCondition(errorOccurred bool, message string, reason string) argoprojiov1alpha1.ApplicationSetCondition {
-	var resourceUpToDateCondition argoprojiov1alpha1.ApplicationSetCondition
+func getResourceUpToDateCondition(errorOccurred bool, message string, reason string) argov1alpha1.ApplicationSetCondition {
+	var resourceUpToDateCondition argov1alpha1.ApplicationSetCondition
 	if errorOccurred {
-		resourceUpToDateCondition = argoprojiov1alpha1.ApplicationSetCondition{
-			Type:    argoprojiov1alpha1.ApplicationSetConditionResourcesUpToDate,
+		resourceUpToDateCondition = argov1alpha1.ApplicationSetCondition{
+			Type:    argov1alpha1.ApplicationSetConditionResourcesUpToDate,
 			Message: message,
 			Reason:  reason,
-			Status:  argoprojiov1alpha1.ApplicationSetConditionStatusFalse,
+			Status:  argov1alpha1.ApplicationSetConditionStatusFalse,
 		}
 	} else {
-		resourceUpToDateCondition = argoprojiov1alpha1.ApplicationSetCondition{
-			Type:    argoprojiov1alpha1.ApplicationSetConditionResourcesUpToDate,
+		resourceUpToDateCondition = argov1alpha1.ApplicationSetCondition{
+			Type:    argov1alpha1.ApplicationSetConditionResourcesUpToDate,
 			Message: "ApplicationSet up to date",
-			Reason:  argoprojiov1alpha1.ApplicationSetReasonApplicationSetUpToDate,
-			Status:  argoprojiov1alpha1.ApplicationSetConditionStatusTrue,
+			Reason:  argov1alpha1.ApplicationSetReasonApplicationSetUpToDate,
+			Status:  argov1alpha1.ApplicationSetConditionStatusTrue,
 		}
 	}
 	return resourceUpToDateCondition
 }
 
-func (r *ApplicationSetReconciler) setApplicationSetStatusCondition(ctx context.Context, applicationSet *argoprojiov1alpha1.ApplicationSet, condition argoprojiov1alpha1.ApplicationSetCondition, paramtersGenerated bool) error {
+func (r *ApplicationSetReconciler) setApplicationSetStatusCondition(ctx context.Context, applicationSet *argov1alpha1.ApplicationSet, condition argov1alpha1.ApplicationSetCondition, paramtersGenerated bool) error {
 	// check if error occurred during reconcile process
-	errOccurred := condition.Type == argoprojiov1alpha1.ApplicationSetConditionErrorOccurred
+	errOccurred := condition.Type == argov1alpha1.ApplicationSetConditionErrorOccurred
 
-	var errOccurredCondition argoprojiov1alpha1.ApplicationSetCondition
+	var errOccurredCondition argov1alpha1.ApplicationSetCondition
 
 	if errOccurred {
 		errOccurredCondition = condition
 	} else {
-		errOccurredCondition = argoprojiov1alpha1.ApplicationSetCondition{
-			Type:    argoprojiov1alpha1.ApplicationSetConditionErrorOccurred,
+		errOccurredCondition = argov1alpha1.ApplicationSetCondition{
+			Type:    argov1alpha1.ApplicationSetConditionErrorOccurred,
 			Message: "Successfully generated parameters for all Applications",
-			Reason:  argoprojiov1alpha1.ApplicationSetReasonApplicationSetUpToDate,
-			Status:  argoprojiov1alpha1.ApplicationSetConditionStatusFalse,
+			Reason:  argov1alpha1.ApplicationSetReasonApplicationSetUpToDate,
+			Status:  argov1alpha1.ApplicationSetConditionStatusFalse,
 		}
 	}
 
 	paramtersGeneratedCondition := getParametersGeneratedCondition(paramtersGenerated, condition.Message)
 	resourceUpToDateCondition := getResourceUpToDateCondition(errOccurred, condition.Message, condition.Reason)
 
-	newConditions := []argoprojiov1alpha1.ApplicationSetCondition{errOccurredCondition, paramtersGeneratedCondition, resourceUpToDateCondition}
+	newConditions := []argov1alpha1.ApplicationSetCondition{errOccurredCondition, paramtersGeneratedCondition, resourceUpToDateCondition}
 
 	needToUpdateConditions := false
 	for _, condition := range newConditions {
@@ -319,10 +320,10 @@ func (r *ApplicationSetReconciler) setApplicationSetStatusCondition(ctx context.
 			}
 		}
 	}
-	evaluatedTypes := map[argoprojiov1alpha1.ApplicationSetConditionType]bool{
-		argoprojiov1alpha1.ApplicationSetConditionErrorOccurred:       true,
-		argoprojiov1alpha1.ApplicationSetConditionParametersGenerated: true,
-		argoprojiov1alpha1.ApplicationSetConditionResourcesUpToDate:   true,
+	evaluatedTypes := map[argov1alpha1.ApplicationSetConditionType]bool{
+		argov1alpha1.ApplicationSetConditionErrorOccurred:       true,
+		argov1alpha1.ApplicationSetConditionParametersGenerated: true,
+		argov1alpha1.ApplicationSetConditionResourcesUpToDate:   true,
 	}
 
 	if needToUpdateConditions || len(applicationSet.Status.Conditions) < 3 {
@@ -351,7 +352,7 @@ func (r *ApplicationSetReconciler) setApplicationSetStatusCondition(ctx context.
 
 // validateGeneratedApplications uses the Argo CD validation functions to verify the correctness of the
 // generated applications.
-func (r *ApplicationSetReconciler) validateGeneratedApplications(ctx context.Context, desiredApplications []argov1alpha1.Application, applicationSetInfo argoprojiov1alpha1.ApplicationSet, namespace string) (map[int]error, error) {
+func (r *ApplicationSetReconciler) validateGeneratedApplications(ctx context.Context, desiredApplications []argov1alpha1.Application, applicationSetInfo argov1alpha1.ApplicationSet, namespace string) (map[int]error, error) {
 	errorsByIndex := map[int]error{}
 	namesSet := map[string]bool{}
 	for i, app := range desiredApplications {
@@ -391,7 +392,7 @@ func (r *ApplicationSetReconciler) validateGeneratedApplications(ctx context.Con
 	return errorsByIndex, nil
 }
 
-func (r *ApplicationSetReconciler) getMinRequeueAfter(applicationSetInfo *argoprojiov1alpha1.ApplicationSet) time.Duration {
+func (r *ApplicationSetReconciler) getMinRequeueAfter(applicationSetInfo *argov1alpha1.ApplicationSet) time.Duration {
 	var res time.Duration
 	for _, requestedGenerator := range applicationSetInfo.Spec.Generators {
 
@@ -411,7 +412,7 @@ func (r *ApplicationSetReconciler) getMinRequeueAfter(applicationSetInfo *argopr
 	return res
 }
 
-func getTempApplication(applicationSetTemplate argoprojiov1alpha1.ApplicationSetTemplate) *argov1alpha1.Application {
+func getTempApplication(applicationSetTemplate argov1alpha1.ApplicationSetTemplate) *argov1alpha1.Application {
 	var tmplApplication argov1alpha1.Application
 	tmplApplication.Annotations = applicationSetTemplate.Annotations
 	tmplApplication.Labels = applicationSetTemplate.Labels
@@ -423,20 +424,20 @@ func getTempApplication(applicationSetTemplate argoprojiov1alpha1.ApplicationSet
 	return &tmplApplication
 }
 
-func (r *ApplicationSetReconciler) generateApplications(applicationSetInfo argoprojiov1alpha1.ApplicationSet) ([]argov1alpha1.Application, argoprojiov1alpha1.ApplicationSetReasonType, error) {
+func (r *ApplicationSetReconciler) generateApplications(applicationSetInfo argov1alpha1.ApplicationSet) ([]argov1alpha1.Application, argov1alpha1.ApplicationSetReasonType, error) {
 	var res []argov1alpha1.Application
 
 	var firstError error
-	var applicationSetReason argoprojiov1alpha1.ApplicationSetReasonType
+	var applicationSetReason argov1alpha1.ApplicationSetReasonType
 
 	for _, requestedGenerator := range applicationSetInfo.Spec.Generators {
-		t, err := generators.Transform(requestedGenerator, r.Generators, applicationSetInfo.Spec.Template, &applicationSetInfo)
+		t, err := generators.Transform(requestedGenerator, r.Generators, applicationSetInfo.Spec.Template, &applicationSetInfo, map[string]interface{}{})
 		if err != nil {
 			log.WithError(err).WithField("generator", requestedGenerator).
 				Error("error generating application from params")
 			if firstError == nil {
 				firstError = err
-				applicationSetReason = argoprojiov1alpha1.ApplicationSetReasonApplicationParamsGenerationError
+				applicationSetReason = argov1alpha1.ApplicationSetReasonApplicationParamsGenerationError
 			}
 			continue
 		}
@@ -445,14 +446,14 @@ func (r *ApplicationSetReconciler) generateApplications(applicationSetInfo argop
 			tmplApplication := getTempApplication(a.Template)
 
 			for _, p := range a.Params {
-				app, err := r.Renderer.RenderTemplateParams(tmplApplication, applicationSetInfo.Spec.SyncPolicy, p)
+				app, err := r.Renderer.RenderTemplateParams(tmplApplication, applicationSetInfo.Spec.SyncPolicy, p, applicationSetInfo.Spec.GoTemplate)
 				if err != nil {
 					log.WithError(err).WithField("params", a.Params).WithField("generator", requestedGenerator).
 						Error("error generating application from params")
 
 					if firstError == nil {
 						firstError = err
-						applicationSetReason = argoprojiov1alpha1.ApplicationSetReasonRenderTemplateParamsError
+						applicationSetReason = argov1alpha1.ApplicationSetReasonRenderTemplateParamsError
 					}
 					continue
 				}
@@ -476,18 +477,18 @@ func (r *ApplicationSetReconciler) SetupWithManager(mgr ctrl.Manager) error {
 			return nil
 		}
 		// ...make sure it's a application set...
-		if owner.APIVersion != argoprojiov1alpha1.GroupVersion.String() || owner.Kind != "ApplicationSet" {
+		if owner.APIVersion != argov1alpha1.SchemeGroupVersion.String() || owner.Kind != "ApplicationSet" {
 			return nil
 		}
 
 		// ...and if so, return it
 		return []string{owner.Name}
 	}); err != nil {
-		return err
+		return fmt.Errorf("error setting up with manager: %w", err)
 	}
 
 	return ctrl.NewControllerManagedBy(mgr).
-		For(&argoprojiov1alpha1.ApplicationSet{}).
+		For(&argov1alpha1.ApplicationSet{}).
 		Owns(&argov1alpha1.Application{}).
 		Watches(
 			&source.Kind{Type: &corev1.Secret{}},
@@ -503,7 +504,7 @@ func (r *ApplicationSetReconciler) SetupWithManager(mgr ctrl.Manager) error {
 // - For new applications, it will call create
 // - For existing application, it will call update
 // The function also adds owner reference to all applications, and uses it to delete them.
-func (r *ApplicationSetReconciler) createOrUpdateInCluster(ctx context.Context, applicationSet argoprojiov1alpha1.ApplicationSet, desiredApplications []argov1alpha1.Application) error {
+func (r *ApplicationSetReconciler) createOrUpdateInCluster(ctx context.Context, applicationSet argov1alpha1.ApplicationSet, desiredApplications []argov1alpha1.Application) error {
 
 	var firstError error
 	// Creates or updates the application in appList
@@ -527,12 +528,16 @@ func (r *ApplicationSetReconciler) createOrUpdateInCluster(ctx context.Context,
 			// Copy only the Application/ObjectMeta fields that are significant, from the generatedApp
 			found.Spec = generatedApp.Spec
 
-			// Preserve argo cd notifications state (https://github.com/argoproj/applicationset/issues/180)
-			if state, exists := found.ObjectMeta.Annotations[NotifiedAnnotationKey]; exists {
-				if generatedApp.Annotations == nil {
-					generatedApp.Annotations = map[string]string{}
+			// Preserve specially treated argo cd annotations:
+			// * https://github.com/argoproj/applicationset/issues/180
+			// * https://github.com/argoproj/argo-cd/issues/10500
+			for _, key := range preservedAnnotations {
+				if state, exists := found.ObjectMeta.Annotations[key]; exists {
+					if generatedApp.Annotations == nil {
+						generatedApp.Annotations = map[string]string{}
+					}
+					generatedApp.Annotations[key] = state
 				}
-				generatedApp.Annotations[NotifiedAnnotationKey] = state
 			}
 			found.ObjectMeta.Annotations = generatedApp.Annotations
 
@@ -557,12 +562,12 @@ func (r *ApplicationSetReconciler) createOrUpdateInCluster(ctx context.Context,
 
 // createInCluster will filter from the desiredApplications only the application that needs to be created
 // Then it will call createOrUpdateInCluster to do the actual create
-func (r *ApplicationSetReconciler) createInCluster(ctx context.Context, applicationSet argoprojiov1alpha1.ApplicationSet, desiredApplications []argov1alpha1.Application) error {
+func (r *ApplicationSetReconciler) createInCluster(ctx context.Context, applicationSet argov1alpha1.ApplicationSet, desiredApplications []argov1alpha1.Application) error {
 
 	var createApps []argov1alpha1.Application
 	current, err := r.getCurrentApplications(ctx, applicationSet)
 	if err != nil {
-		return err
+		return fmt.Errorf("error getting current applications: %w", err)
 	}
 
 	m := make(map[string]bool) // Will holds the app names that are current in the cluster
@@ -583,7 +588,7 @@ func (r *ApplicationSetReconciler) createInCluster(ctx context.Context, applicat
 	return r.createOrUpdateInCluster(ctx, applicationSet, createApps)
 }
 
-func (r *ApplicationSetReconciler) getCurrentApplications(_ context.Context, applicationSet argoprojiov1alpha1.ApplicationSet) ([]argov1alpha1.Application, error) {
+func (r *ApplicationSetReconciler) getCurrentApplications(_ context.Context, applicationSet argov1alpha1.ApplicationSet) ([]argov1alpha1.Application, error) {
 	// TODO: Should this use the context param?
 	var current argov1alpha1.ApplicationList
 	err := r.Client.List(context.Background(), &current, client.MatchingFields{".metadata.controller": applicationSet.Name})
@@ -597,19 +602,19 @@ func (r *ApplicationSetReconciler) getCurrentApplications(_ context.Context, app
 
 // deleteInCluster will delete Applications that are currently on the cluster, but not in appList.
 // The function must be called after all generators had been called and generated applications
-func (r *ApplicationSetReconciler) deleteInCluster(ctx context.Context, applicationSet argoprojiov1alpha1.ApplicationSet, desiredApplications []argov1alpha1.Application) error {
+func (r *ApplicationSetReconciler) deleteInCluster(ctx context.Context, applicationSet argov1alpha1.ApplicationSet, desiredApplications []argov1alpha1.Application) error {
 	// settingsMgr := settings.NewSettingsManager(context.TODO(), r.KubeClientset, applicationSet.Namespace)
 	// argoDB := db.NewDB(applicationSet.Namespace, settingsMgr, r.KubeClientset)
 	// clusterList, err := argoDB.ListClusters(ctx)
 	clusterList, err := utils.ListClusters(ctx, r.KubeClientset, applicationSet.Namespace)
 	if err != nil {
-		return err
+		return fmt.Errorf("error listing clusters: %w", err)
 	}
 
 	// Save current applications to be able to delete the ones that are not in appList
 	current, err := r.getCurrentApplications(ctx, applicationSet)
 	if err != nil {
-		return err
+		return fmt.Errorf("error getting current applications: %w", err)
 	}
 
 	m := make(map[string]bool) // Will holds the app names in appList for the deletion process
@@ -652,7 +657,7 @@ func (r *ApplicationSetReconciler) deleteInCluster(ctx context.Context, applicat
 }
 
 // removeFinalizerOnInvalidDestination removes the Argo CD resources finalizer if the application contains an invalid target (eg missing cluster)
-func (r *ApplicationSetReconciler) removeFinalizerOnInvalidDestination(ctx context.Context, applicationSet argoprojiov1alpha1.ApplicationSet, app *argov1alpha1.Application, clusterList *argov1alpha1.ClusterList, appLog *log.Entry) error {
+func (r *ApplicationSetReconciler) removeFinalizerOnInvalidDestination(ctx context.Context, applicationSet argov1alpha1.ApplicationSet, app *argov1alpha1.Application, clusterList *argov1alpha1.ClusterList, appLog *log.Entry) error {
 
 	// Only check if the finalizers need to be removed IF there are finalizers to remove
 	if len(app.Finalizers) == 0 {
@@ -713,7 +718,7 @@ func (r *ApplicationSetReconciler) removeFinalizerOnInvalidDestination(ctx conte
 
 			err := r.Client.Update(ctx, app, &client.UpdateOptions{})
 			if err != nil {
-				return err
+				return fmt.Errorf("error updating finalizers: %w", err)
 			}
 		}
 	}

applicationset/controllers/applicationset_controller_test.go

@@ -13,9 +13,11 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	corev1 "k8s.io/api/core/v1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
+	kubefake "k8s.io/client-go/kubernetes/fake"
 	"k8s.io/client-go/tools/record"
 	ctrl "sigs.k8s.io/controller-runtime"
 	crtclient "sigs.k8s.io/controller-runtime/pkg/client"
@@ -24,13 +26,9 @@ import (
 
 	"github.com/argoproj/argo-cd/v2/applicationset/generators"
 	"github.com/argoproj/argo-cd/v2/applicationset/utils"
+
+	"github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 	argov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
-
-	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
-	kubefake "k8s.io/client-go/kubernetes/fake"
-
-	"github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
 	appclientset "github.com/argoproj/argo-cd/v2/pkg/client/clientset/versioned/fake"
 	dbmocks "github.com/argoproj/argo-cd/v2/util/db/mocks"
 )
@@ -39,30 +37,30 @@ type generatorMock struct {
 	mock.Mock
 }
 
-func (g *generatorMock) GetTemplate(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator) *argoprojiov1alpha1.ApplicationSetTemplate {
+func (g *generatorMock) GetTemplate(appSetGenerator *argov1alpha1.ApplicationSetGenerator) *argov1alpha1.ApplicationSetTemplate {
 	args := g.Called(appSetGenerator)
 
-	return args.Get(0).(*argoprojiov1alpha1.ApplicationSetTemplate)
+	return args.Get(0).(*argov1alpha1.ApplicationSetTemplate)
 }
 
-func (g *generatorMock) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, _ *argoprojiov1alpha1.ApplicationSet) ([]map[string]string, error) {
+func (g *generatorMock) GenerateParams(appSetGenerator *argov1alpha1.ApplicationSetGenerator, _ *argov1alpha1.ApplicationSet) ([]map[string]interface{}, error) {
 	args := g.Called(appSetGenerator)
 
-	return args.Get(0).([]map[string]string), args.Error(1)
+	return args.Get(0).([]map[string]interface{}), args.Error(1)
 }
 
 type rendererMock struct {
 	mock.Mock
 }
 
-func (g *generatorMock) GetRequeueAfter(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator) time.Duration {
+func (g *generatorMock) GetRequeueAfter(appSetGenerator *argov1alpha1.ApplicationSetGenerator) time.Duration {
 	args := g.Called(appSetGenerator)
 
 	return args.Get(0).(time.Duration)
 }
 
-func (r *rendererMock) RenderTemplateParams(tmpl *argov1alpha1.Application, syncPolicy *argoprojiov1alpha1.ApplicationSetSyncPolicy, params map[string]string) (*argov1alpha1.Application, error) {
-	args := r.Called(tmpl, params)
+func (r *rendererMock) RenderTemplateParams(tmpl *argov1alpha1.Application, syncPolicy *argov1alpha1.ApplicationSetSyncPolicy, params map[string]interface{}, useGoTemplate bool) (*argov1alpha1.Application, error) {
+	args := r.Called(tmpl, params, useGoTemplate)
 
 	if args.Error(1) != nil {
 		return nil, args.Error(1)
@@ -74,7 +72,7 @@ func (r *rendererMock) RenderTemplateParams(tmpl *argov1alpha1.Application, sync
 
 func TestExtractApplications(t *testing.T) {
 	scheme := runtime.NewScheme()
-	err := argoprojiov1alpha1.AddToScheme(scheme)
+	err := argov1alpha1.AddToScheme(scheme)
 	assert.Nil(t, err)
 
 	err = argov1alpha1.AddToScheme(scheme)
@@ -82,8 +80,8 @@ func TestExtractApplications(t *testing.T) {
 
 	for _, c := range []struct {
 		name                string
-		params              []map[string]string
-		template            argoprojiov1alpha1.ApplicationSetTemplate
+		params              []map[string]interface{}
+		template            argov1alpha1.ApplicationSetTemplate
 		generateParamsError error
 		rendererError       error
 		expectErr           bool
@@ -91,9 +89,9 @@ func TestExtractApplications(t *testing.T) {
 	}{
 		{
 			name:   "Generate two applications",
-			params: []map[string]string{{"name": "app1"}, {"name": "app2"}},
-			template: argoprojiov1alpha1.ApplicationSetTemplate{
-				ApplicationSetTemplateMeta: argoprojiov1alpha1.ApplicationSetTemplateMeta{
+			params: []map[string]interface{}{{"name": "app1"}, {"name": "app2"}},
+			template: argov1alpha1.ApplicationSetTemplate{
+				ApplicationSetTemplateMeta: argov1alpha1.ApplicationSetTemplateMeta{
 					Name:      "name",
 					Namespace: "namespace",
 					Labels:    map[string]string{"label_name": "label_value"},
@@ -110,9 +108,9 @@ func TestExtractApplications(t *testing.T) {
 		},
 		{
 			name:   "Handles error from the render",
-			params: []map[string]string{{"name": "app1"}, {"name": "app2"}},
-			template: argoprojiov1alpha1.ApplicationSetTemplate{
-				ApplicationSetTemplateMeta: argoprojiov1alpha1.ApplicationSetTemplateMeta{
+			params: []map[string]interface{}{{"name": "app1"}, {"name": "app2"}},
+			template: argov1alpha1.ApplicationSetTemplate{
+				ApplicationSetTemplateMeta: argov1alpha1.ApplicationSetTemplateMeta{
 					Name:      "name",
 					Namespace: "namespace",
 					Labels:    map[string]string{"label_name": "label_value"},
@@ -133,7 +131,7 @@ func TestExtractApplications(t *testing.T) {
 
 		t.Run(cc.name, func(t *testing.T) {
 
-			appSet := &argoprojiov1alpha1.ApplicationSet{
+			appSet := &argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
@@ -143,15 +141,15 @@ func TestExtractApplications(t *testing.T) {
 			client := fake.NewClientBuilder().WithScheme(scheme).WithObjects(appSet).Build()
 
 			generatorMock := generatorMock{}
-			generator := argoprojiov1alpha1.ApplicationSetGenerator{
-				List: &argoprojiov1alpha1.ListGenerator{},
+			generator := argov1alpha1.ApplicationSetGenerator{
+				List: &argov1alpha1.ListGenerator{},
 			}
 
 			generatorMock.On("GenerateParams", &generator).
 				Return(cc.params, cc.generateParamsError)
 
 			generatorMock.On("GetTemplate", &generator).
-				Return(&argoprojiov1alpha1.ApplicationSetTemplate{})
+				Return(&argov1alpha1.ApplicationSetTemplate{})
 
 			rendererMock := rendererMock{}
 
@@ -161,10 +159,10 @@ func TestExtractApplications(t *testing.T) {
 				for _, p := range cc.params {
 
 					if cc.rendererError != nil {
-						rendererMock.On("RenderTemplateParams", getTempApplication(cc.template), p).
+						rendererMock.On("RenderTemplateParams", getTempApplication(cc.template), p, false).
 							Return(nil, cc.rendererError)
 					} else {
-						rendererMock.On("RenderTemplateParams", getTempApplication(cc.template), p).
+						rendererMock.On("RenderTemplateParams", getTempApplication(cc.template), p, false).
 							Return(&app, nil)
 						expectedApps = append(expectedApps, app)
 					}
@@ -182,13 +180,13 @@ func TestExtractApplications(t *testing.T) {
 				KubeClientset: kubefake.NewSimpleClientset(),
 			}
 
-			got, reason, err := r.generateApplications(argoprojiov1alpha1.ApplicationSet{
+			got, reason, err := r.generateApplications(argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
 				},
-				Spec: argoprojiov1alpha1.ApplicationSetSpec{
-					Generators: []argoprojiov1alpha1.ApplicationSetGenerator{generator},
+				Spec: argov1alpha1.ApplicationSetSpec{
+					Generators: []argov1alpha1.ApplicationSetGenerator{generator},
 					Template:   cc.template,
 				},
 			})
@@ -213,39 +211,39 @@ func TestExtractApplications(t *testing.T) {
 
 func TestMergeTemplateApplications(t *testing.T) {
 	scheme := runtime.NewScheme()
-	_ = argoprojiov1alpha1.AddToScheme(scheme)
+	_ = argov1alpha1.AddToScheme(scheme)
 	_ = argov1alpha1.AddToScheme(scheme)
 
 	client := fake.NewClientBuilder().WithScheme(scheme).Build()
 
 	for _, c := range []struct {
 		name             string
-		params           []map[string]string
-		template         argoprojiov1alpha1.ApplicationSetTemplate
-		overrideTemplate argoprojiov1alpha1.ApplicationSetTemplate
-		expectedMerged   argoprojiov1alpha1.ApplicationSetTemplate
+		params           []map[string]interface{}
+		template         argov1alpha1.ApplicationSetTemplate
+		overrideTemplate argov1alpha1.ApplicationSetTemplate
+		expectedMerged   argov1alpha1.ApplicationSetTemplate
 		expectedApps     []argov1alpha1.Application
 	}{
 		{
 			name:   "Generate app",
-			params: []map[string]string{{"name": "app1"}},
-			template: argoprojiov1alpha1.ApplicationSetTemplate{
-				ApplicationSetTemplateMeta: argoprojiov1alpha1.ApplicationSetTemplateMeta{
+			params: []map[string]interface{}{{"name": "app1"}},
+			template: argov1alpha1.ApplicationSetTemplate{
+				ApplicationSetTemplateMeta: argov1alpha1.ApplicationSetTemplateMeta{
 					Name:      "name",
 					Namespace: "namespace",
 					Labels:    map[string]string{"label_name": "label_value"},
 				},
 				Spec: argov1alpha1.ApplicationSpec{},
 			},
-			overrideTemplate: argoprojiov1alpha1.ApplicationSetTemplate{
-				ApplicationSetTemplateMeta: argoprojiov1alpha1.ApplicationSetTemplateMeta{
+			overrideTemplate: argov1alpha1.ApplicationSetTemplate{
+				ApplicationSetTemplateMeta: argov1alpha1.ApplicationSetTemplateMeta{
 					Name:   "test",
 					Labels: map[string]string{"foo": "bar"},
 				},
 				Spec: argov1alpha1.ApplicationSpec{},
 			},
-			expectedMerged: argoprojiov1alpha1.ApplicationSetTemplate{
-				ApplicationSetTemplateMeta: argoprojiov1alpha1.ApplicationSetTemplateMeta{
+			expectedMerged: argov1alpha1.ApplicationSetTemplate{
+				ApplicationSetTemplateMeta: argov1alpha1.ApplicationSetTemplateMeta{
 					Name:      "test",
 					Namespace: "namespace",
 					Labels:    map[string]string{"label_name": "label_value", "foo": "bar"},
@@ -269,8 +267,8 @@ func TestMergeTemplateApplications(t *testing.T) {
 		t.Run(cc.name, func(t *testing.T) {
 
 			generatorMock := generatorMock{}
-			generator := argoprojiov1alpha1.ApplicationSetGenerator{
-				List: &argoprojiov1alpha1.ListGenerator{},
+			generator := argov1alpha1.ApplicationSetGenerator{
+				List: &argov1alpha1.ListGenerator{},
 			}
 
 			generatorMock.On("GenerateParams", &generator).
@@ -281,7 +279,7 @@ func TestMergeTemplateApplications(t *testing.T) {
 
 			rendererMock := rendererMock{}
 
-			rendererMock.On("RenderTemplateParams", getTempApplication(cc.expectedMerged), cc.params[0]).
+			rendererMock.On("RenderTemplateParams", getTempApplication(cc.expectedMerged), cc.params[0], false).
 				Return(&cc.expectedApps[0], nil)
 
 			r := ApplicationSetReconciler{
@@ -295,13 +293,13 @@ func TestMergeTemplateApplications(t *testing.T) {
 				KubeClientset: kubefake.NewSimpleClientset(),
 			}
 
-			got, _, _ := r.generateApplications(argoprojiov1alpha1.ApplicationSet{
+			got, _, _ := r.generateApplications(argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
 				},
-				Spec: argoprojiov1alpha1.ApplicationSetSpec{
-					Generators: []argoprojiov1alpha1.ApplicationSetGenerator{generator},
+				Spec: argov1alpha1.ApplicationSetSpec{
+					Generators: []argov1alpha1.ApplicationSetGenerator{generator},
 					Template:   cc.template,
 				},
 			},
@@ -316,7 +314,7 @@ func TestMergeTemplateApplications(t *testing.T) {
 func TestCreateOrUpdateInCluster(t *testing.T) {
 
 	scheme := runtime.NewScheme()
-	err := argoprojiov1alpha1.AddToScheme(scheme)
+	err := argov1alpha1.AddToScheme(scheme)
 	assert.Nil(t, err)
 
 	err = argov1alpha1.AddToScheme(scheme)
@@ -326,7 +324,7 @@ func TestCreateOrUpdateInCluster(t *testing.T) {
 		// name is human-readable test name
 		name string
 		// appSet is the ApplicationSet we are generating resources for
-		appSet argoprojiov1alpha1.ApplicationSet
+		appSet argov1alpha1.ApplicationSet
 		// existingApps are the apps that already exist on the cluster
 		existingApps []argov1alpha1.Application
 		// desiredApps are the generated apps to create/update
@@ -336,7 +334,7 @@ func TestCreateOrUpdateInCluster(t *testing.T) {
 	}{
 		{
 			name: "Create an app that doesn't exist",
-			appSet: argoprojiov1alpha1.ApplicationSet{
+			appSet: argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
@@ -366,13 +364,13 @@ func TestCreateOrUpdateInCluster(t *testing.T) {
 		},
 		{
 			name: "Update an existing app with a different project name",
-			appSet: argoprojiov1alpha1.ApplicationSet{
+			appSet: argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
 				},
-				Spec: argoprojiov1alpha1.ApplicationSetSpec{
-					Template: argoprojiov1alpha1.ApplicationSetTemplate{
+				Spec: argov1alpha1.ApplicationSetSpec{
+					Template: argov1alpha1.ApplicationSetTemplate{
 						Spec: argov1alpha1.ApplicationSpec{
 							Project: "project",
 						},
@@ -424,13 +422,13 @@ func TestCreateOrUpdateInCluster(t *testing.T) {
 		},
 		{
 			name: "Create a new app and check it doesn't replace the existing app",
-			appSet: argoprojiov1alpha1.ApplicationSet{
+			appSet: argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
 				},
-				Spec: argoprojiov1alpha1.ApplicationSetSpec{
-					Template: argoprojiov1alpha1.ApplicationSetTemplate{
+				Spec: argov1alpha1.ApplicationSetSpec{
+					Template: argov1alpha1.ApplicationSetTemplate{
 						Spec: argov1alpha1.ApplicationSpec{
 							Project: "project",
 						},
@@ -482,13 +480,13 @@ func TestCreateOrUpdateInCluster(t *testing.T) {
 		},
 		{
 			name: "Ensure that labels and annotations are added (via update) into an exiting application",
-			appSet: argoprojiov1alpha1.ApplicationSet{
+			appSet: argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
 				},
-				Spec: argoprojiov1alpha1.ApplicationSetSpec{
-					Template: argoprojiov1alpha1.ApplicationSetTemplate{
+				Spec: argov1alpha1.ApplicationSetSpec{
+					Template: argov1alpha1.ApplicationSetTemplate{
 						Spec: argov1alpha1.ApplicationSpec{
 							Project: "project",
 						},
@@ -544,13 +542,13 @@ func TestCreateOrUpdateInCluster(t *testing.T) {
 		},
 		{
 			name: "Ensure that labels and annotations are removed from an existing app",
-			appSet: argoprojiov1alpha1.ApplicationSet{
+			appSet: argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
 				},
-				Spec: argoprojiov1alpha1.ApplicationSetSpec{
-					Template: argoprojiov1alpha1.ApplicationSetTemplate{
+				Spec: argov1alpha1.ApplicationSetSpec{
+					Template: argov1alpha1.ApplicationSetTemplate{
 						Spec: argov1alpha1.ApplicationSpec{
 							Project: "project",
 						},
@@ -603,14 +601,14 @@ func TestCreateOrUpdateInCluster(t *testing.T) {
 			},
 		},
 		{
-			name: "Ensure that status and operation fields are not overriden by an update, when removing labels/annotations",
-			appSet: argoprojiov1alpha1.ApplicationSet{
+			name: "Ensure that status and operation fields are not overridden by an update, when removing labels/annotations",
+			appSet: argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
 				},
-				Spec: argoprojiov1alpha1.ApplicationSetSpec{
-					Template: argoprojiov1alpha1.ApplicationSetTemplate{
+				Spec: argov1alpha1.ApplicationSetSpec{
+					Template: argov1alpha1.ApplicationSetTemplate{
 						Spec: argov1alpha1.ApplicationSpec{
 							Project: "project",
 						},
@@ -675,14 +673,14 @@ func TestCreateOrUpdateInCluster(t *testing.T) {
 			},
 		},
 		{
-			name: "Ensure that status and operation fields are not overriden by an update, when removing labels/annotations and adding other fields",
-			appSet: argoprojiov1alpha1.ApplicationSet{
+			name: "Ensure that status and operation fields are not overridden by an update, when removing labels/annotations and adding other fields",
+			appSet: argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
 				},
-				Spec: argoprojiov1alpha1.ApplicationSetSpec{
-					Template: argoprojiov1alpha1.ApplicationSetTemplate{
+				Spec: argov1alpha1.ApplicationSetSpec{
+					Template: argov1alpha1.ApplicationSetTemplate{
 						Spec: argov1alpha1.ApplicationSpec{
 							Project:     "project",
 							Source:      argov1alpha1.ApplicationSource{Path: "path", TargetRevision: "revision", RepoURL: "repoURL"},
@@ -755,14 +753,14 @@ func TestCreateOrUpdateInCluster(t *testing.T) {
 			},
 		},
 		{
-			name: "Ensure that argocd notifications state annotation is preserved from an existing app",
-			appSet: argoprojiov1alpha1.ApplicationSet{
+			name: "Ensure that argocd notifications state and refresh annotation is preserved from an existing app",
+			appSet: argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
 				},
-				Spec: argoprojiov1alpha1.ApplicationSetSpec{
-					Template: argoprojiov1alpha1.ApplicationSetTemplate{
+				Spec: argov1alpha1.ApplicationSetSpec{
+					Template: argov1alpha1.ApplicationSetTemplate{
 						Spec: argov1alpha1.ApplicationSpec{
 							Project: "project",
 						},
@@ -781,8 +779,9 @@ func TestCreateOrUpdateInCluster(t *testing.T) {
 						ResourceVersion: "2",
 						Labels:          map[string]string{"label-key": "label-value"},
 						Annotations: map[string]string{
-							"annot-key":           "annot-value",
-							NotifiedAnnotationKey: `{"b620d4600c771a6f4cxxxxxxx:on-deployed:[0].y7b5sbwa2Q329JYHxxxxxx-fBs:slack:slack-test":1617144614}`,
+							"annot-key":                       "annot-value",
+							NotifiedAnnotationKey:             `{"b620d4600c771a6f4cxxxxxxx:on-deployed:[0].y7b5sbwa2Q329JYHxxxxxx-fBs:slack:slack-test":1617144614}`,
+							argov1alpha1.AnnotationKeyRefresh: string(argov1alpha1.RefreshTypeNormal),
 						},
 					},
 					Spec: argov1alpha1.ApplicationSpec{
@@ -811,7 +810,8 @@ func TestCreateOrUpdateInCluster(t *testing.T) {
 						Namespace:       "namespace",
 						ResourceVersion: "3",
 						Annotations: map[string]string{
-							NotifiedAnnotationKey: `{"b620d4600c771a6f4cxxxxxxx:on-deployed:[0].y7b5sbwa2Q329JYHxxxxxx-fBs:slack:slack-test":1617144614}`,
+							NotifiedAnnotationKey:             `{"b620d4600c771a6f4cxxxxxxx:on-deployed:[0].y7b5sbwa2Q329JYHxxxxxx-fBs:slack:slack-test":1617144614}`,
+							argov1alpha1.AnnotationKeyRefresh: string(argov1alpha1.RefreshTypeNormal),
 						},
 					},
 					Spec: argov1alpha1.ApplicationSpec{
@@ -861,7 +861,7 @@ func TestCreateOrUpdateInCluster(t *testing.T) {
 func TestRemoveFinalizerOnInvalidDestination_FinalizerTypes(t *testing.T) {
 
 	scheme := runtime.NewScheme()
-	err := argoprojiov1alpha1.AddToScheme(scheme)
+	err := argov1alpha1.AddToScheme(scheme)
 	assert.Nil(t, err)
 
 	err = argov1alpha1.AddToScheme(scheme)
@@ -896,13 +896,13 @@ func TestRemoveFinalizerOnInvalidDestination_FinalizerTypes(t *testing.T) {
 	} {
 		t.Run(c.name, func(t *testing.T) {
 
-			appSet := argoprojiov1alpha1.ApplicationSet{
+			appSet := argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
 				},
-				Spec: argoprojiov1alpha1.ApplicationSetSpec{
-					Template: argoprojiov1alpha1.ApplicationSetTemplate{
+				Spec: argov1alpha1.ApplicationSetSpec{
+					Template: argov1alpha1.ApplicationSetTemplate{
 						Spec: argov1alpha1.ApplicationSpec{
 							Project: "project",
 						},
@@ -985,7 +985,7 @@ func TestRemoveFinalizerOnInvalidDestination_FinalizerTypes(t *testing.T) {
 func TestRemoveFinalizerOnInvalidDestination_DestinationTypes(t *testing.T) {
 
 	scheme := runtime.NewScheme()
-	err := argoprojiov1alpha1.AddToScheme(scheme)
+	err := argov1alpha1.AddToScheme(scheme)
 	assert.Nil(t, err)
 
 	err = argov1alpha1.AddToScheme(scheme)
@@ -1058,13 +1058,13 @@ func TestRemoveFinalizerOnInvalidDestination_DestinationTypes(t *testing.T) {
 
 		t.Run(c.name, func(t *testing.T) {
 
-			appSet := argoprojiov1alpha1.ApplicationSet{
+			appSet := argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
 				},
-				Spec: argoprojiov1alpha1.ApplicationSetSpec{
-					Template: argoprojiov1alpha1.ApplicationSetTemplate{
+				Spec: argov1alpha1.ApplicationSetSpec{
+					Template: argov1alpha1.ApplicationSetTemplate{
 						Spec: argov1alpha1.ApplicationSpec{
 							Project: "project",
 						},
@@ -1144,20 +1144,20 @@ func TestRemoveFinalizerOnInvalidDestination_DestinationTypes(t *testing.T) {
 func TestCreateApplications(t *testing.T) {
 
 	scheme := runtime.NewScheme()
-	err := argoprojiov1alpha1.AddToScheme(scheme)
+	err := argov1alpha1.AddToScheme(scheme)
 	assert.Nil(t, err)
 
 	err = argov1alpha1.AddToScheme(scheme)
 	assert.Nil(t, err)
 
 	for _, c := range []struct {
-		appSet     argoprojiov1alpha1.ApplicationSet
+		appSet     argov1alpha1.ApplicationSet
 		existsApps []argov1alpha1.Application
 		apps       []argov1alpha1.Application
 		expected   []argov1alpha1.Application
 	}{
 		{
-			appSet: argoprojiov1alpha1.ApplicationSet{
+			appSet: argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
@@ -1186,13 +1186,13 @@ func TestCreateApplications(t *testing.T) {
 			},
 		},
 		{
-			appSet: argoprojiov1alpha1.ApplicationSet{
+			appSet: argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
 				},
-				Spec: argoprojiov1alpha1.ApplicationSetSpec{
-					Template: argoprojiov1alpha1.ApplicationSetTemplate{
+				Spec: argov1alpha1.ApplicationSetSpec{
+					Template: argov1alpha1.ApplicationSetTemplate{
 						Spec: argov1alpha1.ApplicationSpec{
 							Project: "project",
 						},
@@ -1243,13 +1243,13 @@ func TestCreateApplications(t *testing.T) {
 			},
 		},
 		{
-			appSet: argoprojiov1alpha1.ApplicationSet{
+			appSet: argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
 				},
-				Spec: argoprojiov1alpha1.ApplicationSetSpec{
-					Template: argoprojiov1alpha1.ApplicationSetTemplate{
+				Spec: argov1alpha1.ApplicationSetSpec{
+					Template: argov1alpha1.ApplicationSetTemplate{
 						Spec: argov1alpha1.ApplicationSpec{
 							Project: "project",
 						},
@@ -1337,14 +1337,14 @@ func TestCreateApplications(t *testing.T) {
 func TestDeleteInCluster(t *testing.T) {
 
 	scheme := runtime.NewScheme()
-	err := argoprojiov1alpha1.AddToScheme(scheme)
+	err := argov1alpha1.AddToScheme(scheme)
 	assert.Nil(t, err)
 	err = argov1alpha1.AddToScheme(scheme)
 	assert.Nil(t, err)
 
 	for _, c := range []struct {
 		// appSet is the application set on which the delete function is called
-		appSet argoprojiov1alpha1.ApplicationSet
+		appSet argov1alpha1.ApplicationSet
 		// existingApps is the current state of Applications on the cluster
 		existingApps []argov1alpha1.Application
 		// desireApps is the apps generated by the generator that we wish to keep alive
@@ -1355,13 +1355,13 @@ func TestDeleteInCluster(t *testing.T) {
 		notExpected []argov1alpha1.Application
 	}{
 		{
-			appSet: argoprojiov1alpha1.ApplicationSet{
+			appSet: argov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "name",
 					Namespace: "namespace",
 				},
-				Spec: argoprojiov1alpha1.ApplicationSetSpec{
-					Template: argoprojiov1alpha1.ApplicationSetTemplate{
+				Spec: argov1alpha1.ApplicationSetSpec{
+					Template: argov1alpha1.ApplicationSetTemplate{
 						Spec: argov1alpha1.ApplicationSpec{
 							Project: "project",
 						},
@@ -1491,17 +1491,17 @@ func TestDeleteInCluster(t *testing.T) {
 
 func TestGetMinRequeueAfter(t *testing.T) {
 	scheme := runtime.NewScheme()
-	err := argoprojiov1alpha1.AddToScheme(scheme)
+	err := argov1alpha1.AddToScheme(scheme)
 	assert.Nil(t, err)
 	err = argov1alpha1.AddToScheme(scheme)
 	assert.Nil(t, err)
 
 	client := fake.NewClientBuilder().WithScheme(scheme).Build()
 
-	generator := argoprojiov1alpha1.ApplicationSetGenerator{
-		List:     &argoprojiov1alpha1.ListGenerator{},
-		Git:      &argoprojiov1alpha1.GitGenerator{},
-		Clusters: &argoprojiov1alpha1.ClusterGenerator{},
+	generator := argov1alpha1.ApplicationSetGenerator{
+		List:     &argov1alpha1.ListGenerator{},
+		Git:      &argov1alpha1.GitGenerator{},
+		Clusters: &argov1alpha1.ClusterGenerator{},
 	}
 
 	generatorMock0 := generatorMock{}
@@ -1527,9 +1527,9 @@ func TestGetMinRequeueAfter(t *testing.T) {
 		},
 	}
 
-	got := r.getMinRequeueAfter(&argoprojiov1alpha1.ApplicationSet{
-		Spec: argoprojiov1alpha1.ApplicationSetSpec{
-			Generators: []argoprojiov1alpha1.ApplicationSetGenerator{generator},
+	got := r.getMinRequeueAfter(&argov1alpha1.ApplicationSet{
+		Spec: argov1alpha1.ApplicationSetSpec{
+			Generators: []argov1alpha1.ApplicationSetGenerator{generator},
 		},
 	})
 
@@ -1539,7 +1539,7 @@ func TestGetMinRequeueAfter(t *testing.T) {
 func TestValidateGeneratedApplications(t *testing.T) {
 
 	scheme := runtime.NewScheme()
-	err := argoprojiov1alpha1.AddToScheme(scheme)
+	err := argov1alpha1.AddToScheme(scheme)
 	assert.Nil(t, err)
 
 	err = argov1alpha1.AddToScheme(scheme)
@@ -1739,7 +1739,7 @@ func TestValidateGeneratedApplications(t *testing.T) {
 				KubeClientset:    kubeclientset,
 			}
 
-			appSetInfo := argoprojiov1alpha1.ApplicationSet{}
+			appSetInfo := argov1alpha1.ApplicationSet{}
 
 			validationErrors, _ := r.validateGeneratedApplications(context.TODO(), cc.apps, appSetInfo, "namespace")
 			var errorMessages []string
@@ -1777,7 +1777,7 @@ func TestValidateGeneratedApplications(t *testing.T) {
 func TestReconcilerValidationErrorBehaviour(t *testing.T) {
 
 	scheme := runtime.NewScheme()
-	err := argoprojiov1alpha1.AddToScheme(scheme)
+	err := argov1alpha1.AddToScheme(scheme)
 	assert.Nil(t, err)
 	err = argov1alpha1.AddToScheme(scheme)
 	assert.Nil(t, err)
@@ -1786,15 +1786,16 @@ func TestReconcilerValidationErrorBehaviour(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: "default", Namespace: "argocd"},
 		Spec:       argov1alpha1.AppProjectSpec{SourceRepos: []string{"*"}, Destinations: []argov1alpha1.ApplicationDestination{{Namespace: "*", Server: "https://good-cluster"}}},
 	}
-	appSet := argoprojiov1alpha1.ApplicationSet{
+	appSet := argov1alpha1.ApplicationSet{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "name",
 			Namespace: "argocd",
 		},
-		Spec: argoprojiov1alpha1.ApplicationSetSpec{
-			Generators: []argoprojiov1alpha1.ApplicationSetGenerator{
+		Spec: argov1alpha1.ApplicationSetSpec{
+			GoTemplate: true,
+			Generators: []argov1alpha1.ApplicationSetGenerator{
 				{
-					List: &argoprojiov1alpha1.ListGenerator{
+					List: &argov1alpha1.ListGenerator{
 						Elements: []apiextensionsv1.JSON{{
 							Raw: []byte(`{"cluster": "good-cluster","url": "https://good-cluster"}`),
 						}, {
@@ -1803,15 +1804,15 @@ func TestReconcilerValidationErrorBehaviour(t *testing.T) {
 					},
 				},
 			},
-			Template: argoprojiov1alpha1.ApplicationSetTemplate{
-				ApplicationSetTemplateMeta: argoprojiov1alpha1.ApplicationSetTemplateMeta{
-					Name:      "{{cluster}}",
+			Template: argov1alpha1.ApplicationSetTemplate{
+				ApplicationSetTemplateMeta: argov1alpha1.ApplicationSetTemplateMeta{
+					Name:      "{{.cluster}}",
 					Namespace: "argocd",
 				},
 				Spec: argov1alpha1.ApplicationSpec{
 					Source:      argov1alpha1.ApplicationSource{RepoURL: "https://github.com/argoproj/argocd-example-apps", Path: "guestbook"},
 					Project:     "default",
-					Destination: argov1alpha1.ApplicationDestination{Server: "{{url}}"},
+					Destination: argov1alpha1.ApplicationDestination{Server: "{{.url}}"},
 				},
 			},
 		},
@@ -1831,7 +1832,6 @@ func TestReconcilerValidationErrorBehaviour(t *testing.T) {
 	}}, nil)
 
 	r := ApplicationSetReconciler{
-		Log:      ctrl.Log.WithName("controllers").WithName("ApplicationSet"),
 		Client:   client,
 		Scheme:   scheme,
 		Renderer: &utils.Render{},
@@ -1871,33 +1871,33 @@ func TestReconcilerValidationErrorBehaviour(t *testing.T) {
 
 func TestSetApplicationSetStatusCondition(t *testing.T) {
 	scheme := runtime.NewScheme()
-	err := argoprojiov1alpha1.AddToScheme(scheme)
+	err := argov1alpha1.AddToScheme(scheme)
 	assert.Nil(t, err)
 	err = argov1alpha1.AddToScheme(scheme)
 	assert.Nil(t, err)
 
-	appSet := argoprojiov1alpha1.ApplicationSet{
+	appSet := argov1alpha1.ApplicationSet{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "name",
 			Namespace: "argocd",
 		},
-		Spec: argoprojiov1alpha1.ApplicationSetSpec{
-			Generators: []argoprojiov1alpha1.ApplicationSetGenerator{
-				{List: &argoprojiov1alpha1.ListGenerator{
+		Spec: argov1alpha1.ApplicationSetSpec{
+			Generators: []argov1alpha1.ApplicationSetGenerator{
+				{List: &argov1alpha1.ListGenerator{
 					Elements: []apiextensionsv1.JSON{{
 						Raw: []byte(`{"cluster": "my-cluster","url": "https://kubernetes.default.svc"}`),
 					}},
 				}},
 			},
-			Template: argoprojiov1alpha1.ApplicationSetTemplate{},
+			Template: argov1alpha1.ApplicationSetTemplate{},
 		},
 	}
 
-	appCondition := argoprojiov1alpha1.ApplicationSetCondition{
-		Type:    argoprojiov1alpha1.ApplicationSetConditionResourcesUpToDate,
+	appCondition := argov1alpha1.ApplicationSetCondition{
+		Type:    argov1alpha1.ApplicationSetConditionResourcesUpToDate,
 		Message: "All applications have been generated successfully",
-		Reason:  argoprojiov1alpha1.ApplicationSetReasonApplicationSetUpToDate,
-		Status:  argoprojiov1alpha1.ApplicationSetConditionStatusTrue,
+		Reason:  argov1alpha1.ApplicationSetReasonApplicationSetUpToDate,
+		Status:  argov1alpha1.ApplicationSetConditionStatusTrue,
 	}
 
 	kubeclientset := kubefake.NewSimpleClientset([]runtime.Object{}...)
@@ -1907,7 +1907,6 @@ func TestSetApplicationSetStatusCondition(t *testing.T) {
 	client := fake.NewClientBuilder().WithScheme(scheme).WithObjects(&appSet).Build()
 
 	r := ApplicationSetReconciler{
-		Log:      ctrl.Log.WithName("controllers").WithName("ApplicationSet"),
 		Client:   client,
 		Scheme:   scheme,
 		Renderer: &utils.Render{},

applicationset/controllers/clustereventhandler.go

@@ -12,7 +12,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/event"
 
 	"github.com/argoproj/argo-cd/v2/applicationset/generators"
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 // clusterSecretEventHandler is used when watching Secrets to check if they are ArgoCD Cluster Secrets, and if so

applicationset/controllers/clustereventhandler_test.go

@@ -15,13 +15,12 @@ import (
 
 	"github.com/argoproj/argo-cd/v2/applicationset/generators"
 	argov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
 )
 
 func TestClusterEventHandler(t *testing.T) {
 
 	scheme := runtime.NewScheme()
-	err := argoprojiov1alpha1.AddToScheme(scheme)
+	err := argov1alpha1.AddToScheme(scheme)
 	assert.Nil(t, err)
 
 	err = argov1alpha1.AddToScheme(scheme)
@@ -29,13 +28,13 @@ func TestClusterEventHandler(t *testing.T) {
 
 	tests := []struct {
 		name             string
-		items            []argoprojiov1alpha1.ApplicationSet
+		items            []argov1alpha1.ApplicationSet
 		secret           corev1.Secret
 		expectedRequests []ctrl.Request
 	}{
 		{
 			name:  "no application sets should mean no requests",
-			items: []argoprojiov1alpha1.ApplicationSet{},
+			items: []argov1alpha1.ApplicationSet{},
 			secret: corev1.Secret{
 				ObjectMeta: v1.ObjectMeta{
 					Namespace: "argocd",
@@ -49,16 +48,16 @@ func TestClusterEventHandler(t *testing.T) {
 		},
 		{
 			name: "a cluster generator should produce a request",
-			items: []argoprojiov1alpha1.ApplicationSet{
+			items: []argov1alpha1.ApplicationSet{
 				{
 					ObjectMeta: v1.ObjectMeta{
 						Name:      "my-app-set",
 						Namespace: "argocd",
 					},
-					Spec: argoprojiov1alpha1.ApplicationSetSpec{
-						Generators: []argoprojiov1alpha1.ApplicationSetGenerator{
+					Spec: argov1alpha1.ApplicationSetSpec{
+						Generators: []argov1alpha1.ApplicationSetGenerator{
 							{
-								Clusters: &argoprojiov1alpha1.ClusterGenerator{},
+								Clusters: &argov1alpha1.ClusterGenerator{},
 							},
 						},
 					},
@@ -79,16 +78,16 @@ func TestClusterEventHandler(t *testing.T) {
 		},
 		{
 			name: "multiple cluster generators should produce multiple requests",
-			items: []argoprojiov1alpha1.ApplicationSet{
+			items: []argov1alpha1.ApplicationSet{
 				{
 					ObjectMeta: v1.ObjectMeta{
 						Name:      "my-app-set",
 						Namespace: "argocd",
 					},
-					Spec: argoprojiov1alpha1.ApplicationSetSpec{
-						Generators: []argoprojiov1alpha1.ApplicationSetGenerator{
+					Spec: argov1alpha1.ApplicationSetSpec{
+						Generators: []argov1alpha1.ApplicationSetGenerator{
 							{
-								Clusters: &argoprojiov1alpha1.ClusterGenerator{},
+								Clusters: &argov1alpha1.ClusterGenerator{},
 							},
 						},
 					},
@@ -98,10 +97,10 @@ func TestClusterEventHandler(t *testing.T) {
 						Name:      "my-app-set2",
 						Namespace: "argocd",
 					},
-					Spec: argoprojiov1alpha1.ApplicationSetSpec{
-						Generators: []argoprojiov1alpha1.ApplicationSetGenerator{
+					Spec: argov1alpha1.ApplicationSetSpec{
+						Generators: []argov1alpha1.ApplicationSetGenerator{
 							{
-								Clusters: &argoprojiov1alpha1.ClusterGenerator{},
+								Clusters: &argov1alpha1.ClusterGenerator{},
 							},
 						},
 					},
@@ -123,16 +122,16 @@ func TestClusterEventHandler(t *testing.T) {
 		},
 		{
 			name: "non-cluster generator should not match",
-			items: []argoprojiov1alpha1.ApplicationSet{
+			items: []argov1alpha1.ApplicationSet{
 				{
 					ObjectMeta: v1.ObjectMeta{
 						Name:      "my-app-set",
 						Namespace: "another-namespace",
 					},
-					Spec: argoprojiov1alpha1.ApplicationSetSpec{
-						Generators: []argoprojiov1alpha1.ApplicationSetGenerator{
+					Spec: argov1alpha1.ApplicationSetSpec{
+						Generators: []argov1alpha1.ApplicationSetGenerator{
 							{
-								Clusters: &argoprojiov1alpha1.ClusterGenerator{},
+								Clusters: &argov1alpha1.ClusterGenerator{},
 							},
 						},
 					},
@@ -142,10 +141,10 @@ func TestClusterEventHandler(t *testing.T) {
 						Name:      "app-set-non-cluster",
 						Namespace: "argocd",
 					},
-					Spec: argoprojiov1alpha1.ApplicationSetSpec{
-						Generators: []argoprojiov1alpha1.ApplicationSetGenerator{
+					Spec: argov1alpha1.ApplicationSetSpec{
+						Generators: []argov1alpha1.ApplicationSetGenerator{
 							{
-								List: &argoprojiov1alpha1.ListGenerator{},
+								List: &argov1alpha1.ListGenerator{},
 							},
 						},
 					},
@@ -167,16 +166,16 @@ func TestClusterEventHandler(t *testing.T) {
 
 		{
 			name: "non-argo cd secret should not match",
-			items: []argoprojiov1alpha1.ApplicationSet{
+			items: []argov1alpha1.ApplicationSet{
 				{
 					ObjectMeta: v1.ObjectMeta{
 						Name:      "my-app-set",
 						Namespace: "another-namespace",
 					},
-					Spec: argoprojiov1alpha1.ApplicationSetSpec{
-						Generators: []argoprojiov1alpha1.ApplicationSetGenerator{
+					Spec: argov1alpha1.ApplicationSetSpec{
+						Generators: []argov1alpha1.ApplicationSetGenerator{
 							{
-								Clusters: &argoprojiov1alpha1.ClusterGenerator{},
+								Clusters: &argov1alpha1.ClusterGenerator{},
 							},
 						},
 					},
@@ -196,7 +195,7 @@ func TestClusterEventHandler(t *testing.T) {
 
 		t.Run(test.name, func(t *testing.T) {
 
-			appSetList := argoprojiov1alpha1.ApplicationSetList{
+			appSetList := argov1alpha1.ApplicationSetList{
 				Items: test.items,
 			}
 

applicationset/examples/cluster/cluster-example-fasttemplate.yaml

@@ -0,0 +1,19 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: guestbook
+spec:
+  generators:
+  - clusters: {}
+  template:
+    metadata:
+      name: '{{name}}-guestbook'
+    spec:
+      project: "default"
+      source:
+        repoURL: https://github.com/argoproj/argocd-example-apps/
+        targetRevision: HEAD
+        path: guestbook
+      destination:
+        server: '{{server}}'
+        namespace: guestbook

applicationset/examples/cluster/cluster-example.yaml

@@ -3,11 +3,12 @@ kind: ApplicationSet
 metadata:
   name: guestbook
 spec:
+  goTemplate: true
   generators:
   - clusters: {}
   template:
     metadata:
-      name: '{{name}}-guestbook'
+      name: '{{.name}}-guestbook'
     spec:
       project: "default"
       source:
@@ -15,5 +16,5 @@ spec:
         targetRevision: HEAD
         path: guestbook
       destination:
-        server: '{{server}}'
+        server: '{{.server}}'
         namespace: guestbook

applicationset/examples/clusterDecisionResource/ducktype-example-fasttemplate.yaml

@@ -0,0 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: book-import
+spec:
+  generators:
+    - clusterDecisionResource:
+        configMapRef: ocm-placement
+        name: test-placement
+        requeueAfterSeconds: 30
+  template:
+    metadata:
+      name: '{{clusterName}}-book-import'
+    spec:
+      project: "default"
+      source:
+        repoURL: https://github.com/open-cluster-management/application-samples.git
+        targetRevision: HEAD
+        path: book-import
+      destination:
+        name: '{{clusterName}}'
+        namespace: bookimport
+      syncPolicy:
+        automated:
+          prune: true
+        syncOptions:
+          - CreateNamespace=true

applicationset/examples/clusterDecisionResource/ducktype-example.yaml

@@ -3,6 +3,7 @@ kind: ApplicationSet
 metadata:
   name: book-import
 spec:
+  goTemplate: true
   generators:
     - clusterDecisionResource:
         configMapRef: ocm-placement
@@ -10,7 +11,7 @@ spec:
         requeueAfterSeconds: 30
   template:
     metadata:
-      name: '{{clusterName}}-book-import'
+      name: '{{.clusterName}}-book-import'
     spec:
       project: "default"
       source:
@@ -18,7 +19,7 @@ spec:
         targetRevision: HEAD
         path: book-import
       destination:
-        name: '{{clusterName}}'
+        name: '{{.clusterName}}'
         namespace: bookimport
       syncPolicy:
         automated:

applicationset/examples/design-doc/applicationset-fasttemplate.yaml

@@ -0,0 +1,22 @@
+# This is an example of a typical ApplicationSet which uses the cluster generator.
+# An ApplicationSet is comprised with two stanzas:
+#  - spec.generator - producer of a list of values supplied as arguments to an app template
+#  - spec.template - an application template, which has been parameterized
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: guestbook
+spec:
+  generators:
+  - clusters: {}
+  template:
+    metadata:
+      name: '{{name}}-guestbook'
+    spec:
+      source:
+        repoURL: https://github.com/infra-team/cluster-deployments.git
+        targetRevision: HEAD
+        chart: guestbook
+      destination:
+        server: '{{server}}'
+        namespace: guestbook

applicationset/examples/design-doc/applicationset.yaml

@@ -7,16 +7,17 @@ kind: ApplicationSet
 metadata:
   name: guestbook
 spec:
+  goTemplate: true
   generators:
   - clusters: {}
   template:
     metadata:
-      name: '{{name}}-guestbook'
+      name: '{{.name}}-guestbook'
     spec:
       source:
         repoURL: https://github.com/infra-team/cluster-deployments.git
         targetRevision: HEAD
         chart: guestbook
       destination:
-        server: '{{server}}'
+        server: '{{.server}}'
         namespace: guestbook

applicationset/examples/design-doc/clusters.yaml

@@ -19,15 +19,15 @@ spec:
         project: default
   template:
     metadata:
-      name: '{{name}}-guestbook'
+      name: '{{.name}}-guestbook'
       labels:
-        environment: '{{metadata.labels.environment}}'
+        environment: '{{.metadata.labels.environment}}'
     spec:
-      project: '{{values.project}}'
+      project: '{{.values.project}}'
       source:
         repoURL: https://github.com/infra-team/cluster-deployments.git
         targetRevision: HEAD
         chart: guestbook
       destination:
-        server: '{{server}}'
+        server: '{{.server}}'
         namespace: guestbook

applicationset/examples/design-doc/git-directory-discovery-fasttemplate.yaml

@@ -0,0 +1,44 @@
+# This example demonstrates the git directory generator, which produces an items list 
+# based on discovery of directories in a git repo matching a specified pattern.
+# Git generators automatically provide {{path}} and {{path.basename}} as available
+# variables to the app template.
+#
+# Suppose the following git directory structure (note the use of different config tools):
+#
+# cluster-deployments
+# └── add-ons
+#     ├── argo-rollouts
+#     │   ├── all.yaml
+#     │   └── kustomization.yaml
+#     ├── argo-workflows
+#     │   └── install.yaml
+#     ├── grafana
+#     │   ├── Chart.yaml
+#     │   └── values.yaml
+#     └── prometheus-operator
+#         ├── Chart.yaml
+#         └── values.yaml
+#
+# The following ApplicationSet would produce four applications (in different namespaces),
+# using the directory basename as both the namespace and application name. 
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: cluster-addons
+spec:
+  generators:
+  - git:
+      repoURL: https://github.com/infra-team/cluster-deployments.git
+      directories:
+      - path: add-ons/*
+  template:
+    metadata:
+      name: '{{path.basename}}'
+    spec:
+      source:
+        repoURL: https://github.com/infra-team/cluster-deployments.git
+        targetRevision: HEAD
+        path: '{{path}}'
+      destination:
+        server: http://kubernetes.default.svc
+        namespace: '{{path.basename}}'

applicationset/examples/design-doc/git-directory-discovery.yaml

@@ -26,6 +26,7 @@ kind: ApplicationSet
 metadata:
   name: cluster-addons
 spec:
+  goTemplate: true
   generators:
   - git:
       repoURL: https://github.com/infra-team/cluster-deployments.git
@@ -33,12 +34,12 @@ spec:
       - path: add-ons/*
   template:
     metadata:
-      name: '{{path.basename}}'
+      name: '{{.path.basename}}'
     spec:
       source:
         repoURL: https://github.com/infra-team/cluster-deployments.git
         targetRevision: HEAD
-        path: '{{path}}'
+        path: '{{.path.path}}'
       destination:
         server: http://kubernetes.default.svc
-        namespace: '{{path.basename}}'
+        namespace: '{{.path.basename}}'

applicationset/examples/design-doc/git-files-discovery-fasttemplate.yaml

@@ -0,0 +1,55 @@
+# This example demonstrates a git file generator which traverses the directory structure of a git
+# repository to discover items based on a filename convention. For each file discovered, the
+# contents of the discovered files themselves, act as the set of inputs to the app template.
+#
+# Suppose the following git directory structure:
+#
+# cluster-deployments
+# ├── apps
+# │   └── guestbook
+# │       └── install.yaml
+# └── cluster-config
+#     ├── engineering
+#     │   ├── dev
+#     │   │   └── config.json
+#     │   └── prod
+#     │       └── config.json
+#     └── finance
+#         ├── dev
+#         │   └── config.json
+#         └── prod
+#             └── config.json
+#
+# The discovered files (e.g. config.json) files can be any structured data supplied to the
+# generated application. e.g.:
+# {
+#    "aws_account": "123456",
+#    "asset_id": "11223344"
+#    "cluster": {
+#        "owner": "Jesse_Suen@intuit.com",
+#        "name": "engineering-dev",
+#        "address": "http://1.2.3.4"
+#    }
+# }
+#
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: guestbook
+spec:
+  generators:
+  - git:
+      repoURL: https://github.com/infra-team/cluster-deployments.git
+      files:
+      - path: "**/config.json"
+  template:
+    metadata:
+      name: '{{cluster.name}}-guestbook'
+    spec:
+      source:
+        repoURL: https://github.com/infra-team/cluster-deployments.git
+        targetRevision: HEAD
+        path: apps/guestbook
+      destination:
+        server: '{{cluster.address}}'
+        namespace: guestbook

applicationset/examples/design-doc/git-files-discovery.yaml

@@ -37,6 +37,7 @@ kind: ApplicationSet
 metadata:
   name: guestbook
 spec:
+  goTemplate: true
   generators:
   - git:
       repoURL: https://github.com/infra-team/cluster-deployments.git
@@ -44,12 +45,12 @@ spec:
       - path: "**/config.json"
   template:
     metadata:
-      name: '{{cluster.name}}-guestbook'
+      name: '{{.cluster.name}}-guestbook'
     spec:
       source:
         repoURL: https://github.com/infra-team/cluster-deployments.git
         targetRevision: HEAD
         path: apps/guestbook
       destination:
-        server: '{{cluster.address}}'
+        server: '{{.cluster.address}}'
         namespace: guestbook

applicationset/examples/design-doc/git-files-literal-fasttemplate.yaml

@@ -0,0 +1,68 @@
+# This example demonstrates a git file generator which produces its items based on one or
+# more files referenced in a git repo. The referenced files would contain a json/yaml list of
+# arbitrary structured objects. Each item of the list would become a set of parameters to a
+# generated application.
+#
+# Suppose the following git directory structure:
+#  
+# cluster-deployments
+# ├── apps
+# │   └── guestbook
+# │       ├── v1.0
+# │       │   └── install.yaml
+# │       └── v2.0
+# │           └── install.yaml
+# └── config
+#     └── clusters.json
+#
+# In this example, the `clusters.json` file is json list of structured data:
+# [
+#     {
+#         "account": "123456",
+#         "asset_id": "11223344",
+#         "cluster": {
+#             "owner": "Jesse_Suen@intuit.com",
+#             "name": "engineering-dev",
+#             "address": "http://1.2.3.4"
+#         },
+#         "appVersions": {
+#             "prometheus-operator": "v0.38",
+#             "guestbook": "v2.0"
+#         }
+#     },
+#     {
+#         "account": "456789",
+#         "asset_id": "55667788",
+#         "cluster": {
+#             "owner": "Alexander_Matyushentsev@intuit.com",
+#             "name": "engineering-prod",
+#             "address": "http://2.4.6.8"
+#         },
+#         "appVersions": {
+#             "prometheus-operator": "v0.38",
+#             "guestbook": "v1.0"
+#         }
+#     }
+# ]
+#
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: guestbook
+spec:
+  generators:
+  - git:
+      repoURL: https://github.com/infra-team/cluster-deployments.git
+      files:
+      - path: config/clusters.json
+  template:
+    metadata:
+      name: '{{cluster.name}}-guestbook'
+    spec:
+      source:
+        repoURL: https://github.com/infra-team/cluster-deployments.git
+        targetRevision: HEAD
+        path: apps/guestbook/{{appVersions.guestbook}}
+      destination:
+        server: http://kubernetes.default.svc
+        namespace: guestbook

applicationset/examples/design-doc/git-files-literal.yaml

@@ -50,6 +50,7 @@ kind: ApplicationSet
 metadata:
   name: guestbook
 spec:
+  goTemplate: true
   generators:
   - git:
       repoURL: https://github.com/infra-team/cluster-deployments.git
@@ -57,12 +58,12 @@ spec:
       - path: config/clusters.json
   template:
     metadata:
-      name: '{{cluster.name}}-guestbook'
+      name: '{{.cluster.name}}-guestbook'
     spec:
       source:
         repoURL: https://github.com/infra-team/cluster-deployments.git
         targetRevision: HEAD
-        path: apps/guestbook/{{appVersions.guestbook}}
+        path: apps/guestbook/{{.appVersions.guestbook}}
       destination:
         server: http://kubernetes.default.svc
         namespace: guestbook

applicationset/examples/design-doc/list-fasttemplate.yaml

@@ -0,0 +1,33 @@
+# The list generator specifies a literal list of argument values to the app spec template.
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: guestbook
+spec:
+  generators:
+  - list:
+      elements:
+      - cluster: engineering-dev
+        url: https://1.2.3.4
+        values:
+          project: dev
+      - cluster: engineering-prod
+        url: https://2.4.6.8
+        values:
+          project: prod
+      - cluster: finance-preprod
+        url: https://9.8.7.6
+        values:
+          project: preprod
+  template:
+    metadata:
+      name: '{{cluster}}-guestbook'
+    spec:
+      project: '{{values.project}}'
+      source:
+        repoURL: https://github.com/infra-team/cluster-deployments.git
+        targetRevision: HEAD
+        path: guestbook/{{cluster}}
+      destination:
+        server: '{{url}}'
+        namespace: guestbook

applicationset/examples/design-doc/list.yaml

@@ -4,6 +4,7 @@ kind: ApplicationSet
 metadata:
   name: guestbook
 spec:
+  goTemplate: true
   generators:
   - list:
       elements:
@@ -21,13 +22,13 @@ spec:
           project: preprod
   template:
     metadata:
-      name: '{{cluster}}-guestbook'
+      name: '{{.cluster}}-guestbook'
     spec:
-      project: '{{values.project}}'
+      project: '{{.values.project}}'
       source:
         repoURL: https://github.com/infra-team/cluster-deployments.git
         targetRevision: HEAD
-        path: guestbook/{{cluster}}
+        path: guestbook/{{.cluster}}
       destination:
-        server: '{{url}}'
+        server: '{{.url}}'
         namespace: guestbook

applicationset/examples/design-doc/template-override-fasttemplate.yaml

@@ -0,0 +1,48 @@
+# App templates can also be defined as part of the generator's template stanza. Sometimes it is
+# useful to do this in order to override the spec.template stanza, and when simple string
+# parameterization are insufficient. In the below examples, the generators[].XXX.template is 
+# a partial definition, which overrides/patch the default template.
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: guestbook
+spec:
+  generators:
+  - list:
+      elements:
+        - cluster: engineering-dev
+          url: https://1.2.3.4
+      template:
+        metadata: {}
+        spec:
+          project: "project"
+          source:
+            repoURL: https://github.com/infra-team/cluster-deployments.git
+            path: '{{cluster}}-override'
+          destination: {}
+
+  - list:
+      elements:
+        - cluster: engineering-prod
+          url: https://1.2.3.4
+      template:
+        metadata: {}
+        spec:
+          project: "project2"
+          source:
+            repoURL: https://github.com/infra-team/cluster-deployments.git
+            path: '{{cluster}}-override2'
+          destination: {}
+
+  template:
+    metadata:
+      name: '{{cluster}}-guestbook'
+    spec:
+      project: "project"
+      source:
+        repoURL: https://github.com/infra-team/cluster-deployments.git
+        targetRevision: HEAD
+        path: guestbook/{{cluster}}
+      destination:
+        server: '{{url}}'
+        namespace: guestbook

applicationset/examples/design-doc/template-override.yaml

@@ -7,6 +7,7 @@ kind: ApplicationSet
 metadata:
   name: guestbook
 spec:
+  goTemplate: true
   generators:
   - list:
       elements:
@@ -18,7 +19,7 @@ spec:
           project: "project"
           source:
             repoURL: https://github.com/infra-team/cluster-deployments.git
-            path: '{{cluster}}-override'
+            path: '{{.cluster}}-override'
           destination: {}
 
   - list:
@@ -31,18 +32,18 @@ spec:
           project: "project2"
           source:
             repoURL: https://github.com/infra-team/cluster-deployments.git
-            path: '{{cluster}}-override2'
+            path: '{{.cluster}}-override2'
           destination: {}
 
   template:
     metadata:
-      name: '{{cluster}}-guestbook'
+      name: '{{.cluster}}-guestbook'
     spec:
       project: "project"
       source:
         repoURL: https://github.com/infra-team/cluster-deployments.git
         targetRevision: HEAD
-        path: guestbook/{{cluster}}
+        path: guestbook/{{.cluster}}
       destination:
-        server: '{{url}}'
+        server: '{{.url}}'
         namespace: guestbook

applicationset/examples/git-generator-directory/cluster-addons/argo-workflows/kustomization.yaml

@@ -1,6 +1,6 @@
 #namePrefix: kustomize-
 
 resources:
-- namespace-install.yaml
+- https://github.com/argoproj/argo-workflows/releases/download/v3.4.0/namespace-install.yaml
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

applicationset/examples/git-generator-directory/cluster-addons/argo-workflows/namespace-install.yaml

@@ -1,417 +0,0 @@
-# This is an auto-generated file. DO NOT EDIT
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: clusterworkflowtemplates.argoproj.io
-spec:
-  group: argoproj.io
-  names:
-    kind: ClusterWorkflowTemplate
-    listKind: ClusterWorkflowTemplateList
-    plural: clusterworkflowtemplates
-    shortNames:
-    - clusterwftmpl
-    - cwft
-    singular: clusterworkflowtemplate
-  scope: Cluster
-  version: v1alpha1
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: cronworkflows.argoproj.io
-spec:
-  group: argoproj.io
-  names:
-    kind: CronWorkflow
-    listKind: CronWorkflowList
-    plural: cronworkflows
-    shortNames:
-    - cwf
-    - cronwf
-    singular: cronworkflow
-  scope: Namespaced
-  version: v1alpha1
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: workfloweventbindings.argoproj.io
-spec:
-  group: argoproj.io
-  names:
-    kind: WorkflowEventBinding
-    listKind: WorkflowEventBindingList
-    plural: workfloweventbindings
-    shortNames:
-    - wfeb
-    singular: workfloweventbinding
-  scope: Namespaced
-  version: v1alpha1
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: workflows.argoproj.io
-spec:
-  additionalPrinterColumns:
-  - JSONPath: .status.phase
-    description: Status of the workflow
-    name: Status
-    type: string
-  - JSONPath: .status.startedAt
-    description: When the workflow was started
-    format: date-time
-    name: Age
-    type: date
-  group: argoproj.io
-  names:
-    kind: Workflow
-    listKind: WorkflowList
-    plural: workflows
-    shortNames:
-    - wf
-    singular: workflow
-  scope: Namespaced
-  subresources: {}
-  version: v1alpha1
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: workflowtemplates.argoproj.io
-spec:
-  group: argoproj.io
-  names:
-    kind: WorkflowTemplate
-    listKind: WorkflowTemplateList
-    plural: workflowtemplates
-    shortNames:
-    - wftmpl
-    singular: workflowtemplate
-  scope: Namespaced
-  version: v1alpha1
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: argo
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: argo-server
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: argo-role
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/exec
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  verbs:
-  - get
-  - watch
-  - list
-- apiGroups:
-  - ""
-  resources:
-  - persistentvolumeclaims
-  verbs:
-  - create
-  - delete
-  - get
-- apiGroups:
-  - argoproj.io
-  resources:
-  - workflows
-  - workflows/finalizers
-  verbs:
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-  - create
-- apiGroups:
-  - argoproj.io
-  resources:
-  - workflowtemplates
-  - workflowtemplates/finalizers
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - serviceaccounts
-  verbs:
-  - get
-  - list
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - get
-- apiGroups:
-  - argoproj.io
-  resources:
-  - cronworkflows
-  - cronworkflows/finalizers
-  verbs:
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - ""
-  resources:
-  - events
-  verbs:
-  - create
-  - patch
-- apiGroups:
-  - policy
-  resources:
-  - poddisruptionbudgets
-  verbs:
-  - create
-  - get
-  - delete
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: argo-server-role
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  verbs:
-  - get
-  - watch
-  - list
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - get
-  - create
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/exec
-  - pods/log
-  verbs:
-  - get
-  - list
-  - watch
-  - delete
-- apiGroups:
-  - ""
-  resources:
-  - events
-  verbs:
-  - watch
-  - create
-  - patch
-- apiGroups:
-  - ""
-  resources:
-  - serviceaccounts
-  verbs:
-  - get
-  - list
-- apiGroups:
-  - argoproj.io
-  resources:
-  - workflows
-  - workfloweventbindings
-  - workflowtemplates
-  - cronworkflows
-  - cronworkflows/finalizers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: argo-binding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: argo-role
-subjects:
-- kind: ServiceAccount
-  name: argo
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: argo-server-binding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: argo-server-role
-subjects:
-- kind: ServiceAccount
-  name: argo-server
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: workflow-controller-configmap
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: argo-server
-spec:
-  ports:
-  - name: web
-    port: 2746
-    targetPort: 2746
-  selector:
-    app: argo-server
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: workflow-controller-metrics
-spec:
-  ports:
-  - name: metrics
-    port: 9090
-    protocol: TCP
-    targetPort: 9090
-  selector:
-    app: workflow-controller
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: argo-server
-spec:
-  selector:
-    matchLabels:
-      app: argo-server
-  template:
-    metadata:
-      labels:
-        app: argo-server
-    spec:
-      containers:
-      - args:
-        - server
-        - --namespaced
-        image: argoproj/argocli:v2.12.5
-        name: argo-server
-        ports:
-        - containerPort: 2746
-          name: web
-        readinessProbe:
-          httpGet:
-            path: /
-            port: 2746
-            scheme: HTTP
-          initialDelaySeconds: 10
-          periodSeconds: 20
-        volumeMounts:
-        - mountPath: /tmp
-          name: tmp
-      nodeSelector:
-        kubernetes.io/os: linux
-      securityContext:
-        runAsNonRoot: true
-      serviceAccountName: argo-server
-      volumes:
-      - emptyDir: {}
-        name: tmp
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: workflow-controller
-spec:
-  selector:
-    matchLabels:
-      app: workflow-controller
-  template:
-    metadata:
-      labels:
-        app: workflow-controller
-    spec:
-      containers:
-      - args:
-        - --configmap
-        - workflow-controller-configmap
-        - --executor-image
-        - argoproj/argoexec:v2.12.5
-        - --namespaced
-        command:
-        - workflow-controller
-        image: argoproj/workflow-controller:v2.12.5
-        livenessProbe:
-          httpGet:
-            path: /metrics
-            port: metrics
-          initialDelaySeconds: 30
-          periodSeconds: 30
-        name: workflow-controller
-        ports:
-        - containerPort: 9090
-          name: metrics
-      nodeSelector:
-        kubernetes.io/os: linux
-      securityContext:
-        runAsNonRoot: true
-      serviceAccountName: argo

applicationset/examples/git-generator-directory/cluster-addons/prometheus-operator/Chart.yaml

@@ -11,4 +11,4 @@ version: 0.1.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: "1.0"
+appVersion: "1.0"

applicationset/examples/git-generator-directory/cluster-addons/prometheus-operator/requirements.yaml

@@ -1,4 +1,4 @@
 dependencies:
 - name: kube-prometheus-stack
-  version: 9.4.10
+  version: 40.5.0
   repository: https://prometheus-community.github.io/helm-charts

applicationset/examples/git-generator-directory/excludes/cluster-addons/argo-workflows/kustomization.yaml

@@ -1,6 +1,6 @@
 #namePrefix: kustomize-
 
 resources:
-- namespace-install.yaml
+- https://github.com/argoproj/argo-workflows/releases/download/v3.4.0/namespace-install.yaml
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

applicationset/examples/git-generator-directory/excludes/cluster-addons/argo-workflows/namespace-install.yaml

@@ -1,417 +0,0 @@
-# This is an auto-generated file. DO NOT EDIT
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: clusterworkflowtemplates.argoproj.io
-spec:
-  group: argoproj.io
-  names:
-    kind: ClusterWorkflowTemplate
-    listKind: ClusterWorkflowTemplateList
-    plural: clusterworkflowtemplates
-    shortNames:
-    - clusterwftmpl
-    - cwft
-    singular: clusterworkflowtemplate
-  scope: Cluster
-  version: v1alpha1
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: cronworkflows.argoproj.io
-spec:
-  group: argoproj.io
-  names:
-    kind: CronWorkflow
-    listKind: CronWorkflowList
-    plural: cronworkflows
-    shortNames:
-    - cwf
-    - cronwf
-    singular: cronworkflow
-  scope: Namespaced
-  version: v1alpha1
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: workfloweventbindings.argoproj.io
-spec:
-  group: argoproj.io
-  names:
-    kind: WorkflowEventBinding
-    listKind: WorkflowEventBindingList
-    plural: workfloweventbindings
-    shortNames:
-    - wfeb
-    singular: workfloweventbinding
-  scope: Namespaced
-  version: v1alpha1
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: workflows.argoproj.io
-spec:
-  additionalPrinterColumns:
-  - JSONPath: .status.phase
-    description: Status of the workflow
-    name: Status
-    type: string
-  - JSONPath: .status.startedAt
-    description: When the workflow was started
-    format: date-time
-    name: Age
-    type: date
-  group: argoproj.io
-  names:
-    kind: Workflow
-    listKind: WorkflowList
-    plural: workflows
-    shortNames:
-    - wf
-    singular: workflow
-  scope: Namespaced
-  subresources: {}
-  version: v1alpha1
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: workflowtemplates.argoproj.io
-spec:
-  group: argoproj.io
-  names:
-    kind: WorkflowTemplate
-    listKind: WorkflowTemplateList
-    plural: workflowtemplates
-    shortNames:
-    - wftmpl
-    singular: workflowtemplate
-  scope: Namespaced
-  version: v1alpha1
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: argo
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: argo-server
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: argo-role
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/exec
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  verbs:
-  - get
-  - watch
-  - list
-- apiGroups:
-  - ""
-  resources:
-  - persistentvolumeclaims
-  verbs:
-  - create
-  - delete
-  - get
-- apiGroups:
-  - argoproj.io
-  resources:
-  - workflows
-  - workflows/finalizers
-  verbs:
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-  - create
-- apiGroups:
-  - argoproj.io
-  resources:
-  - workflowtemplates
-  - workflowtemplates/finalizers
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - serviceaccounts
-  verbs:
-  - get
-  - list
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - get
-- apiGroups:
-  - argoproj.io
-  resources:
-  - cronworkflows
-  - cronworkflows/finalizers
-  verbs:
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - ""
-  resources:
-  - events
-  verbs:
-  - create
-  - patch
-- apiGroups:
-  - policy
-  resources:
-  - poddisruptionbudgets
-  verbs:
-  - create
-  - get
-  - delete
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: argo-server-role
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  verbs:
-  - get
-  - watch
-  - list
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - get
-  - create
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/exec
-  - pods/log
-  verbs:
-  - get
-  - list
-  - watch
-  - delete
-- apiGroups:
-  - ""
-  resources:
-  - events
-  verbs:
-  - watch
-  - create
-  - patch
-- apiGroups:
-  - ""
-  resources:
-  - serviceaccounts
-  verbs:
-  - get
-  - list
-- apiGroups:
-  - argoproj.io
-  resources:
-  - workflows
-  - workfloweventbindings
-  - workflowtemplates
-  - cronworkflows
-  - cronworkflows/finalizers
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: argo-binding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: argo-role
-subjects:
-- kind: ServiceAccount
-  name: argo
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: argo-server-binding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: argo-server-role
-subjects:
-- kind: ServiceAccount
-  name: argo-server
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: workflow-controller-configmap
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: argo-server
-spec:
-  ports:
-  - name: web
-    port: 2746
-    targetPort: 2746
-  selector:
-    app: argo-server
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: workflow-controller-metrics
-spec:
-  ports:
-  - name: metrics
-    port: 9090
-    protocol: TCP
-    targetPort: 9090
-  selector:
-    app: workflow-controller
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: argo-server
-spec:
-  selector:
-    matchLabels:
-      app: argo-server
-  template:
-    metadata:
-      labels:
-        app: argo-server
-    spec:
-      containers:
-      - args:
-        - server
-        - --namespaced
-        image: argoproj/argocli:v2.12.5
-        name: argo-server
-        ports:
-        - containerPort: 2746
-          name: web
-        readinessProbe:
-          httpGet:
-            path: /
-            port: 2746
-            scheme: HTTP
-          initialDelaySeconds: 10
-          periodSeconds: 20
-        volumeMounts:
-        - mountPath: /tmp
-          name: tmp
-      nodeSelector:
-        kubernetes.io/os: linux
-      securityContext:
-        runAsNonRoot: true
-      serviceAccountName: argo-server
-      volumes:
-      - emptyDir: {}
-        name: tmp
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: workflow-controller
-spec:
-  selector:
-    matchLabels:
-      app: workflow-controller
-  template:
-    metadata:
-      labels:
-        app: workflow-controller
-    spec:
-      containers:
-      - args:
-        - --configmap
-        - workflow-controller-configmap
-        - --executor-image
-        - argoproj/argoexec:v2.12.5
-        - --namespaced
-        command:
-        - workflow-controller
-        image: argoproj/workflow-controller:v2.12.5
-        livenessProbe:
-          httpGet:
-            path: /metrics
-            port: metrics
-          initialDelaySeconds: 30
-          periodSeconds: 30
-        name: workflow-controller
-        ports:
-        - containerPort: 9090
-          name: metrics
-      nodeSelector:
-        kubernetes.io/os: linux
-      securityContext:
-        runAsNonRoot: true
-      serviceAccountName: argo

applicationset/examples/git-generator-directory/excludes/cluster-addons/prometheus-operator/Chart.yaml

@@ -1 +1,14 @@
+apiVersion: v2
 name: helm-prometheus-operator
+
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+appVersion: "1.0"

applicationset/examples/git-generator-directory/excludes/cluster-addons/prometheus-operator/requirements.yaml

@@ -1,4 +1,4 @@
 dependencies:
 - name: kube-prometheus-stack
-  version: 9.4.10
+  version: 40.5.0
   repository: https://prometheus-community.github.io/helm-charts

applicationset/examples/git-generator-directory/excludes/git-directories-exclude-example-fasttemplate.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: cluster-addons
+  namespace: argocd
+spec:
+  generators:
+  - git:
+      repoURL: https://github.com/argoproj/argo-cd.git
+      revision: HEAD
+      directories:
+      - path: applicationset/examples/git-generator-directory/excludes/cluster-addons/*
+      - exclude: true
+        path: applicationset/examples/git-generator-directory/excludes/cluster-addons/exclude-helm-guestbook
+  template:
+    metadata:
+      name: '{{path.basename}}'
+    spec:
+      project: "my-project"
+      source:
+        repoURL: https://github.com/argoproj/argo-cd.git
+        targetRevision: HEAD
+        path: '{{path}}'
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: '{{path.basename}}'
+      syncPolicy:
+        syncOptions:
+        - CreateNamespace=true

applicationset/examples/git-generator-directory/excludes/git-directories-exclude-example.yaml

@@ -2,7 +2,9 @@ apiVersion: argoproj.io/v1alpha1
 kind: ApplicationSet
 metadata:
   name: cluster-addons
+  namespace: argocd
 spec:
+  goTemplate: true
   generators:
   - git:
       repoURL: https://github.com/argoproj/argo-cd.git
@@ -13,13 +15,16 @@ spec:
         path: applicationset/examples/git-generator-directory/excludes/cluster-addons/exclude-helm-guestbook
   template:
     metadata:
-      name: '{{path.basename}}'
+      name: '{{.path.basename}}'
     spec:
-      project: default
+      project: "my-project"
       source:
         repoURL: https://github.com/argoproj/argo-cd.git
         targetRevision: HEAD
-        path: '{{path}}'
+        path: '{{.path}}'
       destination:
         server: https://kubernetes.default.svc
-        namespace: '{{path.basename}}'
+        namespace: '{{.path.basename}}'
+      syncPolicy:
+        syncOptions:
+        - CreateNamespace=true

applicationset/examples/git-generator-directory/git-directories-example-fasttemplate.yaml

@@ -0,0 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: cluster-addons
+  namespace: argocd
+spec:
+  generators:
+  - git:
+      repoURL: https://github.com/argoproj/argo-cd.git
+      revision: HEAD
+      directories:
+      - path: applicationset/examples/git-generator-directory/cluster-addons/*
+  template:
+    metadata:
+      name: '{{path.basename}}'
+    spec:
+      project: "my-project"
+      source:
+        repoURL: https://github.com/argoproj/argo-cd.git
+        targetRevision: HEAD
+        path: '{{path}}'
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: '{{path.basename}}'
+      syncPolicy:
+        syncOptions:
+        - CreateNamespace=true

applicationset/examples/git-generator-directory/git-directories-example.yaml

@@ -2,7 +2,9 @@ apiVersion: argoproj.io/v1alpha1
 kind: ApplicationSet
 metadata:
   name: cluster-addons
+  namespace: argocd
 spec:
+  goTemplate: true
   generators:
   - git:
       repoURL: https://github.com/argoproj/argo-cd.git
@@ -11,13 +13,16 @@ spec:
       - path: applicationset/examples/git-generator-directory/cluster-addons/*
   template:
     metadata:
-      name: '{{path.basename}}'
+      name: '{{.path.basename}}'
     spec:
-      project: default
+      project: "my-project"
       source:
         repoURL: https://github.com/argoproj/argo-cd.git
         targetRevision: HEAD
-        path: '{{path}}'
+        path: '{{.path.path}}'
       destination:
         server: https://kubernetes.default.svc
-        namespace: '{{path.basename}}'
+        namespace: '{{.path.basename}}'
+      syncPolicy:
+        syncOptions:
+        - CreateNamespace=true

applicationset/examples/git-generator-files-discovery/git-generator-files-fasttemplate.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: guestbook
+spec:
+  generators:
+    - git:
+        repoURL: https://github.com/argoproj/argo-cd.git
+        revision: HEAD
+        files:
+        - path: "applicationset/examples/git-generator-files-discovery/cluster-config/**/config.json"
+  template:
+    metadata:
+      name: '{{cluster.name}}-guestbook'
+    spec:
+      project: default
+      source:
+        repoURL: https://github.com/argoproj/argo-cd.git
+        targetRevision: HEAD
+        path: "applicationset/examples/git-generator-files-discovery/apps/guestbook"
+      destination:
+        server: https://kubernetes.default.svc
+        #server: '{{cluster.address}}'
+        namespace: guestbook

applicationset/examples/git-generator-files-discovery/git-generator-files.yaml

@@ -3,6 +3,7 @@ kind: ApplicationSet
 metadata:
   name: guestbook
 spec:
+  goTemplate: true
   generators:
     - git:
         repoURL: https://github.com/argoproj/argo-cd.git
@@ -11,7 +12,7 @@ spec:
         - path: "applicationset/examples/git-generator-files-discovery/cluster-config/**/config.json"
   template:
     metadata:
-      name: '{{cluster.name}}-guestbook'
+      name: '{{.cluster.name}}-guestbook'
     spec:
       project: default
       source:
@@ -20,5 +21,5 @@ spec:
         path: "applicationset/examples/git-generator-files-discovery/apps/guestbook"
       destination:
         server: https://kubernetes.default.svc
-        #server: '{{cluster.address}}'
+        #server: '{{.cluster.address}}'
         namespace: guestbook

applicationset/examples/list-generator/list-example-fasttemplate.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: guestbook
+spec:
+  generators:
+  - list:
+      elements:
+      - cluster: engineering-dev
+        url: https://kubernetes.default.svc
+      - cluster: engineering-prod
+        url: https://kubernetes.default.svc
+  template:
+    metadata:
+      name: '{{cluster}}-guestbook'
+    spec:
+      project: default
+      source:
+        repoURL: https://github.com/argoproj/argo-cd.git
+        targetRevision: HEAD
+        path: applicationset/examples/list-generator/guestbook/{{cluster}}
+      destination:
+        server: '{{url}}'
+        namespace: guestbook

applicationset/examples/list-generator/list-example.yaml

@@ -3,6 +3,7 @@ kind: ApplicationSet
 metadata:
   name: guestbook
 spec:
+  goTemplate: true
   generators:
   - list:
       elements:
@@ -12,13 +13,13 @@ spec:
         url: https://kubernetes.default.svc
   template:
     metadata:
-      name: '{{cluster}}-guestbook'
+      name: '{{.cluster}}-guestbook'
     spec:
       project: default
       source:
         repoURL: https://github.com/argoproj/argo-cd.git
         targetRevision: HEAD
-        path: applicationset/examples/list-generator/guestbook/{{cluster}}
+        path: applicationset/examples/list-generator/guestbook/{{.cluster}}
       destination:
-        server: '{{url}}'
+        server: '{{.url}}'
         namespace: guestbook

applicationset/examples/matrix/cluster-and-git-fasttemplate.yaml

@@ -0,0 +1,33 @@
+# This example demonstrates the combining of the git generator with a cluster generator
+# The expected output would be an application per git directory and a cluster (application_count = git directory * clusters)
+#
+#
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: cluster-git
+spec:
+  generators:
+  - matrix:
+      generators:
+        - git:
+            repoURL: https://github.com/argoproj/argo-cd.git
+            revision: HEAD
+            directories:
+            - path: applicationset/examples/matrix/cluster-addons/*
+        - clusters:
+            selector:
+              matchLabels:
+                argocd.argoproj.io/secret-type: cluster
+  template:
+    metadata:
+      name: '{{path.basename}}-{{name}}'
+    spec:
+      project: '{{metadata.labels.environment}}'
+      source:
+        repoURL: https://github.com/argoproj/argo-cd.git
+        targetRevision: HEAD
+        path: '{{path}}'
+      destination:
+        server: '{{server}}'
+        namespace: '{{path.basename}}'

applicationset/examples/matrix/cluster-and-git.yaml

@@ -7,6 +7,7 @@ kind: ApplicationSet
 metadata:
   name: cluster-git
 spec:
+  goTemplate: true
   generators:
   - matrix:
       generators:
@@ -21,13 +22,13 @@ spec:
                 argocd.argoproj.io/secret-type: cluster
   template:
     metadata:
-      name: '{{path.basename}}-{{name}}'
+      name: '{{.path.basename}}-{{.name}}'
     spec:
-      project: '{{metadata.labels.environment}}'
+      project: '{{.metadata.labels.environment}}'
       source:
         repoURL: https://github.com/argoproj/argo-cd.git
         targetRevision: HEAD
-        path: '{{path}}'
+        path: '{{.path.path}}'
       destination:
-        server: '{{server}}'
-        namespace: '{{path.basename}}'
+        server: '{{.server}}'
+        namespace: '{{.path.basename}}'

applicationset/examples/matrix/list-and-git-fasttemplate.yaml

@@ -0,0 +1,39 @@
+# This example demonstrates the combining of the git generator with a list generator
+# The expected output would be an application per git directory and a list entry (application_count = git directory * list entries)
+#
+#
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: list-git
+spec:
+  generators:
+  - matrix:
+      generators:
+      - git:
+          repoURL: https://github.com/argoproj/argo-cd.git
+          revision: HEAD
+          directories:
+          - path: applicationset/examples/matrix/cluster-addons/*
+      - list:
+          elements:
+          - cluster: engineering-dev
+            url: https://1.2.3.4
+            values:
+              project: dev
+          - cluster: engineering-prod
+            url: https://2.4.6.8
+            values:
+              project: prod
+  template:
+    metadata:
+      name: '{{path.basename}}-{{cluster}}'
+    spec:
+      project: '{{values.project}}'
+      source:
+        repoURL: https://github.com/argoproj/argo-cd.git
+        targetRevision: HEAD
+        path: '{{path}}'
+      destination:
+        server: '{{url}}'
+        namespace: '{{path.basename}}'

applicationset/examples/matrix/list-and-git.yaml

@@ -7,6 +7,7 @@ kind: ApplicationSet
 metadata:
   name: list-git
 spec:
+  goTemplate: true
   generators:
   - matrix:
       generators:
@@ -27,13 +28,13 @@ spec:
               project: prod
   template:
     metadata:
-      name: '{{path.basename}}-{{cluster}}'
+      name: '{{.path.basename}}-{{.cluster}}'
     spec:
-      project: '{{values.project}}'
+      project: '{{.values.project}}'
       source:
         repoURL: https://github.com/argoproj/argo-cd.git
         targetRevision: HEAD
-        path: '{{path}}'
+        path: '{{.path.path}}'
       destination:
-        server: '{{url}}'
-        namespace: '{{path.basename}}'
+        server: '{{.url}}'
+        namespace: '{{.path.basename}}'

applicationset/examples/matrix/list-and-list-fasttemplate.yaml

@@ -0,0 +1,37 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: list-and-list
+  namespace: argocd
+spec:
+  generators:
+    - matrix:
+        generators:
+          - list:
+              elements:
+                - cluster: engineering-dev
+                  url: https://kubernetes.default.svc
+                  values:
+                    project: default
+                - cluster: engineering-prod
+                  url: https://kubernetes.default.svc
+                  values:
+                    project: default
+          - list:
+              elements:
+                - values:
+                    suffix: '1'
+                - values:
+                    suffix: '2'
+  template:
+    metadata:
+      name: '{{cluster}}-{{values.suffix}}'
+    spec:
+      project: '{{values.project}}'
+      source:
+        repoURL: https://github.com/argoproj/argo-cd.git
+        targetRevision: HEAD
+        path: '{{path}}'
+      destination:
+        server: '{{url}}'
+        namespace: '{{path.basename}}'

applicationset/examples/matrix/list-and-list.yaml

@@ -4,6 +4,7 @@ metadata:
   name: list-and-list
   namespace: argocd
 spec:
+  goTemplate: true
   generators:
     - matrix:
         generators:
@@ -25,13 +26,13 @@ spec:
                     suffix: '2'
   template:
     metadata:
-      name: '{{cluster}}-{{values.suffix}}'
+      name: '{{.cluster}}-{{.values.suffix}}'
     spec:
-      project: '{{values.project}}'
+      project: '{{.values.project}}'
       source:
         repoURL: https://github.com/argoproj/argo-cd.git
         targetRevision: HEAD
-        path: '{{path}}'
+        path: '{{.path.path}}'
       destination:
-        server: '{{url}}'
-        namespace: '{{path.basename}}'
+        server: '{{.url}}'
+        namespace: '{{.path.basename}}'

applicationset/examples/matrix/matrix-and-union-in-matrix-fasttemplate.yaml

@@ -0,0 +1,67 @@
+# The matrix generator can contain other combination-type generators (matrix and union). But nested matrix and union
+# generators cannot contain further-nested matrix or union generators.
+#
+# The generators are evaluated from most-nested to least-nested. In this case:
+#  1. The union generator joins two lists to make 3 parameter sets.
+#  2. The inner matrix generator takes the cartesian product of the two lists to make 4 parameters sets.
+#  3. The outer matrix generator takes the cartesian product of the 3 union and the 4 inner matrix parameter sets to
+#     make 3*4=12 final parameter sets.
+#  4. The 12 final parameter sets are evaluated against the top-level template to generate 12 Applications.
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: matrix-and-union-in-matrix
+spec:
+  generators:
+    - matrix:
+        generators:
+          - union:
+              mergeKeys:
+                - cluster
+              generators:
+                - list:
+                    elements:
+                      - cluster: engineering-dev
+                        url: https://kubernetes.default.svc
+                        values:
+                          project: default
+                      - cluster: engineering-prod
+                        url: https://kubernetes.default.svc
+                        values:
+                          project: default
+                - list:
+                    elements:
+                      - cluster: engineering-dev
+                        url: https://kubernetes.default.svc
+                        values:
+                          project: default
+                      - cluster: engineering-test
+                        url: https://kubernetes.default.svc
+                        values:
+                          project: default
+          - matrix:
+              generators:
+                - list:
+                    elements:
+                      - values:
+                          suffix: '1'
+                      - values:
+                          suffix: '2'
+                - list:
+                    elements:
+                      - values:
+                          prefix: 'first'
+                      - values:
+                          prefix: 'second'
+  template:
+    metadata:
+      name: '{{values.prefix}}-{{cluster}}-{{values.suffix}}'
+    spec:
+      project: '{{values.project}}'
+      source:
+        repoURL: https://github.com/argoproj/argo-cd.git
+        targetRevision: HEAD
+        path: '{{path}}'
+      destination:
+        server: '{{url}}'
+        namespace: '{{path.basename}}'

applicationset/examples/matrix/matrix-and-union-in-matrix.yaml

@@ -12,6 +12,7 @@ kind: ApplicationSet
 metadata:
   name: matrix-and-union-in-matrix
 spec:
+  goTemplate: true
   generators:
     - matrix:
         generators:
@@ -55,13 +56,13 @@ spec:
                           prefix: 'second'
   template:
     metadata:
-      name: '{{values.prefix}}-{{cluster}}-{{values.suffix}}'
+      name: '{{.values.prefix}}-{{.cluster}}-{{.values.suffix}}'
     spec:
-      project: '{{values.project}}'
+      project: '{{.values.project}}'
       source:
         repoURL: https://github.com/argoproj/argo-cd.git
         targetRevision: HEAD
-        path: '{{path}}'
+        path: '{{.path.path}}'
       destination:
-        server: '{{url}}'
-        namespace: '{{path.basename}}'
+        server: '{{.url}}'
+        namespace: '{{.path.basename}}'

applicationset/examples/merge/merge-clusters-and-list-fasttemplate.yaml

@@ -0,0 +1,44 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: merge-clusters-and-list
+spec:
+  generators:
+    - merge:
+        mergeKeys:
+          - server
+        generators:
+          - clusters:
+              values:
+                kafka: 'true'
+                redis: 'false'
+          # For clusters with a specific label, enable Kafka.
+          - clusters:
+              selector:
+                matchLabels:
+                  use-kafka: 'false'
+              values:
+                kafka: 'false'
+          # For a specific cluster, enable Redis.
+          - list:
+              elements:
+                - server: https://some-specific-cluster
+                  values.redis: 'true'
+  template:
+    metadata:
+      name: '{{name}}'
+    spec:
+      project: default
+      source:
+        repoURL: https://github.com/argoproj/argocd-example-apps/
+        targetRevision: HEAD
+        path: helm-guestbook
+        helm:
+          parameters:
+            - name: kafka
+              value: '{{values.kafka}}'
+            - name: redis
+              value: '{{values.redis}}'
+      destination:
+        server: '{{server}}'
+        namespace: default

applicationset/examples/merge/merge-clusters-and-list.yaml

@@ -3,6 +3,7 @@ kind: ApplicationSet
 metadata:
   name: merge-clusters-and-list
 spec:
+  goTemplate: true
   generators:
     - merge:
         mergeKeys:
@@ -26,7 +27,7 @@ spec:
                   values.redis: 'true'
   template:
     metadata:
-      name: '{{name}}'
+      name: '{{.name}}'
     spec:
       project: default
       source:
@@ -36,9 +37,9 @@ spec:
         helm:
           parameters:
             - name: kafka
-              value: '{{values.kafka}}'
+              value: '{{.values.kafka}}'
             - name: redis
-              value: '{{values.redis}}'
+              value: '{{.values.redis}}'
       destination:
-        server: '{{server}}'
+        server: '{{.server}}'
         namespace: default

applicationset/examples/merge/merge-two-matrixes-fasttemplate.yaml

@@ -0,0 +1,43 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: merge-two-matrixes
+spec:
+  generators:
+    - merge:
+        mergeKeys:
+          - server
+          - environment
+        generators:
+          - matrix:
+              generators:
+                - clusters:
+                    values:
+                      replicaCount: '2'
+                - list:
+                    elements:
+                      - environment: staging
+                        namespace: guestbook-non-prod
+                      - environment: prod
+                        namespace: guestbook
+          - list:
+              elements:
+                - server: https://kubernetes.default.svc
+                  environment: staging
+                  values.replicaCount: '1'
+  template:
+    metadata:
+      name: '{{name}}-guestbook-{{environment}}'
+    spec:
+      project: default
+      source:
+        repoURL: https://github.com/argoproj/argocd-example-apps/
+        targetRevision: HEAD
+        path: helm-guestbook
+        helm:
+          parameters:
+            - name: replicaCount
+              value: '{{values.replicaCount}}'
+      destination:
+        server: '{{server}}'
+        namespace: '{{namespace}}'

applicationset/examples/merge/merge-two-matrixes.yaml

@@ -3,6 +3,7 @@ kind: ApplicationSet
 metadata:
   name: merge-two-matrixes
 spec:
+  goTemplate: true
   generators:
     - merge:
         mergeKeys:
@@ -27,7 +28,7 @@ spec:
                   values.replicaCount: '1'
   template:
     metadata:
-      name: '{{name}}-guestbook-{{environment}}'
+      name: '{{.name}}-guestbook-{{.environment}}'
     spec:
       project: default
       source:
@@ -37,7 +38,7 @@ spec:
         helm:
           parameters:
             - name: replicaCount
-              value: '{{values.replicaCount}}'
+              value: '{{.values.replicaCount}}'
       destination:
-        server: '{{server}}'
-        namespace: '{{namespace}}'
+        server: '{{.server}}'
+        namespace: '{{.namespace}}'

applicationset/examples/pull-request-generator/pull-request-example-fasttemplate.yaml

@@ -0,0 +1,40 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: myapp
+spec:
+  generators:
+  - pullRequest:
+      github:
+        # The GitHub organization or user.
+        owner: myorg
+        # The Github repository
+        repo: myrepo
+        # For GitHub Enterprise. (optional)
+        api: https://git.example.com/
+        # Reference to a Secret containing an access token. (optional)
+        tokenRef:
+          secretName: github-token
+          key: token
+        # Labels is used to filter the PRs that you want to target. (optional)
+        labels:
+        - preview
+  template:
+    metadata:
+      name: 'myapp-{{ branch }}-{{ number }}'
+    spec:
+      source:
+        repoURL: 'https://github.com/myorg/myrepo.git'
+        targetRevision: '{{ head_sha }}'
+        path: helm-guestbook
+        helm:
+          parameters:
+          - name: "image.tag"
+            value: "pull-{{ head_sha }}"
+      project: default
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: "{{ branch }}-{{ number }}"
+      syncPolicy:
+        syncOptions:
+        - CreateNamespace=true

applicationset/examples/pull-request-generator/pull-request-example.yaml

@@ -3,6 +3,7 @@ kind: ApplicationSet
 metadata:
   name: myapp
 spec:
+  goTemplate: true
   generators:
   - pullRequest:
       github:
@@ -21,20 +22,20 @@ spec:
         - preview
   template:
     metadata:
-      name: 'myapp-{{ branch }}-{{ number }}'
+      name: 'myapp-{{ .branch }}-{{ .number }}'
     spec:
       source:
         repoURL: 'https://github.com/myorg/myrepo.git'
-        targetRevision: '{{ head_sha }}'
+        targetRevision: '{{ .head_sha }}'
         path: helm-guestbook
         helm:
           parameters:
           - name: "image.tag"
-            value: "pull-{{ head_sha }}"
+            value: "pull-{{ .head_sha }}"
       project: default
       destination:
         server: https://kubernetes.default.svc
-        namespace: "{{ branch }}-{{ number }}"
+        namespace: "{{ .branch }}-{{ .number }}"
       syncPolicy:
         syncOptions:
         - CreateNamespace=true

applicationset/examples/scm-provider-generator/scm-provider-example-fasttemplate.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: guestbook
+spec:
+  generators:
+  - scmProvider:
+      github:
+        organization: argoproj
+      cloneProtocol: https
+      filters:
+      - repositoryMatch: example-apps
+  template:
+    metadata:
+      name: '{{ repository }}-guestbook'
+    spec:
+      project: "default"
+      source:
+        repoURL: '{{ url }}'
+        targetRevision: '{{ branch }}'
+        path: guestbook
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: guestbook

applicationset/examples/scm-provider-generator/scm-provider-example.yaml

@@ -3,6 +3,7 @@ kind: ApplicationSet
 metadata:
   name: guestbook
 spec:
+  goTemplate: true
   generators:
   - scmProvider:
       github:
@@ -12,12 +13,12 @@ spec:
       - repositoryMatch: example-apps
   template:
     metadata:
-      name: '{{ repository }}-guestbook'
+      name: '{{ .repository }}-guestbook'
     spec:
       project: "default"
       source:
-        repoURL: '{{ url }}'
-        targetRevision: '{{ branch }}'
+        repoURL: '{{ .url }}'
+        targetRevision: '{{ .branch }}'
         path: guestbook
       destination:
         server: https://kubernetes.default.svc

applicationset/examples/template-override/template-overrides-example-fasttemplate.yaml

@@ -0,0 +1,36 @@
+# App templates can also be defined as part of the generator's template stanza. Sometimes it is
+# useful to do this in order to override the spec.template stanza, and when simple string
+# parameterization are insufficient. In the below examples, the generators[].XXX.template is 
+# a partial definition, which overrides/patch the default template.
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: guestbook
+spec:
+  generators:
+  - list:
+      elements:
+        - cluster: engineering-dev
+          url: https://kubernetes.default.svc
+      template:
+        metadata: {}
+        spec:
+          project: "default"
+          source:
+            targetRevision: HEAD
+            repoURL: https://github.com/argoproj/argo-cd.git
+            path: 'applicationset/examples/template-override/{{cluster}}-override'
+          destination: {}
+
+  template:
+    metadata:
+      name: '{{cluster}}-guestbook'
+    spec:
+      project: "default"
+      source:
+        repoURL: https://github.com/argoproj/argo-cd.git
+        targetRevision: HEAD
+        path: applicationset/examples/template-override/default
+      destination:
+        server: '{{url}}'
+        namespace: guestbook

applicationset/examples/template-override/template-overrides-example.yaml

@@ -7,6 +7,7 @@ kind: ApplicationSet
 metadata:
   name: guestbook
 spec:
+  goTemplate: true
   generators:
   - list:
       elements:
@@ -19,12 +20,12 @@ spec:
           source:
             targetRevision: HEAD
             repoURL: https://github.com/argoproj/argo-cd.git
-            path: 'applicationset/examples/template-override/{{cluster}}-override'
+            path: 'applicationset/examples/template-override/{{.cluster}}-override'
           destination: {}
 
   template:
     metadata:
-      name: '{{cluster}}-guestbook'
+      name: '{{.cluster}}-guestbook'
     spec:
       project: "default"
       source:
@@ -32,5 +33,5 @@ spec:
         targetRevision: HEAD
         path: applicationset/examples/template-override/default
       destination:
-        server: '{{url}}'
+        server: '{{.url}}'
         namespace: guestbook

applicationset/generators/cluster.go

@@ -3,8 +3,6 @@ package generators
 import (
 	"context"
 	"fmt"
-	"regexp"
-	"strings"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -17,7 +15,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/argoproj/argo-cd/v2/applicationset/utils"
-	argoappsetv1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argoappsetv1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 const (
@@ -37,6 +35,8 @@ type ClusterGenerator struct {
 	settingsManager *settings.SettingsManager
 }
 
+var render = &utils.Render{}
+
 func NewClusterGenerator(c client.Client, ctx context.Context, clientset kubernetes.Interface, namespace string) Generator {
 
 	settingsManager := settings.NewSettingsManager(ctx, clientset, namespace)
@@ -60,7 +60,7 @@ func (g *ClusterGenerator) GetTemplate(appSetGenerator *argoappsetv1alpha1.Appli
 }
 
 func (g *ClusterGenerator) GenerateParams(
-	appSetGenerator *argoappsetv1alpha1.ApplicationSetGenerator, _ *argoappsetv1alpha1.ApplicationSet) ([]map[string]string, error) {
+	appSetGenerator *argoappsetv1alpha1.ApplicationSetGenerator, appSet *argoappsetv1alpha1.ApplicationSet) ([]map[string]interface{}, error) {
 
 	if appSetGenerator == nil {
 		return nil, EmptyAppSetGeneratorError
@@ -89,7 +89,7 @@ func (g *ClusterGenerator) GenerateParams(
 		return nil, err
 	}
 
-	res := []map[string]string{}
+	res := []map[string]interface{}{}
 
 	secretsFound := []corev1.Secret{}
 
@@ -102,43 +102,102 @@ func (g *ClusterGenerator) GenerateParams(
 
 		} else if !ignoreLocalClusters {
 			// If there is no secret for the cluster, it's the local cluster, so handle it here.
-			params := map[string]string{}
+			params := map[string]interface{}{}
 			params["name"] = cluster.Name
+			params["nameNormalized"] = cluster.Name
 			params["server"] = cluster.Server
 
-			for key, value := range appSetGenerator.Clusters.Values {
-				params[fmt.Sprintf("values.%s", key)] = value
+			err = appendTemplatedValues(appSetGenerator.Clusters.Values, params, appSet)
+			if err != nil {
+				return nil, err
 			}
 
-			log.WithField("cluster", "local cluster").Info("matched local cluster")
-
 			res = append(res, params)
+
+			log.WithField("cluster", "local cluster").Info("matched local cluster")
 		}
 	}
 
 	// For each matching cluster secret (non-local clusters only)
 	for _, cluster := range secretsFound {
-		params := map[string]string{}
+		params := map[string]interface{}{}
+
 		params["name"] = string(cluster.Data["name"])
-		params["nameNormalized"] = sanitizeName(string(cluster.Data["name"]))
+		params["nameNormalized"] = utils.SanitizeName(string(cluster.Data["name"]))
 		params["server"] = string(cluster.Data["server"])
-		for key, value := range cluster.ObjectMeta.Annotations {
-			params[fmt.Sprintf("metadata.annotations.%s", key)] = value
+
+		if appSet.Spec.GoTemplate {
+			meta := map[string]interface{}{}
+
+			if len(cluster.ObjectMeta.Annotations) > 0 {
+				meta["annotations"] = cluster.ObjectMeta.Annotations
+			}
+			if len(cluster.ObjectMeta.Labels) > 0 {
+				meta["labels"] = cluster.ObjectMeta.Labels
+			}
+
+			params["metadata"] = meta
+		} else {
+			for key, value := range cluster.ObjectMeta.Annotations {
+				params[fmt.Sprintf("metadata.annotations.%s", key)] = value
+			}
+
+			for key, value := range cluster.ObjectMeta.Labels {
+				params[fmt.Sprintf("metadata.labels.%s", key)] = value
+			}
 		}
-		for key, value := range cluster.ObjectMeta.Labels {
-			params[fmt.Sprintf("metadata.labels.%s", key)] = value
+
+		err = appendTemplatedValues(appSetGenerator.Clusters.Values, params, appSet)
+		if err != nil {
+			return nil, err
 		}
-		for key, value := range appSetGenerator.Clusters.Values {
-			params[fmt.Sprintf("values.%s", key)] = value
-		}
-		log.WithField("cluster", cluster.Name).Info("matched cluster secret")
 
 		res = append(res, params)
+
+		log.WithField("cluster", cluster.Name).Info("matched cluster secret")
 	}
 
 	return res, nil
 }
 
+func appendTemplatedValues(clusterValues map[string]string, params map[string]interface{}, appSet *argoappsetv1alpha1.ApplicationSet) error {
+	// We create a local map to ensure that we do not fall victim to a billion-laughs attack. We iterate through the
+	// cluster values map and only replace values in said map if it has already been whitelisted in the params map.
+	// Once we iterate through all the cluster values we can then safely merge the `tmp` map into the main params map.
+	tmp := map[string]interface{}{}
+
+	for key, value := range clusterValues {
+		result, err := replaceTemplatedString(value, params, appSet)
+
+		if err != nil {
+			return fmt.Errorf("error replacing templated String: %w", err)
+		}
+
+		if appSet.Spec.GoTemplate {
+			if tmp["values"] == nil {
+				tmp["values"] = map[string]string{}
+			}
+			tmp["values"].(map[string]string)[key] = result
+		} else {
+			tmp[fmt.Sprintf("values.%s", key)] = result
+		}
+	}
+
+	for key, value := range tmp {
+		params[key] = value
+	}
+
+	return nil
+}
+
+func replaceTemplatedString(value string, params map[string]interface{}, appSet *argoappsetv1alpha1.ApplicationSet) (string, error) {
+	replacedTmplStr, err := render.Replace(value, params, appSet.Spec.GoTemplate)
+	if err != nil {
+		return "", err
+	}
+	return replacedTmplStr, nil
+}
+
 func (g *ClusterGenerator) getSecretsByClusterName(appSetGenerator *argoappsetv1alpha1.ApplicationSetGenerator) (map[string]corev1.Secret, error) {
 	// List all Clusters:
 	clusterSecretList := &corev1.SecretList{}
@@ -165,20 +224,3 @@ func (g *ClusterGenerator) getSecretsByClusterName(appSetGenerator *argoappsetv1
 	return res, nil
 
 }
-
-// sanitize the name in accordance with the below rules
-// 1. contain no more than 253 characters
-// 2. contain only lowercase alphanumeric characters, '-' or '.'
-// 3. start and end with an alphanumeric character
-func sanitizeName(name string) string {
-	invalidDNSNameChars := regexp.MustCompile("[^-a-z0-9.]")
-	maxDNSNameLength := 253
-
-	name = strings.ToLower(name)
-	name = invalidDNSNameChars.ReplaceAllString(name, "-")
-	if len(name) > maxDNSNameLength {
-		name = name[:maxDNSNameLength]
-	}
-
-	return strings.Trim(name, "-.")
-}

applicationset/generators/cluster_test.go

@@ -3,6 +3,7 @@ package generators
 import (
 	"context"
 	"fmt"
+	"testing"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -10,11 +11,10 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
-	"testing"
-
 	kubefake "k8s.io/client-go/kubernetes/fake"
 
-	argoappsetv1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	"github.com/argoproj/argo-cd/v2/applicationset/utils"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -86,7 +86,7 @@ func TestGenerateParams(t *testing.T) {
 		name     string
 		selector metav1.LabelSelector
 		values   map[string]string
-		expected []map[string]string
+		expected []map[string]interface{}
 		// clientError is true if a k8s client error should be simulated
 		clientError   bool
 		expectedError error
@@ -94,15 +94,23 @@ func TestGenerateParams(t *testing.T) {
 		{
 			name:     "no label selector",
 			selector: metav1.LabelSelector{},
-			values:   nil,
-			expected: []map[string]string{
-				{"name": "production_01/west", "nameNormalized": "production-01-west", "server": "https://production-01.example.com", "metadata.labels.environment": "production", "metadata.labels.org": "bar",
+			values: map[string]string{
+				"lol1":  "lol",
+				"lol2":  "{{values.lol1}}{{values.lol1}}",
+				"lol3":  "{{values.lol2}}{{values.lol2}}{{values.lol2}}",
+				"foo":   "bar",
+				"bar":   "{{ metadata.annotations.foo.argoproj.io }}",
+				"bat":   "{{ metadata.labels.environment }}",
+				"aaa":   "{{ server }}",
+				"no-op": "{{ this-does-not-exist }}",
+			}, expected: []map[string]interface{}{
+				{"values.lol1": "lol", "values.lol2": "{{values.lol1}}{{values.lol1}}", "values.lol3": "{{values.lol2}}{{values.lol2}}{{values.lol2}}", "values.foo": "bar", "values.bar": "production", "values.no-op": "{{ this-does-not-exist }}", "values.bat": "production", "values.aaa": "https://production-01.example.com", "name": "production_01/west", "nameNormalized": "production-01-west", "server": "https://production-01.example.com", "metadata.labels.environment": "production", "metadata.labels.org": "bar",
 					"metadata.labels.argocd.argoproj.io/secret-type": "cluster", "metadata.annotations.foo.argoproj.io": "production"},
 
-				{"name": "staging-01", "nameNormalized": "staging-01", "server": "https://staging-01.example.com", "metadata.labels.environment": "staging", "metadata.labels.org": "foo",
+				{"values.lol1": "lol", "values.lol2": "{{values.lol1}}{{values.lol1}}", "values.lol3": "{{values.lol2}}{{values.lol2}}{{values.lol2}}", "values.foo": "bar", "values.bar": "staging", "values.no-op": "{{ this-does-not-exist }}", "values.bat": "staging", "values.aaa": "https://staging-01.example.com", "name": "staging-01", "nameNormalized": "staging-01", "server": "https://staging-01.example.com", "metadata.labels.environment": "staging", "metadata.labels.org": "foo",
 					"metadata.labels.argocd.argoproj.io/secret-type": "cluster", "metadata.annotations.foo.argoproj.io": "staging"},
 
-				{"name": "in-cluster", "server": "https://kubernetes.default.svc"},
+				{"values.lol1": "lol", "values.lol2": "{{values.lol1}}{{values.lol1}}", "values.lol3": "{{values.lol2}}{{values.lol2}}{{values.lol2}}", "values.foo": "bar", "values.bar": "{{ metadata.annotations.foo.argoproj.io }}", "values.no-op": "{{ this-does-not-exist }}", "values.bat": "{{ metadata.labels.environment }}", "values.aaa": "https://kubernetes.default.svc", "nameNormalized": "in-cluster", "name": "in-cluster", "server": "https://kubernetes.default.svc"},
 			},
 			clientError:   false,
 			expectedError: nil,
@@ -115,7 +123,7 @@ func TestGenerateParams(t *testing.T) {
 				},
 			},
 			values: nil,
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{"name": "production_01/west", "nameNormalized": "production-01-west", "server": "https://production-01.example.com", "metadata.labels.environment": "production", "metadata.labels.org": "bar",
 					"metadata.labels.argocd.argoproj.io/secret-type": "cluster", "metadata.annotations.foo.argoproj.io": "production"},
 
@@ -135,7 +143,7 @@ func TestGenerateParams(t *testing.T) {
 			values: map[string]string{
 				"foo": "bar",
 			},
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{"values.foo": "bar", "name": "production_01/west", "nameNormalized": "production-01-west", "server": "https://production-01.example.com", "metadata.labels.environment": "production", "metadata.labels.org": "bar",
 					"metadata.labels.argocd.argoproj.io/secret-type": "cluster", "metadata.annotations.foo.argoproj.io": "production"},
 			},
@@ -159,7 +167,7 @@ func TestGenerateParams(t *testing.T) {
 			values: map[string]string{
 				"foo": "bar",
 			},
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{"values.foo": "bar", "name": "staging-01", "nameNormalized": "staging-01", "server": "https://staging-01.example.com", "metadata.labels.environment": "staging", "metadata.labels.org": "foo",
 					"metadata.labels.argocd.argoproj.io/secret-type": "cluster", "metadata.annotations.foo.argoproj.io": "staging"},
 				{"values.foo": "bar", "name": "production_01/west", "nameNormalized": "production-01-west", "server": "https://production-01.example.com", "metadata.labels.environment": "production", "metadata.labels.org": "bar",
@@ -188,7 +196,7 @@ func TestGenerateParams(t *testing.T) {
 			values: map[string]string{
 				"name": "baz",
 			},
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{"values.name": "baz", "name": "staging-01", "nameNormalized": "staging-01", "server": "https://staging-01.example.com", "metadata.labels.environment": "staging", "metadata.labels.org": "foo",
 					"metadata.labels.argocd.argoproj.io/secret-type": "cluster", "metadata.annotations.foo.argoproj.io": "staging"},
 			},
@@ -225,12 +233,395 @@ func TestGenerateParams(t *testing.T) {
 
 			var clusterGenerator = NewClusterGenerator(cl, context.Background(), appClientset, "namespace")
 
-			got, err := clusterGenerator.GenerateParams(&argoappsetv1alpha1.ApplicationSetGenerator{
-				Clusters: &argoappsetv1alpha1.ClusterGenerator{
+			applicationSetInfo := argoprojiov1alpha1.ApplicationSet{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "set",
+				},
+				Spec: argoprojiov1alpha1.ApplicationSetSpec{},
+			}
+
+			got, err := clusterGenerator.GenerateParams(&argoprojiov1alpha1.ApplicationSetGenerator{
+				Clusters: &argoprojiov1alpha1.ClusterGenerator{
 					Selector: testCase.selector,
 					Values:   testCase.values,
 				},
-			}, nil)
+			}, &applicationSetInfo)
+
+			if testCase.expectedError != nil {
+				assert.EqualError(t, err, testCase.expectedError.Error())
+			} else {
+				assert.NoError(t, err)
+				assert.ElementsMatch(t, testCase.expected, got)
+			}
+
+		})
+	}
+}
+
+func TestGenerateParamsGoTemplate(t *testing.T) {
+	clusters := []client.Object{
+		&corev1.Secret{
+			TypeMeta: metav1.TypeMeta{
+				Kind:       "Secret",
+				APIVersion: "v1",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "staging-01",
+				Namespace: "namespace",
+				Labels: map[string]string{
+					"argocd.argoproj.io/secret-type": "cluster",
+					"environment":                    "staging",
+					"org":                            "foo",
+				},
+				Annotations: map[string]string{
+					"foo.argoproj.io": "staging",
+				},
+			},
+			Data: map[string][]byte{
+				"config": []byte("{}"),
+				"name":   []byte("staging-01"),
+				"server": []byte("https://staging-01.example.com"),
+			},
+			Type: corev1.SecretType("Opaque"),
+		},
+		&corev1.Secret{
+			TypeMeta: metav1.TypeMeta{
+				Kind:       "Secret",
+				APIVersion: "v1",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "production-01",
+				Namespace: "namespace",
+				Labels: map[string]string{
+					"argocd.argoproj.io/secret-type": "cluster",
+					"environment":                    "production",
+					"org":                            "bar",
+				},
+				Annotations: map[string]string{
+					"foo.argoproj.io": "production",
+				},
+			},
+			Data: map[string][]byte{
+				"config": []byte("{}"),
+				"name":   []byte("production_01/west"),
+				"server": []byte("https://production-01.example.com"),
+			},
+			Type: corev1.SecretType("Opaque"),
+		},
+	}
+	testCases := []struct {
+		name     string
+		selector metav1.LabelSelector
+		values   map[string]string
+		expected []map[string]interface{}
+		// clientError is true if a k8s client error should be simulated
+		clientError   bool
+		expectedError error
+	}{
+		{
+			name:     "no label selector",
+			selector: metav1.LabelSelector{},
+			values: map[string]string{
+				"lol1":  "lol",
+				"lol2":  "{{ .values.lol1 }}{{ .values.lol1 }}",
+				"lol3":  "{{ .values.lol2 }}{{ .values.lol2 }}{{ .values.lol2 }}",
+				"foo":   "bar",
+				"bar":   "{{ if not (empty .metadata) }}{{index .metadata.annotations \"foo.argoproj.io\" }}{{ end }}",
+				"bat":   "{{ if not (empty .metadata) }}{{.metadata.labels.environment}}{{ end }}",
+				"aaa":   "{{ .server }}",
+				"no-op": "{{ .thisDoesNotExist }}",
+			}, expected: []map[string]interface{}{
+				{
+					"name":           "production_01/west",
+					"nameNormalized": "production-01-west",
+					"server":         "https://production-01.example.com",
+					"metadata": map[string]interface{}{
+						"labels": map[string]string{
+							"argocd.argoproj.io/secret-type": "cluster",
+							"environment":                    "production",
+							"org":                            "bar",
+						},
+						"annotations": map[string]string{
+							"foo.argoproj.io": "production",
+						},
+					},
+					"values": map[string]string{
+						"lol1":  "lol",
+						"lol2":  "<no value><no value>",
+						"lol3":  "<no value><no value><no value>",
+						"foo":   "bar",
+						"bar":   "production",
+						"bat":   "production",
+						"aaa":   "https://production-01.example.com",
+						"no-op": "<no value>",
+					},
+				},
+				{
+					"name":           "staging-01",
+					"nameNormalized": "staging-01",
+					"server":         "https://staging-01.example.com",
+					"metadata": map[string]interface{}{
+						"labels": map[string]string{
+							"argocd.argoproj.io/secret-type": "cluster",
+							"environment":                    "staging",
+							"org":                            "foo",
+						},
+						"annotations": map[string]string{
+							"foo.argoproj.io": "staging",
+						},
+					},
+					"values": map[string]string{
+						"lol1":  "lol",
+						"lol2":  "<no value><no value>",
+						"lol3":  "<no value><no value><no value>",
+						"foo":   "bar",
+						"bar":   "staging",
+						"bat":   "staging",
+						"aaa":   "https://staging-01.example.com",
+						"no-op": "<no value>",
+					},
+				},
+				{
+					"nameNormalized": "in-cluster",
+					"name":           "in-cluster",
+					"server":         "https://kubernetes.default.svc",
+					"values": map[string]string{
+						"lol1":  "lol",
+						"lol2":  "<no value><no value>",
+						"lol3":  "<no value><no value><no value>",
+						"foo":   "bar",
+						"bar":   "",
+						"bat":   "",
+						"aaa":   "https://kubernetes.default.svc",
+						"no-op": "<no value>",
+					},
+				},
+			},
+			clientError:   false,
+			expectedError: nil,
+		},
+		{
+			name: "secret type label selector",
+			selector: metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					"argocd.argoproj.io/secret-type": "cluster",
+				},
+			},
+			values: nil,
+			expected: []map[string]interface{}{
+				{
+					"name":           "production_01/west",
+					"nameNormalized": "production-01-west",
+					"server":         "https://production-01.example.com",
+					"metadata": map[string]interface{}{
+						"labels": map[string]string{
+							"argocd.argoproj.io/secret-type": "cluster",
+							"environment":                    "production",
+							"org":                            "bar",
+						},
+						"annotations": map[string]string{
+							"foo.argoproj.io": "production",
+						},
+					},
+				},
+				{
+					"name":           "staging-01",
+					"nameNormalized": "staging-01",
+					"server":         "https://staging-01.example.com",
+					"metadata": map[string]interface{}{
+						"labels": map[string]string{
+							"argocd.argoproj.io/secret-type": "cluster",
+							"environment":                    "staging",
+							"org":                            "foo",
+						},
+						"annotations": map[string]string{
+							"foo.argoproj.io": "staging",
+						},
+					},
+				},
+			},
+			clientError:   false,
+			expectedError: nil,
+		},
+		{
+			name: "production-only",
+			selector: metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					"environment": "production",
+				},
+			},
+			values: map[string]string{
+				"foo": "bar",
+			},
+			expected: []map[string]interface{}{
+				{
+					"name":           "production_01/west",
+					"nameNormalized": "production-01-west",
+					"server":         "https://production-01.example.com",
+					"metadata": map[string]interface{}{
+						"labels": map[string]string{
+							"argocd.argoproj.io/secret-type": "cluster",
+							"environment":                    "production",
+							"org":                            "bar",
+						},
+						"annotations": map[string]string{
+							"foo.argoproj.io": "production",
+						},
+					},
+					"values": map[string]string{
+						"foo": "bar",
+					},
+				},
+			},
+			clientError:   false,
+			expectedError: nil,
+		},
+		{
+			name: "production or staging",
+			selector: metav1.LabelSelector{
+				MatchExpressions: []metav1.LabelSelectorRequirement{
+					{
+						Key:      "environment",
+						Operator: "In",
+						Values: []string{
+							"production",
+							"staging",
+						},
+					},
+				},
+			},
+			values: map[string]string{
+				"foo": "bar",
+			},
+			expected: []map[string]interface{}{
+				{
+					"name":           "production_01/west",
+					"nameNormalized": "production-01-west",
+					"server":         "https://production-01.example.com",
+					"metadata": map[string]interface{}{
+						"labels": map[string]string{
+							"argocd.argoproj.io/secret-type": "cluster",
+							"environment":                    "production",
+							"org":                            "bar",
+						},
+						"annotations": map[string]string{
+							"foo.argoproj.io": "production",
+						},
+					},
+					"values": map[string]string{
+						"foo": "bar",
+					},
+				},
+				{
+					"name":           "staging-01",
+					"nameNormalized": "staging-01",
+					"server":         "https://staging-01.example.com",
+					"metadata": map[string]interface{}{
+						"labels": map[string]string{
+							"argocd.argoproj.io/secret-type": "cluster",
+							"environment":                    "staging",
+							"org":                            "foo",
+						},
+						"annotations": map[string]string{
+							"foo.argoproj.io": "staging",
+						},
+					},
+					"values": map[string]string{
+						"foo": "bar",
+					},
+				},
+			},
+			clientError:   false,
+			expectedError: nil,
+		},
+		{
+			name: "production or staging with match labels",
+			selector: metav1.LabelSelector{
+				MatchExpressions: []metav1.LabelSelectorRequirement{
+					{
+						Key:      "environment",
+						Operator: "In",
+						Values: []string{
+							"production",
+							"staging",
+						},
+					},
+				},
+				MatchLabels: map[string]string{
+					"org": "foo",
+				},
+			},
+			values: map[string]string{
+				"name": "baz",
+			},
+			expected: []map[string]interface{}{
+				{
+					"name":           "staging-01",
+					"nameNormalized": "staging-01",
+					"server":         "https://staging-01.example.com",
+					"metadata": map[string]interface{}{
+						"labels": map[string]string{
+							"argocd.argoproj.io/secret-type": "cluster",
+							"environment":                    "staging",
+							"org":                            "foo",
+						},
+						"annotations": map[string]string{
+							"foo.argoproj.io": "staging",
+						},
+					},
+					"values": map[string]string{
+						"name": "baz",
+					},
+				},
+			},
+			clientError:   false,
+			expectedError: nil,
+		},
+		{
+			name:          "simulate client error",
+			selector:      metav1.LabelSelector{},
+			values:        nil,
+			expected:      nil,
+			clientError:   true,
+			expectedError: fmt.Errorf("could not list Secrets"),
+		},
+	}
+
+	// convert []client.Object to []runtime.Object, for use by kubefake package
+	runtimeClusters := []runtime.Object{}
+	for _, clientCluster := range clusters {
+		runtimeClusters = append(runtimeClusters, clientCluster)
+	}
+
+	for _, testCase := range testCases {
+
+		t.Run(testCase.name, func(t *testing.T) {
+
+			appClientset := kubefake.NewSimpleClientset(runtimeClusters...)
+
+			fakeClient := fake.NewClientBuilder().WithObjects(clusters...).Build()
+			cl := &possiblyErroringFakeCtrlRuntimeClient{
+				fakeClient,
+				testCase.clientError,
+			}
+
+			var clusterGenerator = NewClusterGenerator(cl, context.Background(), appClientset, "namespace")
+
+			applicationSetInfo := argoprojiov1alpha1.ApplicationSet{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "set",
+				},
+				Spec: argoprojiov1alpha1.ApplicationSetSpec{
+					GoTemplate: true,
+				},
+			}
+
+			got, err := clusterGenerator.GenerateParams(&argoprojiov1alpha1.ApplicationSetGenerator{
+				Clusters: &argoprojiov1alpha1.ClusterGenerator{
+					Selector: testCase.selector,
+					Values:   testCase.values,
+				},
+			}, &applicationSetInfo)
 
 			if testCase.expectedError != nil {
 				assert.EqualError(t, err, testCase.expectedError.Error())
@@ -245,10 +636,10 @@ func TestGenerateParams(t *testing.T) {
 
 func TestSanitizeClusterName(t *testing.T) {
 	t.Run("valid DNS-1123 subdomain name", func(t *testing.T) {
-		assert.Equal(t, "cluster-name", sanitizeName("cluster-name"))
+		assert.Equal(t, "cluster-name", utils.SanitizeName("cluster-name"))
 	})
 	t.Run("invalid DNS-1123 subdomain name", func(t *testing.T) {
 		invalidName := "-.--CLUSTER/name  -./.-"
-		assert.Equal(t, "cluster-name", sanitizeName(invalidName))
+		assert.Equal(t, "cluster-name", utils.SanitizeName(invalidName))
 	})
 }

applicationset/generators/duck_type.go

@@ -17,7 +17,7 @@ import (
 	"k8s.io/client-go/kubernetes"
 
 	"github.com/argoproj/argo-cd/v2/applicationset/utils"
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 var _ Generator = (*DuckTypeGenerator)(nil)
@@ -60,7 +60,7 @@ func (g *DuckTypeGenerator) GetTemplate(appSetGenerator *argoprojiov1alpha1.Appl
 	return &appSetGenerator.ClusterDecisionResource.Template
 }
 
-func (g *DuckTypeGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, _ *argoprojiov1alpha1.ApplicationSet) ([]map[string]string, error) {
+func (g *DuckTypeGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, appSet *argoprojiov1alpha1.ApplicationSet) ([]map[string]interface{}, error) {
 
 	if appSetGenerator == nil {
 		return nil, EmptyAppSetGeneratorError
@@ -152,7 +152,7 @@ func (g *DuckTypeGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.A
 
 	}
 
-	res := []map[string]string{}
+	res := []map[string]interface{}{}
 	clusterDecisions := []interface{}{}
 
 	// Build the decision slice
@@ -178,7 +178,7 @@ func (g *DuckTypeGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.A
 		for _, cluster := range clusterDecisions {
 
 			// generated instance of cluster params
-			params := map[string]string{}
+			params := map[string]interface{}{}
 
 			log.Infof("cluster: %v", cluster)
 			matchValue := cluster.(map[string]interface{})[matchKey]
@@ -215,7 +215,14 @@ func (g *DuckTypeGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.A
 			}
 
 			for key, value := range appSetGenerator.ClusterDecisionResource.Values {
-				params[fmt.Sprintf("values.%s", key)] = value
+				if appSet.Spec.GoTemplate {
+					if params["values"] == nil {
+						params["values"] = map[string]string{}
+					}
+					params["values"].(map[string]string)[key] = value
+				} else {
+					params[fmt.Sprintf("values.%s", key)] = value
+				}
 			}
 
 			res = append(res, params)

applicationset/generators/duck_type_test.go

@@ -14,7 +14,7 @@ import (
 	kubefake "k8s.io/client-go/kubernetes/fake"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 
 	"testing"
 )
@@ -149,7 +149,7 @@ func TestGenerateParamsForDuckType(t *testing.T) {
 		labelSelector metav1.LabelSelector
 		resource      *unstructured.Unstructured
 		values        map[string]string
-		expected      []map[string]string
+		expected      []map[string]interface{}
 		expectedError error
 	}{
 		{
@@ -157,7 +157,7 @@ func TestGenerateParamsForDuckType(t *testing.T) {
 			resourceName:  "",
 			resource:      duckType,
 			values:        nil,
-			expected:      []map[string]string{},
+			expected:      []map[string]interface{}{},
 			expectedError: fmt.Errorf("There is a problem with the definition of the ClusterDecisionResource generator"),
 		},
 		/*** This does not work with the FAKE runtime client, fieldSelectors are broken.
@@ -175,7 +175,7 @@ func TestGenerateParamsForDuckType(t *testing.T) {
 			resourceName: resourceName,
 			resource:     duckType,
 			values:       nil,
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{"clusterName": "production-01", "name": "production-01", "server": "https://production-01.example.com"},
 
 				{"clusterName": "staging-01", "name": "staging-01", "server": "https://staging-01.example.com"},
@@ -189,7 +189,7 @@ func TestGenerateParamsForDuckType(t *testing.T) {
 			values: map[string]string{
 				"foo": "bar",
 			},
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{"clusterName": "production-01", "values.foo": "bar", "name": "production-01", "server": "https://production-01.example.com"},
 			},
 			expectedError: nil,
@@ -217,7 +217,7 @@ func TestGenerateParamsForDuckType(t *testing.T) {
 			labelSelector: metav1.LabelSelector{MatchLabels: map[string]string{"duck": "all-species"}},
 			resource:      duckType,
 			values:        nil,
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{"clusterName": "production-01", "name": "production-01", "server": "https://production-01.example.com"},
 
 				{"clusterName": "staging-01", "name": "staging-01", "server": "https://staging-01.example.com"},
@@ -232,7 +232,7 @@ func TestGenerateParamsForDuckType(t *testing.T) {
 			values: map[string]string{
 				"foo": "bar",
 			},
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{"clusterName": "production-01", "values.foo": "bar", "name": "production-01", "server": "https://production-01.example.com"},
 			},
 			expectedError: nil,
@@ -249,7 +249,7 @@ func TestGenerateParamsForDuckType(t *testing.T) {
 			}},
 			resource: duckType,
 			values:   nil,
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{"clusterName": "production-01", "name": "production-01", "server": "https://production-01.example.com"},
 
 				{"clusterName": "staging-01", "name": "staging-01", "server": "https://staging-01.example.com"},
@@ -295,6 +295,13 @@ func TestGenerateParamsForDuckType(t *testing.T) {
 
 			var duckTypeGenerator = NewDuckTypeGenerator(context.Background(), fakeDynClient, appClientset, "namespace")
 
+			applicationSetInfo := argoprojiov1alpha1.ApplicationSet{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "set",
+				},
+				Spec: argoprojiov1alpha1.ApplicationSetSpec{},
+			}
+
 			got, err := duckTypeGenerator.GenerateParams(&argoprojiov1alpha1.ApplicationSetGenerator{
 				ClusterDecisionResource: &argoprojiov1alpha1.DuckTypeGenerator{
 					ConfigMapRef:  "my-configmap",
@@ -302,7 +309,307 @@ func TestGenerateParamsForDuckType(t *testing.T) {
 					LabelSelector: testCase.labelSelector,
 					Values:        testCase.values,
 				},
-			}, nil)
+			}, &applicationSetInfo)
+
+			if testCase.expectedError != nil {
+				assert.EqualError(t, err, testCase.expectedError.Error())
+			} else {
+				assert.NoError(t, err)
+				assert.ElementsMatch(t, testCase.expected, got)
+			}
+		})
+	}
+}
+
+func TestGenerateParamsForDuckTypeGoTemplate(t *testing.T) {
+	clusters := []client.Object{
+		&corev1.Secret{
+			TypeMeta: metav1.TypeMeta{
+				Kind:       "Secret",
+				APIVersion: "v1",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "staging-01",
+				Namespace: "namespace",
+				Labels: map[string]string{
+					"argocd.argoproj.io/secret-type": "cluster",
+					"environment":                    "staging",
+					"org":                            "foo",
+				},
+				Annotations: map[string]string{
+					"foo.argoproj.io": "staging",
+				},
+			},
+			Data: map[string][]byte{
+				"config": []byte("{}"),
+				"name":   []byte("staging-01"),
+				"server": []byte("https://staging-01.example.com"),
+			},
+			Type: corev1.SecretType("Opaque"),
+		},
+		&corev1.Secret{
+			TypeMeta: metav1.TypeMeta{
+				Kind:       "Secret",
+				APIVersion: "v1",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "production-01",
+				Namespace: "namespace",
+				Labels: map[string]string{
+					"argocd.argoproj.io/secret-type": "cluster",
+					"environment":                    "production",
+					"org":                            "bar",
+				},
+				Annotations: map[string]string{
+					"foo.argoproj.io": "production",
+				},
+			},
+			Data: map[string][]byte{
+				"config": []byte("{}"),
+				"name":   []byte("production-01"),
+				"server": []byte("https://production-01.example.com"),
+			},
+			Type: corev1.SecretType("Opaque"),
+		},
+	}
+
+	duckType := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": resourceApiVersion,
+			"kind":       "Duck",
+			"metadata": map[string]interface{}{
+				"name":      resourceName,
+				"namespace": "namespace",
+				"labels":    map[string]interface{}{"duck": "all-species"},
+			},
+			"status": map[string]interface{}{
+				"decisions": []interface{}{
+					map[string]interface{}{
+						"clusterName": "staging-01",
+					},
+					map[string]interface{}{
+						"clusterName": "production-01",
+					},
+				},
+			},
+		},
+	}
+
+	duckTypeProdOnly := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": resourceApiVersion,
+			"kind":       "Duck",
+			"metadata": map[string]interface{}{
+				"name":      resourceName,
+				"namespace": "namespace",
+				"labels":    map[string]interface{}{"duck": "spotted"},
+			},
+			"status": map[string]interface{}{
+				"decisions": []interface{}{
+					map[string]interface{}{
+						"clusterName": "production-01",
+					},
+				},
+			},
+		},
+	}
+
+	duckTypeEmpty := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": resourceApiVersion,
+			"kind":       "Duck",
+			"metadata": map[string]interface{}{
+				"name":      resourceName,
+				"namespace": "namespace",
+				"labels":    map[string]interface{}{"duck": "canvasback"},
+			},
+			"status": map[string]interface{}{},
+		},
+	}
+
+	configMap := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-configmap",
+			Namespace: "namespace",
+		},
+		Data: map[string]string{
+			"apiVersion":    resourceApiVersion,
+			"kind":          resourceKind,
+			"statusListKey": "decisions",
+			"matchKey":      "clusterName",
+		},
+	}
+
+	testCases := []struct {
+		name          string
+		configMapRef  string
+		resourceName  string
+		labelSelector metav1.LabelSelector
+		resource      *unstructured.Unstructured
+		values        map[string]string
+		expected      []map[string]interface{}
+		expectedError error
+	}{
+		{
+			name:          "no duck resource",
+			resourceName:  "",
+			resource:      duckType,
+			values:        nil,
+			expected:      []map[string]interface{}{},
+			expectedError: fmt.Errorf("There is a problem with the definition of the ClusterDecisionResource generator"),
+		},
+		/*** This does not work with the FAKE runtime client, fieldSelectors are broken.
+		{
+			name:          "invalid name for duck resource",
+			resourceName:  resourceName + "-different",
+			resource:      duckType,
+			values:        nil,
+			expected:      []map[string]string{},
+			expectedError: fmt.Errorf("duck.mallard.io \"quak\" not found"),
+		},
+		***/
+		{
+			name:         "duck type generator resourceName",
+			resourceName: resourceName,
+			resource:     duckType,
+			values:       nil,
+			expected: []map[string]interface{}{
+				{"clusterName": "production-01", "name": "production-01", "server": "https://production-01.example.com"},
+
+				{"clusterName": "staging-01", "name": "staging-01", "server": "https://staging-01.example.com"},
+			},
+			expectedError: nil,
+		},
+		{
+			name:         "production-only",
+			resourceName: resourceName,
+			resource:     duckTypeProdOnly,
+			values: map[string]string{
+				"foo": "bar",
+			},
+			expected: []map[string]interface{}{
+				{"clusterName": "production-01", "values": map[string]string{"foo": "bar"}, "name": "production-01", "server": "https://production-01.example.com"},
+			},
+			expectedError: nil,
+		},
+		{
+			name:          "duck type empty status",
+			resourceName:  resourceName,
+			resource:      duckTypeEmpty,
+			values:        nil,
+			expected:      nil,
+			expectedError: nil,
+		},
+		{
+			name:          "duck type empty status labelSelector.matchLabels",
+			resourceName:  "",
+			labelSelector: metav1.LabelSelector{MatchLabels: map[string]string{"duck": "canvasback"}},
+			resource:      duckTypeEmpty,
+			values:        nil,
+			expected:      nil,
+			expectedError: nil,
+		},
+		{
+			name:          "duck type generator labelSelector.matchLabels",
+			resourceName:  "",
+			labelSelector: metav1.LabelSelector{MatchLabels: map[string]string{"duck": "all-species"}},
+			resource:      duckType,
+			values:        nil,
+			expected: []map[string]interface{}{
+				{"clusterName": "production-01", "name": "production-01", "server": "https://production-01.example.com"},
+
+				{"clusterName": "staging-01", "name": "staging-01", "server": "https://staging-01.example.com"},
+			},
+			expectedError: nil,
+		},
+		{
+			name:          "production-only labelSelector.matchLabels",
+			resourceName:  "",
+			resource:      duckTypeProdOnly,
+			labelSelector: metav1.LabelSelector{MatchLabels: map[string]string{"duck": "spotted"}},
+			values: map[string]string{
+				"foo": "bar",
+			},
+			expected: []map[string]interface{}{
+				{"clusterName": "production-01", "values": map[string]string{"foo": "bar"}, "name": "production-01", "server": "https://production-01.example.com"},
+			},
+			expectedError: nil,
+		},
+		{
+			name:         "duck type generator labelSelector.matchExpressions",
+			resourceName: "",
+			labelSelector: metav1.LabelSelector{MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      "duck",
+					Operator: "In",
+					Values:   []string{"all-species", "marbled"},
+				},
+			}},
+			resource: duckType,
+			values:   nil,
+			expected: []map[string]interface{}{
+				{"clusterName": "production-01", "name": "production-01", "server": "https://production-01.example.com"},
+
+				{"clusterName": "staging-01", "name": "staging-01", "server": "https://staging-01.example.com"},
+			},
+			expectedError: nil,
+		},
+		{
+			name:         "duck type generator resourceName and labelSelector.matchExpressions",
+			resourceName: resourceName,
+			labelSelector: metav1.LabelSelector{MatchExpressions: []metav1.LabelSelectorRequirement{
+				{
+					Key:      "duck",
+					Operator: "In",
+					Values:   []string{"all-species", "marbled"},
+				},
+			}},
+			resource:      duckType,
+			values:        nil,
+			expected:      nil,
+			expectedError: fmt.Errorf("There is a problem with the definition of the ClusterDecisionResource generator"),
+		},
+	}
+
+	// convert []client.Object to []runtime.Object, for use by kubefake package
+	runtimeClusters := []runtime.Object{}
+	for _, clientCluster := range clusters {
+		runtimeClusters = append(runtimeClusters, clientCluster)
+	}
+
+	for _, testCase := range testCases {
+
+		t.Run(testCase.name, func(t *testing.T) {
+
+			appClientset := kubefake.NewSimpleClientset(append(runtimeClusters, configMap)...)
+
+			gvrToListKind := map[schema.GroupVersionResource]string{{
+				Group:    "mallard.io",
+				Version:  "v1",
+				Resource: "ducks",
+			}: "DuckList"}
+
+			fakeDynClient := dynfake.NewSimpleDynamicClientWithCustomListKinds(runtime.NewScheme(), gvrToListKind, testCase.resource)
+
+			var duckTypeGenerator = NewDuckTypeGenerator(context.Background(), fakeDynClient, appClientset, "namespace")
+
+			applicationSetInfo := argoprojiov1alpha1.ApplicationSet{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "set",
+				},
+				Spec: argoprojiov1alpha1.ApplicationSetSpec{
+					GoTemplate: true,
+				},
+			}
+
+			got, err := duckTypeGenerator.GenerateParams(&argoprojiov1alpha1.ApplicationSetGenerator{
+				ClusterDecisionResource: &argoprojiov1alpha1.DuckTypeGenerator{
+					ConfigMapRef:  "my-configmap",
+					Name:          testCase.resourceName,
+					LabelSelector: testCase.labelSelector,
+					Values:        testCase.values,
+				},
+			}, &applicationSetInfo)
 
 			if testCase.expectedError != nil {
 				assert.EqualError(t, err, testCase.expectedError.Error())

applicationset/generators/generator_spec_processor.go

@@ -1,23 +1,40 @@
 package generators
 
 import (
+	"fmt"
+	"encoding/json"
 	"reflect"
 
+	"github.com/argoproj/argo-cd/v2/applicationset/utils"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
+
 	"github.com/imdario/mergo"
 	log "github.com/sirupsen/logrus"
+)
 
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+const (
+	selectorKey = "Selector"
 )
 
 type TransformResult struct {
-	Params   []map[string]string
+	Params   []map[string]interface{}
 	Template argoprojiov1alpha1.ApplicationSetTemplate
 }
 
 //Transform a spec generator to list of paramSets and a template
-func Transform(requestedGenerator argoprojiov1alpha1.ApplicationSetGenerator, allGenerators map[string]Generator, baseTemplate argoprojiov1alpha1.ApplicationSetTemplate, appSet *argoprojiov1alpha1.ApplicationSet) ([]TransformResult, error) {
+func Transform(requestedGenerator argoprojiov1alpha1.ApplicationSetGenerator, allGenerators map[string]Generator, baseTemplate argoprojiov1alpha1.ApplicationSetTemplate, appSet *argoprojiov1alpha1.ApplicationSet, genParams map[string]interface{}) ([]TransformResult, error) {
+	selector, err := metav1.LabelSelectorAsSelector(requestedGenerator.Selector)
+	if err != nil {
+		return nil, fmt.Errorf("error parsing label selector: %w", err)
+	}
+
 	res := []TransformResult{}
 	var firstError error
+	interpolatedGenerator := requestedGenerator.DeepCopy()
 
 	generators := GetRelevantGenerators(&requestedGenerator, allGenerators)
 	for _, g := range generators {
@@ -31,8 +48,20 @@ func Transform(requestedGenerator argoprojiov1alpha1.ApplicationSetGenerator, al
 			}
 			continue
 		}
-
-		params, err := g.GenerateParams(&requestedGenerator, appSet)
+		var params []map[string]interface{}
+		if len(genParams) != 0 {
+			tempInterpolatedGenerator, err := InterpolateGenerator(&requestedGenerator, genParams, appSet.Spec.GoTemplate)
+			interpolatedGenerator = &tempInterpolatedGenerator
+			if err != nil {
+				log.WithError(err).WithField("genParams", genParams).
+					Error("error interpolating params for generator")
+				if firstError == nil {
+					firstError = err
+				}
+				continue
+			}
+		}
+		params, err = g.GenerateParams(interpolatedGenerator, appSet)
 		if err != nil {
 			log.WithError(err).WithField("generator", g).
 				Error("error generating params")
@@ -41,16 +70,34 @@ func Transform(requestedGenerator argoprojiov1alpha1.ApplicationSetGenerator, al
 			}
 			continue
 		}
+		var filterParams []map[string]interface{}
+		for _, param := range params {
+
+			if requestedGenerator.Selector != nil && !selector.Matches(labels.Set(keepOnlyStringValues(param))) {
+				continue
+			}
+			filterParams = append(filterParams, param)
+		}
 
 		res = append(res, TransformResult{
-			Params:   params,
+			Params:   filterParams,
 			Template: mergedTemplate,
 		})
-
 	}
 
 	return res, firstError
+}
 
+func keepOnlyStringValues(in map[string]interface{}) map[string]string {
+	var out map[string]string = map[string]string{}
+
+	for key, value := range in {
+		if _, ok := value.(string); ok {
+			out[key] = value.(string)
+		}
+	}
+
+	return out
 }
 
 func GetRelevantGenerators(requestedGenerator *argoprojiov1alpha1.ApplicationSetGenerator, generators map[string]Generator) []Generator {
@@ -62,9 +109,13 @@ func GetRelevantGenerators(requestedGenerator *argoprojiov1alpha1.ApplicationSet
 		if !field.CanInterface() {
 			continue
 		}
+		name := v.Type().Field(i).Name
+		if name == selectorKey {
+			continue
+		}
 
 		if !reflect.ValueOf(field.Interface()).IsNil() {
-			res = append(res, generators[v.Type().Field(i).Name])
+			res = append(res, generators[name])
 		}
 	}
 
@@ -72,7 +123,6 @@ func GetRelevantGenerators(requestedGenerator *argoprojiov1alpha1.ApplicationSet
 }
 
 func mergeGeneratorTemplate(g Generator, requestedGenerator *argoprojiov1alpha1.ApplicationSetGenerator, applicationSetTemplate argoprojiov1alpha1.ApplicationSetTemplate) (argoprojiov1alpha1.ApplicationSetTemplate, error) {
-
 	// Make a copy of the value from `GetTemplate()` before merge, rather than copying directly into
 	// the provided parameter (which will touch the original resource object returned by client-go)
 	dest := g.GetTemplate(requestedGenerator).DeepCopy()
@@ -81,3 +131,28 @@ func mergeGeneratorTemplate(g Generator, requestedGenerator *argoprojiov1alpha1.
 
 	return *dest, err
 }
+
+// Currently for Matrix Generator. Allows interpolating the matrix's 2nd child generator with values from the 1st child generator
+// "params" parameter is an array, where each index corresponds to a generator. Each index contains a map w/ that generator's parameters.
+func InterpolateGenerator(requestedGenerator *argoprojiov1alpha1.ApplicationSetGenerator, params map[string]interface{}, useGoTemplate bool) (argoprojiov1alpha1.ApplicationSetGenerator, error) {
+	interpolatedGenerator := requestedGenerator.DeepCopy()
+	tmplBytes, err := json.Marshal(interpolatedGenerator)
+	if err != nil {
+		log.WithError(err).WithField("requestedGenerator", interpolatedGenerator).Error("error marshalling requested generator for interpolation")
+		return *interpolatedGenerator, err
+	}
+
+	render := utils.Render{}
+	replacedTmplStr, err := render.Replace(string(tmplBytes), params, useGoTemplate)
+	if err != nil {
+		log.WithError(err).WithField("interpolatedGeneratorString", replacedTmplStr).Error("error interpolating generator with other generator's parameter")
+		return *interpolatedGenerator, err
+	}
+
+	err = json.Unmarshal([]byte(replacedTmplStr), interpolatedGenerator)
+	if err != nil {
+		log.WithError(err).WithField("requestedGenerator", interpolatedGenerator).Error("error unmarshalling requested generator for interpolation")
+		return *interpolatedGenerator, err
+	}
+	return *interpolatedGenerator, nil
+}

applicationset/generators/generator_spec_processor_test.go

@@ -0,0 +1,267 @@
+package generators
+
+import (
+	"context"
+	"testing"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	argov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
+
+	"github.com/stretchr/testify/mock"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	kubefake "k8s.io/client-go/kubernetes/fake"
+	crtclient "sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
+)
+
+func TestMatchValues(t *testing.T) {
+	testCases := []struct {
+		name     string
+		elements []apiextensionsv1.JSON
+		selector *metav1.LabelSelector
+		expected []map[string]interface{}
+	}{
+		{
+			name:     "no filter",
+			elements: []apiextensionsv1.JSON{{Raw: []byte(`{"cluster": "cluster","url": "url"}`)}},
+			selector: &metav1.LabelSelector{},
+			expected: []map[string]interface{}{{"cluster": "cluster", "url": "url"}},
+		},
+		{
+			name:     "nil",
+			elements: []apiextensionsv1.JSON{{Raw: []byte(`{"cluster": "cluster","url": "url"}`)}},
+			selector: nil,
+			expected: []map[string]interface{}{{"cluster": "cluster", "url": "url"}},
+		},
+		{
+			name:     "values.foo should be foo but is ignore element",
+			elements: []apiextensionsv1.JSON{{Raw: []byte(`{"cluster": "cluster","url": "url","values":{"foo":"bar"}}`)}},
+			selector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					"values.foo": "foo",
+				},
+			},
+			expected: []map[string]interface{}{},
+		},
+		{
+			name:     "values.foo should be bar",
+			elements: []apiextensionsv1.JSON{{Raw: []byte(`{"cluster": "cluster","url": "url","values":{"foo":"bar"}}`)}},
+			selector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					"values.foo": "bar",
+				},
+			},
+			expected: []map[string]interface{}{{"cluster": "cluster", "url": "url", "values.foo": "bar"}},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			var listGenerator = NewListGenerator()
+			var data = map[string]Generator{
+				"List": listGenerator,
+			}
+
+			applicationSetInfo := argoprojiov1alpha1.ApplicationSet{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "set",
+				},
+				Spec: argoprojiov1alpha1.ApplicationSetSpec{},
+			}
+
+			results, err := Transform(argoprojiov1alpha1.ApplicationSetGenerator{
+				Selector: testCase.selector,
+				List: &argoprojiov1alpha1.ListGenerator{
+					Elements: testCase.elements,
+					Template: emptyTemplate(),
+				}},
+				data,
+				emptyTemplate(),
+				&applicationSetInfo, nil)
+
+			assert.NoError(t, err)
+			assert.ElementsMatch(t, testCase.expected, results[0].Params)
+		})
+	}
+}
+
+func emptyTemplate() argoprojiov1alpha1.ApplicationSetTemplate {
+	return argoprojiov1alpha1.ApplicationSetTemplate{
+		Spec: argov1alpha1.ApplicationSpec{
+			Project: "project",
+		},
+	}
+}
+
+func getMockClusterGenerator() Generator {
+	clusters := []crtclient.Object{
+		&corev1.Secret{
+			TypeMeta: metav1.TypeMeta{
+				Kind:       "Secret",
+				APIVersion: "v1",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "staging-01",
+				Namespace: "namespace",
+				Labels: map[string]string{
+					"argocd.argoproj.io/secret-type": "cluster",
+					"environment":                    "staging",
+					"org":                            "foo",
+				},
+				Annotations: map[string]string{
+					"foo.argoproj.io": "staging",
+				},
+			},
+			Data: map[string][]byte{
+				"config": []byte("{}"),
+				"name":   []byte("staging-01"),
+				"server": []byte("https://staging-01.example.com"),
+			},
+			Type: corev1.SecretType("Opaque"),
+		},
+		&corev1.Secret{
+			TypeMeta: metav1.TypeMeta{
+				Kind:       "Secret",
+				APIVersion: "v1",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "production-01",
+				Namespace: "namespace",
+				Labels: map[string]string{
+					"argocd.argoproj.io/secret-type": "cluster",
+					"environment":                    "production",
+					"org":                            "bar",
+				},
+				Annotations: map[string]string{
+					"foo.argoproj.io": "production",
+				},
+			},
+			Data: map[string][]byte{
+				"config": []byte("{}"),
+				"name":   []byte("production_01/west"),
+				"server": []byte("https://production-01.example.com"),
+			},
+			Type: corev1.SecretType("Opaque"),
+		},
+	}
+	runtimeClusters := []runtime.Object{}
+	appClientset := kubefake.NewSimpleClientset(runtimeClusters...)
+
+	fakeClient := fake.NewClientBuilder().WithObjects(clusters...).Build()
+	return NewClusterGenerator(fakeClient, context.Background(), appClientset, "namespace")
+}
+
+func getMockGitGenerator() Generator {
+	argoCDServiceMock := argoCDServiceMock{mock: &mock.Mock{}}
+	argoCDServiceMock.mock.On("GetDirectories", mock.Anything, mock.Anything, mock.Anything).Return([]string{"app1", "app2", "app_3", "p1/app4"}, nil)
+	var gitGenerator = NewGitGenerator(argoCDServiceMock)
+	return gitGenerator
+}
+
+func TestGetRelevantGenerators(t *testing.T) {
+
+	testGenerators := map[string]Generator{
+		"Clusters": getMockClusterGenerator(),
+		"Git":      getMockGitGenerator(),
+	}
+
+	testGenerators["Matrix"] = NewMatrixGenerator(testGenerators)
+	testGenerators["Merge"] = NewMergeGenerator(testGenerators)
+	testGenerators["List"] = NewListGenerator()
+
+	requestedGenerator := &argoprojiov1alpha1.ApplicationSetGenerator{
+		List: &argoprojiov1alpha1.ListGenerator{
+			Elements: []apiextensionsv1.JSON{{Raw: []byte(`{"cluster": "cluster","url": "url","values":{"foo":"bar"}}`)}},
+		}}
+
+	relevantGenerators := GetRelevantGenerators(requestedGenerator, testGenerators)
+	assert.Len(t, relevantGenerators, 1)
+	assert.IsType(t, &ListGenerator{}, relevantGenerators[0])
+
+	requestedGenerator = &argoprojiov1alpha1.ApplicationSetGenerator{
+		Clusters: &argoprojiov1alpha1.ClusterGenerator{
+			Selector: metav1.LabelSelector{},
+			Template: argoprojiov1alpha1.ApplicationSetTemplate{},
+			Values:   nil,
+		},
+	}
+
+	relevantGenerators = GetRelevantGenerators(requestedGenerator, testGenerators)
+	assert.Len(t, relevantGenerators, 1)
+	assert.IsType(t, &ClusterGenerator{}, relevantGenerators[0])
+
+	requestedGenerator = &argoprojiov1alpha1.ApplicationSetGenerator{
+		Git: &argoprojiov1alpha1.GitGenerator{
+			RepoURL:             "",
+			Directories:         nil,
+			Files:               nil,
+			Revision:            "",
+			RequeueAfterSeconds: nil,
+			Template:            argoprojiov1alpha1.ApplicationSetTemplate{},
+		},
+	}
+
+	relevantGenerators = GetRelevantGenerators(requestedGenerator, testGenerators)
+	assert.Len(t, relevantGenerators, 1)
+	assert.IsType(t, &GitGenerator{}, relevantGenerators[0])
+}
+
+func TestInterpolateGenerator(t *testing.T) {
+	requestedGenerator := &argoprojiov1alpha1.ApplicationSetGenerator{
+		Clusters: &argoprojiov1alpha1.ClusterGenerator{
+			Selector: metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					"argocd.argoproj.io/secret-type": "cluster",
+					"path-basename":                  "{{path.basename}}",
+					"path-zero":                      "{{path[0]}}",
+					"path-full":                      "{{path}}",
+				}},
+		},
+	}
+	gitGeneratorParams := map[string]interface{}{
+		"path":                    "p1/p2/app3",
+		"path.basename":           "app3",
+		"path[0]":                 "p1",
+		"path[1]":                 "p2",
+		"path.basenameNormalized": "app3",
+	}
+	interpolatedGenerator, err := InterpolateGenerator(requestedGenerator, gitGeneratorParams, false)
+	if err != nil {
+		log.WithError(err).WithField("requestedGenerator", requestedGenerator).Error("error interpolating Generator")
+		return
+	}
+	assert.Equal(t, "app3", interpolatedGenerator.Clusters.Selector.MatchLabels["path-basename"])
+	assert.Equal(t, "p1", interpolatedGenerator.Clusters.Selector.MatchLabels["path-zero"])
+	assert.Equal(t, "p1/p2/app3", interpolatedGenerator.Clusters.Selector.MatchLabels["path-full"])
+
+	fileNamePath := argoprojiov1alpha1.GitFileGeneratorItem{
+		Path: "{{name}}",
+	}
+	fileServerPath := argoprojiov1alpha1.GitFileGeneratorItem{
+		Path: "{{server}}",
+	}
+
+	requestedGenerator = &argoprojiov1alpha1.ApplicationSetGenerator{
+		Git: &argoprojiov1alpha1.GitGenerator{
+			Files:    append([]argoprojiov1alpha1.GitFileGeneratorItem{}, fileNamePath, fileServerPath),
+			Template: argoprojiov1alpha1.ApplicationSetTemplate{},
+		},
+	}
+	clusterGeneratorParams := map[string]interface{}{
+		"name": "production_01/west", "server": "https://production-01.example.com",
+	}
+	interpolatedGenerator, err = InterpolateGenerator(requestedGenerator, clusterGeneratorParams, true)
+	if err != nil {
+		log.WithError(err).WithField("requestedGenerator", requestedGenerator).Error("error interpolating Generator")
+		return
+	}
+	assert.Equal(t, "production_01/west", interpolatedGenerator.Git.Files[0].Path)
+	assert.Equal(t, "https://production-01.example.com", interpolatedGenerator.Git.Files[1].Path)
+}

applicationset/generators/git.go

@@ -14,7 +14,8 @@ import (
 	"sigs.k8s.io/yaml"
 
 	"github.com/argoproj/argo-cd/v2/applicationset/services"
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	"github.com/argoproj/argo-cd/v2/applicationset/utils"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 var _ Generator = (*GitGenerator)(nil)
@@ -45,7 +46,7 @@ func (g *GitGenerator) GetRequeueAfter(appSetGenerator *argoprojiov1alpha1.Appli
 	return DefaultRequeueAfterSeconds
 }
 
-func (g *GitGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, _ *argoprojiov1alpha1.ApplicationSet) ([]map[string]string, error) {
+func (g *GitGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, appSet *argoprojiov1alpha1.ApplicationSet) ([]map[string]interface{}, error) {
 
 	if appSetGenerator == nil {
 		return nil, EmptyAppSetGeneratorError
@@ -56,11 +57,11 @@ func (g *GitGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.Applic
 	}
 
 	var err error
-	var res []map[string]string
+	var res []map[string]interface{}
 	if appSetGenerator.Git.Directories != nil {
-		res, err = g.generateParamsForGitDirectories(appSetGenerator)
+		res, err = g.generateParamsForGitDirectories(appSetGenerator, appSet.Spec.GoTemplate)
 	} else if appSetGenerator.Git.Files != nil {
-		res, err = g.generateParamsForGitFiles(appSetGenerator)
+		res, err = g.generateParamsForGitFiles(appSetGenerator, appSet.Spec.GoTemplate)
 	} else {
 		return nil, EmptyAppSetGeneratorError
 	}
@@ -71,7 +72,7 @@ func (g *GitGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.Applic
 	return res, nil
 }
 
-func (g *GitGenerator) generateParamsForGitDirectories(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator) ([]map[string]string, error) {
+func (g *GitGenerator) generateParamsForGitDirectories(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, useGoTemplate bool) ([]map[string]interface{}, error) {
 
 	// Directories, not files
 	allPaths, err := g.repos.GetDirectories(context.TODO(), appSetGenerator.Git.RepoURL, appSetGenerator.Git.Revision)
@@ -88,12 +89,12 @@ func (g *GitGenerator) generateParamsForGitDirectories(appSetGenerator *argoproj
 
 	requestedApps := g.filterApps(appSetGenerator.Git.Directories, allPaths)
 
-	res := g.generateParamsFromApps(requestedApps, appSetGenerator)
+	res := g.generateParamsFromApps(requestedApps, appSetGenerator, useGoTemplate)
 
 	return res, nil
 }
 
-func (g *GitGenerator) generateParamsForGitFiles(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator) ([]map[string]string, error) {
+func (g *GitGenerator) generateParamsForGitFiles(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, useGoTemplate bool) ([]map[string]interface{}, error) {
 
 	// Get all files that match the requested path string, removing duplicates
 	allFiles := make(map[string][]byte)
@@ -116,11 +117,11 @@ func (g *GitGenerator) generateParamsForGitFiles(appSetGenerator *argoprojiov1al
 	sort.Strings(allPaths)
 
 	// Generate params from each path, and return
-	res := []map[string]string{}
+	res := []map[string]interface{}{}
 	for _, path := range allPaths {
 
 		// A JSON / YAML file path can contain multiple sets of parameters (ie it is an array)
-		paramsArray, err := g.generateParamsFromGitFile(path, allFiles[path])
+		paramsArray, err := g.generateParamsFromGitFile(path, allFiles[path], useGoTemplate)
 		if err != nil {
 			return nil, fmt.Errorf("unable to process file '%s': %v", path, err)
 		}
@@ -132,7 +133,7 @@ func (g *GitGenerator) generateParamsForGitFiles(appSetGenerator *argoprojiov1al
 	return res, nil
 }
 
-func (g *GitGenerator) generateParamsFromGitFile(filePath string, fileContent []byte) ([]map[string]string, error) {
+func (g *GitGenerator) generateParamsFromGitFile(filePath string, fileContent []byte, useGoTemplate bool) ([]map[string]interface{}, error) {
 	objectsFound := []map[string]interface{}{}
 
 	// First, we attempt to parse as an array
@@ -147,27 +148,46 @@ func (g *GitGenerator) generateParamsFromGitFile(filePath string, fileContent []
 		objectsFound = append(objectsFound, singleObj)
 	}
 
-	res := []map[string]string{}
+	res := []map[string]interface{}{}
 
-	// Flatten all objects found, and return them
 	for _, objectFound := range objectsFound {
 
-		flat, err := flatten.Flatten(objectFound, "", flatten.DotStyle)
-		if err != nil {
-			return nil, err
-		}
-		params := map[string]string{}
-		for k, v := range flat {
-			params[k] = fmt.Sprintf("%v", v)
-		}
-		params["path"] = path.Dir(filePath)
-		params["path.basename"] = path.Base(params["path"])
-		params["path.basenameNormalized"] = sanitizeName(path.Base(params["path"]))
-		for k, v := range strings.Split(strings.TrimSuffix(params["path"], params["path.basename"]), "/") {
-			if len(v) > 0 {
-				params["path["+strconv.Itoa(k)+"]"] = v
+		params := map[string]interface{}{}
+
+		if useGoTemplate {
+			for k, v := range objectFound {
+				params[k] = v
+			}
+
+			paramPath := map[string]interface{}{}
+
+			paramPath["path"] = path.Dir(filePath)
+			paramPath["basename"] = path.Base(paramPath["path"].(string))
+			paramPath["filename"] = path.Base(filePath)
+			paramPath["basenameNormalized"] = utils.SanitizeName(path.Base(paramPath["path"].(string)))
+			paramPath["filenameNormalized"] = utils.SanitizeName(path.Base(paramPath["filename"].(string)))
+			paramPath["segments"] = strings.Split(paramPath["path"].(string), "/")
+			params["path"] = paramPath
+		} else {
+			flat, err := flatten.Flatten(objectFound, "", flatten.DotStyle)
+			if err != nil {
+				return nil, err
+			}
+			for k, v := range flat {
+				params[k] = fmt.Sprintf("%v", v)
+			}
+			params["path"] = path.Dir(filePath)
+			params["path.basename"] = path.Base(params["path"].(string))
+			params["path.filename"] = path.Base(filePath)
+			params["path.basenameNormalized"] = utils.SanitizeName(path.Base(params["path"].(string)))
+			params["path.filenameNormalized"] = utils.SanitizeName(path.Base(params["path.filename"].(string)))
+			for k, v := range strings.Split(params["path"].(string), "/") {
+				if len(v) > 0 {
+					params["path["+strconv.Itoa(k)+"]"] = v
+				}
 			}
 		}
+
 		res = append(res, params)
 	}
 
@@ -203,21 +223,32 @@ func (g *GitGenerator) filterApps(Directories []argoprojiov1alpha1.GitDirectoryG
 	return res
 }
 
-func (g *GitGenerator) generateParamsFromApps(requestedApps []string, _ *argoprojiov1alpha1.ApplicationSetGenerator) []map[string]string {
-	// TODO: At some point, the appicationSetGenerator param should be used
+func (g *GitGenerator) generateParamsFromApps(requestedApps []string, _ *argoprojiov1alpha1.ApplicationSetGenerator, useGoTemplate bool) []map[string]interface{} {
+	// TODO: At some point, the applicationSetGenerator param should be used
 
-	res := make([]map[string]string, len(requestedApps))
+	res := make([]map[string]interface{}, len(requestedApps))
 	for i, a := range requestedApps {
 
-		params := make(map[string]string, 2)
-		params["path"] = a
-		params["path.basename"] = path.Base(a)
-		params["path.basenameNormalized"] = sanitizeName(path.Base(a))
-		for k, v := range strings.Split(strings.TrimSuffix(params["path"], params["path.basename"]), "/") {
-			if len(v) > 0 {
-				params["path["+strconv.Itoa(k)+"]"] = v
+		params := make(map[string]interface{}, 5)
+
+		if useGoTemplate {
+			paramPath := map[string]interface{}{}
+			paramPath["path"] = a
+			paramPath["basename"] = path.Base(a)
+			paramPath["basenameNormalized"] = utils.SanitizeName(path.Base(a))
+			paramPath["segments"] = strings.Split(paramPath["path"].(string), "/")
+			params["path"] = paramPath
+		} else {
+			params["path"] = a
+			params["path.basename"] = path.Base(a)
+			params["path.basenameNormalized"] = utils.SanitizeName(path.Base(a))
+			for k, v := range strings.Split(params["path"].(string), "/") {
+				if len(v) > 0 {
+					params["path["+strconv.Itoa(k)+"]"] = v
+				}
 			}
 		}
+
 		res[i] = params
 	}
 

applicationset/generators/git_test.go

@@ -9,7 +9,7 @@ import (
 	"github.com/stretchr/testify/mock"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 // type clientSet struct {
@@ -47,6 +47,56 @@ func (a argoCDServiceMock) GetDirectories(ctx context.Context, repoURL string, r
 	return args.Get(0).([]string), args.Error(1)
 }
 
+func Test_generateParamsFromGitFile(t *testing.T) {
+	params, err := (*GitGenerator)(nil).generateParamsFromGitFile("path/dir/file_name.yaml", []byte(`
+foo:
+  bar: baz
+`), false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	assert.Equal(t, []map[string]interface{}{
+		{
+			"foo.bar":                 "baz",
+			"path":                    "path/dir",
+			"path.basename":           "dir",
+			"path.filename":           "file_name.yaml",
+			"path.basenameNormalized": "dir",
+			"path.filenameNormalized": "file-name.yaml",
+			"path[0]":                 "path",
+			"path[1]":                 "dir",
+		},
+	}, params)
+}
+
+func Test_generateParamsFromGitFileGoTemplate(t *testing.T) {
+	params, err := (*GitGenerator)(nil).generateParamsFromGitFile("path/dir/file_name.yaml", []byte(`
+foo:
+  bar: baz
+`), true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	assert.Equal(t, []map[string]interface{}{
+		{
+			"foo": map[string]interface{}{
+				"bar": "baz",
+			},
+			"path": map[string]interface{}{
+				"path":               "path/dir",
+				"basename":           "dir",
+				"filename":           "file_name.yaml",
+				"basenameNormalized": "dir",
+				"filenameNormalized": "file-name.yaml",
+				"segments": []string{
+					"path",
+					"dir",
+				},
+			},
+		},
+	}, params)
+}
+
 func TestGitGenerateParamsFromDirectories(t *testing.T) {
 
 	cases := []struct {
@@ -54,7 +104,7 @@ func TestGitGenerateParamsFromDirectories(t *testing.T) {
 		directories   []argoprojiov1alpha1.GitDirectoryGeneratorItem
 		repoApps      []string
 		repoError     error
-		expected      []map[string]string
+		expected      []map[string]interface{}
 		expectedError error
 	}{
 		{
@@ -67,10 +117,10 @@ func TestGitGenerateParamsFromDirectories(t *testing.T) {
 				"p1/app4",
 			},
 			repoError: nil,
-			expected: []map[string]string{
-				{"path": "app1", "path.basename": "app1", "path.basenameNormalized": "app1"},
-				{"path": "app2", "path.basename": "app2", "path.basenameNormalized": "app2"},
-				{"path": "app_3", "path.basename": "app_3", "path.basenameNormalized": "app-3"},
+			expected: []map[string]interface{}{
+				{"path": "app1", "path.basename": "app1", "path.basenameNormalized": "app1", "path[0]": "app1"},
+				{"path": "app2", "path.basename": "app2", "path.basenameNormalized": "app2", "path[0]": "app2"},
+				{"path": "app_3", "path.basename": "app_3", "path.basenameNormalized": "app-3", "path[0]": "app_3"},
 			},
 			expectedError: nil,
 		},
@@ -84,9 +134,9 @@ func TestGitGenerateParamsFromDirectories(t *testing.T) {
 				"p1/p2/p3/app4",
 			},
 			repoError: nil,
-			expected: []map[string]string{
-				{"path": "p1/app2", "path.basename": "app2", "path[0]": "p1", "path.basenameNormalized": "app2"},
-				{"path": "p1/p2/app3", "path.basename": "app3", "path[0]": "p1", "path[1]": "p2", "path.basenameNormalized": "app3"},
+			expected: []map[string]interface{}{
+				{"path": "p1/app2", "path.basename": "app2", "path[0]": "p1", "path[1]": "app2", "path.basenameNormalized": "app2"},
+				{"path": "p1/p2/app3", "path.basename": "app3", "path[0]": "p1", "path[1]": "p2", "path[2]": "app3", "path.basenameNormalized": "app3"},
 			},
 			expectedError: nil,
 		},
@@ -101,10 +151,10 @@ func TestGitGenerateParamsFromDirectories(t *testing.T) {
 				"p2/app3",
 			},
 			repoError: nil,
-			expected: []map[string]string{
-				{"path": "app1", "path.basename": "app1", "path.basenameNormalized": "app1"},
-				{"path": "app2", "path.basename": "app2", "path.basenameNormalized": "app2"},
-				{"path": "p2/app3", "path.basename": "app3", "path[0]": "p2", "path.basenameNormalized": "app3"},
+			expected: []map[string]interface{}{
+				{"path": "app1", "path.basename": "app1", "path[0]": "app1", "path.basenameNormalized": "app1"},
+				{"path": "app2", "path.basename": "app2", "path[0]": "app2", "path.basenameNormalized": "app2"},
+				{"path": "p2/app3", "path.basename": "app3", "path[0]": "p2", "path[1]": "app3", "path.basenameNormalized": "app3"},
 			},
 			expectedError: nil,
 		},
@@ -119,10 +169,10 @@ func TestGitGenerateParamsFromDirectories(t *testing.T) {
 				"p2/app3",
 			},
 			repoError: nil,
-			expected: []map[string]string{
-				{"path": "app1", "path.basename": "app1", "path.basenameNormalized": "app1"},
-				{"path": "app2", "path.basename": "app2", "path.basenameNormalized": "app2"},
-				{"path": "p2/app3", "path.basename": "app3", "path[0]": "p2", "path.basenameNormalized": "app3"},
+			expected: []map[string]interface{}{
+				{"path": "app1", "path.basename": "app1", "path[0]": "app1", "path.basenameNormalized": "app1"},
+				{"path": "app2", "path.basename": "app2", "path[0]": "app2", "path.basenameNormalized": "app2"},
+				{"path": "p2/app3", "path.basename": "app3", "path[0]": "p2", "path[1]": "app3", "path.basenameNormalized": "app3"},
 			},
 			expectedError: nil,
 		},
@@ -131,7 +181,7 @@ func TestGitGenerateParamsFromDirectories(t *testing.T) {
 			directories:   []argoprojiov1alpha1.GitDirectoryGeneratorItem{{Path: "*"}},
 			repoApps:      []string{},
 			repoError:     nil,
-			expected:      []map[string]string{},
+			expected:      []map[string]interface{}{},
 			expectedError: nil,
 		},
 		{
@@ -139,7 +189,7 @@ func TestGitGenerateParamsFromDirectories(t *testing.T) {
 			directories:   []argoprojiov1alpha1.GitDirectoryGeneratorItem{{Path: "*"}},
 			repoApps:      []string{},
 			repoError:     fmt.Errorf("error"),
-			expected:      []map[string]string{},
+			expected:      []map[string]interface{}{},
 			expectedError: fmt.Errorf("error"),
 		},
 	}
@@ -170,7 +220,250 @@ func TestGitGenerateParamsFromDirectories(t *testing.T) {
 				},
 			}
 
-			got, err := gitGenerator.GenerateParams(&applicationSetInfo.Spec.Generators[0], nil)
+			got, err := gitGenerator.GenerateParams(&applicationSetInfo.Spec.Generators[0], &applicationSetInfo)
+
+			if testCaseCopy.expectedError != nil {
+				assert.EqualError(t, err, testCaseCopy.expectedError.Error())
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, testCaseCopy.expected, got)
+			}
+
+			argoCDServiceMock.mock.AssertExpectations(t)
+		})
+	}
+}
+
+func TestGitGenerateParamsFromDirectoriesGoTemplate(t *testing.T) {
+
+	cases := []struct {
+		name          string
+		directories   []argoprojiov1alpha1.GitDirectoryGeneratorItem
+		repoApps      []string
+		repoError     error
+		expected      []map[string]interface{}
+		expectedError error
+	}{
+		{
+			name:        "happy flow - created apps",
+			directories: []argoprojiov1alpha1.GitDirectoryGeneratorItem{{Path: "*"}},
+			repoApps: []string{
+				"app1",
+				"app2",
+				"app_3",
+				"p1/app4",
+			},
+			repoError: nil,
+			expected: []map[string]interface{}{
+				{
+					"path": map[string]interface{}{
+						"path":               "app1",
+						"basename":           "app1",
+						"basenameNormalized": "app1",
+						"segments": []string{
+							"app1",
+						},
+					},
+				},
+				{
+					"path": map[string]interface{}{
+						"path":               "app2",
+						"basename":           "app2",
+						"basenameNormalized": "app2",
+						"segments": []string{
+							"app2",
+						},
+					},
+				},
+				{
+					"path": map[string]interface{}{
+						"path":               "app_3",
+						"basename":           "app_3",
+						"basenameNormalized": "app-3",
+						"segments": []string{
+							"app_3",
+						},
+					},
+				},
+			},
+			expectedError: nil,
+		},
+		{
+			name:        "It filters application according to the paths",
+			directories: []argoprojiov1alpha1.GitDirectoryGeneratorItem{{Path: "p1/*"}, {Path: "p1/*/*"}},
+			repoApps: []string{
+				"app1",
+				"p1/app2",
+				"p1/p2/app3",
+				"p1/p2/p3/app4",
+			},
+			repoError: nil,
+			expected: []map[string]interface{}{
+				{
+					"path": map[string]interface{}{
+						"path":               "p1/app2",
+						"basename":           "app2",
+						"basenameNormalized": "app2",
+						"segments": []string{
+							"p1",
+							"app2",
+						},
+					},
+				},
+				{
+					"path": map[string]interface{}{
+						"path":               "p1/p2/app3",
+						"basename":           "app3",
+						"basenameNormalized": "app3",
+						"segments": []string{
+							"p1",
+							"p2",
+							"app3",
+						},
+					},
+				},
+			},
+			expectedError: nil,
+		},
+		{
+			name:        "It filters application according to the paths with Exclude",
+			directories: []argoprojiov1alpha1.GitDirectoryGeneratorItem{{Path: "p1/*", Exclude: true}, {Path: "*"}, {Path: "*/*"}},
+			repoApps: []string{
+				"app1",
+				"app2",
+				"p1/app2",
+				"p1/app3",
+				"p2/app3",
+			},
+			repoError: nil,
+			expected: []map[string]interface{}{
+				{
+					"path": map[string]interface{}{
+						"path":               "app1",
+						"basename":           "app1",
+						"basenameNormalized": "app1",
+						"segments": []string{
+							"app1",
+						},
+					},
+				},
+				{
+					"path": map[string]interface{}{
+						"path":               "app2",
+						"basename":           "app2",
+						"basenameNormalized": "app2",
+						"segments": []string{
+							"app2",
+						},
+					},
+				},
+				{
+					"path": map[string]interface{}{
+						"path":               "p2/app3",
+						"basename":           "app3",
+						"basenameNormalized": "app3",
+						"segments": []string{
+							"p2",
+							"app3",
+						},
+					},
+				},
+			},
+			expectedError: nil,
+		},
+		{
+			name:        "Expecting same exclude behavior with different order",
+			directories: []argoprojiov1alpha1.GitDirectoryGeneratorItem{{Path: "*"}, {Path: "*/*"}, {Path: "p1/*", Exclude: true}},
+			repoApps: []string{
+				"app1",
+				"app2",
+				"p1/app2",
+				"p1/app3",
+				"p2/app3",
+			},
+			repoError: nil,
+			expected: []map[string]interface{}{
+
+				{
+					"path": map[string]interface{}{
+						"path":               "app1",
+						"basename":           "app1",
+						"basenameNormalized": "app1",
+						"segments": []string{
+							"app1",
+						},
+					},
+				},
+				{
+					"path": map[string]interface{}{
+						"path":               "app2",
+						"basename":           "app2",
+						"basenameNormalized": "app2",
+						"segments": []string{
+							"app2",
+						},
+					},
+				},
+				{
+					"path": map[string]interface{}{
+						"path":               "p2/app3",
+						"basename":           "app3",
+						"basenameNormalized": "app3",
+						"segments": []string{
+							"p2",
+							"app3",
+						},
+					},
+				},
+			},
+			expectedError: nil,
+		},
+		{
+			name:          "handles empty response from repo server",
+			directories:   []argoprojiov1alpha1.GitDirectoryGeneratorItem{{Path: "*"}},
+			repoApps:      []string{},
+			repoError:     nil,
+			expected:      []map[string]interface{}{},
+			expectedError: nil,
+		},
+		{
+			name:          "handles error from repo server",
+			directories:   []argoprojiov1alpha1.GitDirectoryGeneratorItem{{Path: "*"}},
+			repoApps:      []string{},
+			repoError:     fmt.Errorf("error"),
+			expected:      []map[string]interface{}{},
+			expectedError: fmt.Errorf("error"),
+		},
+	}
+
+	for _, testCase := range cases {
+		testCaseCopy := testCase
+
+		t.Run(testCaseCopy.name, func(t *testing.T) {
+			t.Parallel()
+
+			argoCDServiceMock := argoCDServiceMock{mock: &mock.Mock{}}
+
+			argoCDServiceMock.mock.On("GetDirectories", mock.Anything, mock.Anything, mock.Anything).Return(testCaseCopy.repoApps, testCaseCopy.repoError)
+
+			var gitGenerator = NewGitGenerator(argoCDServiceMock)
+			applicationSetInfo := argoprojiov1alpha1.ApplicationSet{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "set",
+				},
+				Spec: argoprojiov1alpha1.ApplicationSetSpec{
+					GoTemplate: true,
+					Generators: []argoprojiov1alpha1.ApplicationSetGenerator{{
+						Git: &argoprojiov1alpha1.GitGenerator{
+							RepoURL:     "RepoURL",
+							Revision:    "Revision",
+							Directories: testCaseCopy.directories,
+						},
+					}},
+				},
+			}
+
+			got, err := gitGenerator.GenerateParams(&applicationSetInfo.Spec.Generators[0], &applicationSetInfo)
 
 			if testCaseCopy.expectedError != nil {
 				assert.EqualError(t, err, testCaseCopy.expectedError.Error())
@@ -195,7 +488,7 @@ func TestGitGenerateParamsFromFiles(t *testing.T) {
 		repoFileContents map[string][]byte
 		// if repoPathsError is non-nil, the call to GetPaths(...) will return this error value
 		repoPathsError error
-		expected       []map[string]string
+		expected       []map[string]interface{}
 		expectedError  error
 	}{
 		{
@@ -226,7 +519,7 @@ func TestGitGenerateParamsFromFiles(t *testing.T) {
 }`),
 			},
 			repoPathsError: nil,
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{
 					"cluster.owner":           "john.doe@example.com",
 					"cluster.name":            "production",
@@ -238,7 +531,10 @@ func TestGitGenerateParamsFromFiles(t *testing.T) {
 					"path":                    "cluster-config/production",
 					"path.basename":           "production",
 					"path[0]":                 "cluster-config",
+					"path[1]":                 "production",
 					"path.basenameNormalized": "production",
+					"path.filename":           "config.json",
+					"path.filenameNormalized": "config.json",
 				},
 				{
 					"cluster.owner":           "foo.bar@example.com",
@@ -247,7 +543,10 @@ func TestGitGenerateParamsFromFiles(t *testing.T) {
 					"path":                    "cluster-config/staging",
 					"path.basename":           "staging",
 					"path[0]":                 "cluster-config",
+					"path[1]":                 "staging",
 					"path.basenameNormalized": "staging",
+					"path.filename":           "config.json",
+					"path.filenameNormalized": "config.json",
 				},
 			},
 			expectedError: nil,
@@ -257,7 +556,7 @@ func TestGitGenerateParamsFromFiles(t *testing.T) {
 			files:            []argoprojiov1alpha1.GitFileGeneratorItem{{Path: "**/config.json"}},
 			repoFileContents: map[string][]byte{},
 			repoPathsError:   fmt.Errorf("paths error"),
-			expected:         []map[string]string{},
+			expected:         []map[string]interface{}{},
 			expectedError:    fmt.Errorf("paths error"),
 		},
 		{
@@ -267,7 +566,7 @@ func TestGitGenerateParamsFromFiles(t *testing.T) {
 				"cluster-config/production/config.json": []byte(`invalid json file`),
 			},
 			repoPathsError: nil,
-			expected:       []map[string]string{},
+			expected:       []map[string]interface{}{},
 			expectedError:  fmt.Errorf("unable to process file 'cluster-config/production/config.json': unable to parse file: error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string into Go value of type map[string]interface {}"),
 		},
 		{
@@ -296,7 +595,7 @@ func TestGitGenerateParamsFromFiles(t *testing.T) {
 ]`),
 			},
 			repoPathsError: nil,
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{
 					"cluster.owner":           "john.doe@example.com",
 					"cluster.name":            "production",
@@ -305,7 +604,10 @@ func TestGitGenerateParamsFromFiles(t *testing.T) {
 					"path":                    "cluster-config/production",
 					"path.basename":           "production",
 					"path[0]":                 "cluster-config",
+					"path[1]":                 "production",
 					"path.basenameNormalized": "production",
+					"path.filename":           "config.json",
+					"path.filenameNormalized": "config.json",
 				},
 				{
 					"cluster.owner":           "john.doe@example.com",
@@ -314,7 +616,10 @@ func TestGitGenerateParamsFromFiles(t *testing.T) {
 					"path":                    "cluster-config/production",
 					"path.basename":           "production",
 					"path[0]":                 "cluster-config",
+					"path[1]":                 "production",
 					"path.basenameNormalized": "production",
+					"path.filename":           "config.json",
+					"path.filenameNormalized": "config.json",
 				},
 			},
 			expectedError: nil,
@@ -342,7 +647,7 @@ cluster:
 `),
 			},
 			repoPathsError: nil,
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{
 					"cluster.owner":           "john.doe@example.com",
 					"cluster.name":            "production",
@@ -353,7 +658,10 @@ cluster:
 					"path":                    "cluster-config/production",
 					"path.basename":           "production",
 					"path[0]":                 "cluster-config",
+					"path[1]":                 "production",
 					"path.basenameNormalized": "production",
+					"path.filename":           "config.yaml",
+					"path.filenameNormalized": "config.yaml",
 				},
 				{
 					"cluster.owner":           "foo.bar@example.com",
@@ -362,7 +670,10 @@ cluster:
 					"path":                    "cluster-config/staging",
 					"path.basename":           "staging",
 					"path[0]":                 "cluster-config",
+					"path[1]":                 "staging",
 					"path.basenameNormalized": "staging",
+					"path.filename":           "config.yaml",
+					"path.filenameNormalized": "config.yaml",
 				},
 			},
 			expectedError: nil,
@@ -384,7 +695,7 @@ cluster:
     address: https://kubernetes.default.svc`),
 			},
 			repoPathsError: nil,
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{
 					"cluster.owner":           "john.doe@example.com",
 					"cluster.name":            "production",
@@ -393,7 +704,10 @@ cluster:
 					"path":                    "cluster-config/production",
 					"path.basename":           "production",
 					"path[0]":                 "cluster-config",
+					"path[1]":                 "production",
 					"path.basenameNormalized": "production",
+					"path.filename":           "config.yaml",
+					"path.filenameNormalized": "config.yaml",
 				},
 				{
 					"cluster.owner":           "john.doe@example.com",
@@ -402,7 +716,10 @@ cluster:
 					"path":                    "cluster-config/production",
 					"path.basename":           "production",
 					"path[0]":                 "cluster-config",
+					"path[1]":                 "production",
 					"path.basenameNormalized": "production",
+					"path.filename":           "config.yaml",
+					"path.filenameNormalized": "config.yaml",
 				},
 			},
 			expectedError: nil,
@@ -435,7 +752,357 @@ cluster:
 				},
 			}
 
-			got, err := gitGenerator.GenerateParams(&applicationSetInfo.Spec.Generators[0], nil)
+			got, err := gitGenerator.GenerateParams(&applicationSetInfo.Spec.Generators[0], &applicationSetInfo)
+			fmt.Println(got, err)
+
+			if testCaseCopy.expectedError != nil {
+				assert.EqualError(t, err, testCaseCopy.expectedError.Error())
+			} else {
+				assert.NoError(t, err)
+				assert.ElementsMatch(t, testCaseCopy.expected, got)
+			}
+
+			argoCDServiceMock.mock.AssertExpectations(t)
+		})
+	}
+}
+
+func TestGitGenerateParamsFromFilesGoTemplate(t *testing.T) {
+
+	cases := []struct {
+		name string
+		// files is the list of paths/globs to match
+		files []argoprojiov1alpha1.GitFileGeneratorItem
+		// repoFileContents maps repo path to the literal contents of that path
+		repoFileContents map[string][]byte
+		// if repoPathsError is non-nil, the call to GetPaths(...) will return this error value
+		repoPathsError error
+		expected       []map[string]interface{}
+		expectedError  error
+	}{
+		{
+			name:  "happy flow: create params from git files",
+			files: []argoprojiov1alpha1.GitFileGeneratorItem{{Path: "**/config.json"}},
+			repoFileContents: map[string][]byte{
+				"cluster-config/production/config.json": []byte(`{
+   "cluster": {
+       "owner": "john.doe@example.com",
+       "name": "production",
+       "address": "https://kubernetes.default.svc"
+   },
+   "key1": "val1",
+   "key2": {
+       "key2_1": "val2_1",
+       "key2_2": {
+           "key2_2_1": "val2_2_1"
+       }
+   },
+   "key3": 123
+}`),
+				"cluster-config/staging/config.json": []byte(`{
+   "cluster": {
+       "owner": "foo.bar@example.com",
+       "name": "staging",
+       "address": "https://kubernetes.default.svc"
+   }
+}`),
+			},
+			repoPathsError: nil,
+			expected: []map[string]interface{}{
+				{
+					"cluster": map[string]interface{}{
+						"owner":   "john.doe@example.com",
+						"name":    "production",
+						"address": "https://kubernetes.default.svc",
+					},
+					"key1": "val1",
+					"key2": map[string]interface{}{
+						"key2_1": "val2_1",
+						"key2_2": map[string]interface{}{
+							"key2_2_1": "val2_2_1",
+						},
+					},
+					"key3": float64(123),
+					"path": map[string]interface{}{
+						"path":               "cluster-config/production",
+						"basename":           "production",
+						"filename":           "config.json",
+						"basenameNormalized": "production",
+						"filenameNormalized": "config.json",
+						"segments": []string{
+							"cluster-config",
+							"production",
+						},
+					},
+				},
+				{
+					"cluster": map[string]interface{}{
+						"owner":   "foo.bar@example.com",
+						"name":    "staging",
+						"address": "https://kubernetes.default.svc",
+					},
+					"path": map[string]interface{}{
+						"path":               "cluster-config/staging",
+						"basename":           "staging",
+						"filename":           "config.json",
+						"basenameNormalized": "staging",
+						"filenameNormalized": "config.json",
+						"segments": []string{
+							"cluster-config",
+							"staging",
+						},
+					},
+				},
+			},
+			expectedError: nil,
+		},
+		{
+			name:             "handles error during getting repo paths",
+			files:            []argoprojiov1alpha1.GitFileGeneratorItem{{Path: "**/config.json"}},
+			repoFileContents: map[string][]byte{},
+			repoPathsError:   fmt.Errorf("paths error"),
+			expected:         []map[string]interface{}{},
+			expectedError:    fmt.Errorf("paths error"),
+		},
+		{
+			name:  "test invalid JSON file returns error",
+			files: []argoprojiov1alpha1.GitFileGeneratorItem{{Path: "**/config.json"}},
+			repoFileContents: map[string][]byte{
+				"cluster-config/production/config.json": []byte(`invalid json file`),
+			},
+			repoPathsError: nil,
+			expected:       []map[string]interface{}{},
+			expectedError:  fmt.Errorf("unable to process file 'cluster-config/production/config.json': unable to parse file: error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string into Go value of type map[string]interface {}"),
+		},
+		{
+			name:  "test JSON array",
+			files: []argoprojiov1alpha1.GitFileGeneratorItem{{Path: "**/config.json"}},
+			repoFileContents: map[string][]byte{
+				"cluster-config/production/config.json": []byte(`
+[
+	{
+		"cluster": {
+			"owner": "john.doe@example.com",
+			"name": "production",
+			"address": "https://kubernetes.default.svc",
+			"inner": {
+				"one" : "two"
+			}
+		}
+	},
+	{
+		"cluster": {
+			"owner": "john.doe@example.com",
+			"name": "staging",
+			"address": "https://kubernetes.default.svc"
+		}
+	}
+]`),
+			},
+			repoPathsError: nil,
+			expected: []map[string]interface{}{
+				{
+					"cluster": map[string]interface{}{
+						"owner":   "john.doe@example.com",
+						"name":    "production",
+						"address": "https://kubernetes.default.svc",
+						"inner": map[string]interface{}{
+							"one": "two",
+						},
+					},
+					"path": map[string]interface{}{
+						"path":               "cluster-config/production",
+						"basename":           "production",
+						"filename":           "config.json",
+						"basenameNormalized": "production",
+						"filenameNormalized": "config.json",
+						"segments": []string{
+							"cluster-config",
+							"production",
+						},
+					},
+				},
+				{
+					"cluster": map[string]interface{}{
+						"owner":   "john.doe@example.com",
+						"name":    "staging",
+						"address": "https://kubernetes.default.svc",
+					},
+					"path": map[string]interface{}{
+						"path":               "cluster-config/production",
+						"basename":           "production",
+						"filename":           "config.json",
+						"basenameNormalized": "production",
+						"filenameNormalized": "config.json",
+						"segments": []string{
+							"cluster-config",
+							"production",
+						},
+					},
+				},
+			},
+			expectedError: nil,
+		},
+		{
+			name:  "Test YAML flow",
+			files: []argoprojiov1alpha1.GitFileGeneratorItem{{Path: "**/config.yaml"}},
+			repoFileContents: map[string][]byte{
+				"cluster-config/production/config.yaml": []byte(`
+cluster:
+  owner: john.doe@example.com
+  name: production
+  address: https://kubernetes.default.svc
+key1: val1
+key2:
+  key2_1: val2_1
+  key2_2:
+    key2_2_1: val2_2_1
+`),
+				"cluster-config/staging/config.yaml": []byte(`
+cluster:
+  owner: foo.bar@example.com
+  name: staging
+  address: https://kubernetes.default.svc
+`),
+			},
+			repoPathsError: nil,
+			expected: []map[string]interface{}{
+				{
+					"cluster": map[string]interface{}{
+						"owner":   "john.doe@example.com",
+						"name":    "production",
+						"address": "https://kubernetes.default.svc",
+					},
+					"key1": "val1",
+					"key2": map[string]interface{}{
+						"key2_1": "val2_1",
+						"key2_2": map[string]interface{}{
+							"key2_2_1": "val2_2_1",
+						},
+					},
+					"path": map[string]interface{}{
+						"path":               "cluster-config/production",
+						"basename":           "production",
+						"filename":           "config.yaml",
+						"basenameNormalized": "production",
+						"filenameNormalized": "config.yaml",
+						"segments": []string{
+							"cluster-config",
+							"production",
+						},
+					},
+				},
+				{
+					"cluster": map[string]interface{}{
+						"owner":   "foo.bar@example.com",
+						"name":    "staging",
+						"address": "https://kubernetes.default.svc",
+					},
+					"path": map[string]interface{}{
+						"path":               "cluster-config/staging",
+						"basename":           "staging",
+						"filename":           "config.yaml",
+						"basenameNormalized": "staging",
+						"filenameNormalized": "config.yaml",
+						"segments": []string{
+							"cluster-config",
+							"staging",
+						},
+					},
+				},
+			},
+			expectedError: nil,
+		},
+		{
+			name:  "test YAML array",
+			files: []argoprojiov1alpha1.GitFileGeneratorItem{{Path: "**/config.yaml"}},
+			repoFileContents: map[string][]byte{
+				"cluster-config/production/config.yaml": []byte(`
+- cluster:
+    owner: john.doe@example.com
+    name: production
+    address: https://kubernetes.default.svc
+    inner:
+      one: two
+- cluster:
+    owner: john.doe@example.com
+    name: staging
+    address: https://kubernetes.default.svc`),
+			},
+			repoPathsError: nil,
+			expected: []map[string]interface{}{
+				{
+					"cluster": map[string]interface{}{
+						"owner":   "john.doe@example.com",
+						"name":    "production",
+						"address": "https://kubernetes.default.svc",
+						"inner": map[string]interface{}{
+							"one": "two",
+						},
+					},
+					"path": map[string]interface{}{
+						"path":               "cluster-config/production",
+						"basename":           "production",
+						"filename":           "config.yaml",
+						"basenameNormalized": "production",
+						"filenameNormalized": "config.yaml",
+						"segments": []string{
+							"cluster-config",
+							"production",
+						},
+					},
+				},
+				{
+					"cluster": map[string]interface{}{
+						"owner":   "john.doe@example.com",
+						"name":    "staging",
+						"address": "https://kubernetes.default.svc",
+					},
+					"path": map[string]interface{}{
+						"path":               "cluster-config/production",
+						"basename":           "production",
+						"filename":           "config.yaml",
+						"basenameNormalized": "production",
+						"filenameNormalized": "config.yaml",
+						"segments": []string{
+							"cluster-config",
+							"production",
+						},
+					},
+				},
+			},
+			expectedError: nil,
+		},
+	}
+
+	for _, testCase := range cases {
+		testCaseCopy := testCase
+
+		t.Run(testCaseCopy.name, func(t *testing.T) {
+			t.Parallel()
+
+			argoCDServiceMock := argoCDServiceMock{mock: &mock.Mock{}}
+			argoCDServiceMock.mock.On("GetFiles", mock.Anything, mock.Anything, mock.Anything, mock.Anything).
+				Return(testCaseCopy.repoFileContents, testCaseCopy.repoPathsError)
+
+			var gitGenerator = NewGitGenerator(argoCDServiceMock)
+			applicationSetInfo := argoprojiov1alpha1.ApplicationSet{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "set",
+				},
+				Spec: argoprojiov1alpha1.ApplicationSetSpec{
+					GoTemplate: true,
+					Generators: []argoprojiov1alpha1.ApplicationSetGenerator{{
+						Git: &argoprojiov1alpha1.GitGenerator{
+							RepoURL:  "RepoURL",
+							Revision: "Revision",
+							Files:    testCaseCopy.files,
+						},
+					}},
+				},
+			}
+
+			got, err := gitGenerator.GenerateParams(&applicationSetInfo.Spec.Generators[0], &applicationSetInfo)
 			fmt.Println(got, err)
 
 			if testCaseCopy.expectedError != nil {
@@ -448,5 +1115,4 @@ cluster:
 			argoCDServiceMock.mock.AssertExpectations(t)
 		})
 	}
-
 }

applicationset/generators/interface.go

@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"time"
 
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 // Generator defines the interface implemented by all ApplicationSet generators.
@@ -12,9 +12,9 @@ type Generator interface {
 	// GenerateParams interprets the ApplicationSet and generates all relevant parameters for the application template.
 	// The expected / desired list of parameters is returned, it then will be render and reconciled
 	// against the current state of the Applications in the cluster.
-	GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, applicationSetInfo *argoprojiov1alpha1.ApplicationSet) ([]map[string]string, error)
+	GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, applicationSetInfo *argoprojiov1alpha1.ApplicationSet) ([]map[string]interface{}, error)
 
-	// GetRequeueAfter is the the generator can controller the next reconciled loop
+	// GetRequeueAfter is the generator can controller the next reconciled loop
 	// In case there is more then one generator the time will be the minimum of the times.
 	// In case NoRequeueAfter is empty, it will be ignored
 	GetRequeueAfter(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator) time.Duration

applicationset/generators/list.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"time"
 
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 var _ Generator = (*ListGenerator)(nil)
@@ -26,7 +26,7 @@ func (g *ListGenerator) GetTemplate(appSetGenerator *argoprojiov1alpha1.Applicat
 	return &appSetGenerator.List.Template
 }
 
-func (g *ListGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, _ *argoprojiov1alpha1.ApplicationSet) ([]map[string]string, error) {
+func (g *ListGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, appSet *argoprojiov1alpha1.ApplicationSet) ([]map[string]interface{}, error) {
 	if appSetGenerator == nil {
 		return nil, EmptyAppSetGeneratorError
 	}
@@ -35,39 +35,42 @@ func (g *ListGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.Appli
 		return nil, EmptyAppSetGeneratorError
 	}
 
-	res := make([]map[string]string, len(appSetGenerator.List.Elements))
+	res := make([]map[string]interface{}, len(appSetGenerator.List.Elements))
 
 	for i, tmpItem := range appSetGenerator.List.Elements {
-		params := map[string]string{}
+		params := map[string]interface{}{}
 		var element map[string]interface{}
 		err := json.Unmarshal(tmpItem.Raw, &element)
 		if err != nil {
 			return nil, fmt.Errorf("error unmarshling list element %v", err)
 		}
 
-		for key, value := range element {
-			if key == "values" {
-				values, ok := (value).(map[string]interface{})
-				if !ok {
-					return nil, fmt.Errorf("error parsing values map")
-				}
-				for k, v := range values {
-					value, ok := v.(string)
+		if appSet.Spec.GoTemplate {
+			res[i] = element
+		} else {
+			for key, value := range element {
+				if key == "values" {
+					values, ok := (value).(map[string]interface{})
+					if !ok {
+						return nil, fmt.Errorf("error parsing values map")
+					}
+					for k, v := range values {
+						value, ok := v.(string)
+						if !ok {
+							return nil, fmt.Errorf("error parsing value as string %v", err)
+						}
+						params[fmt.Sprintf("values.%s", k)] = value
+					}
+				} else {
+					v, ok := value.(string)
 					if !ok {
 						return nil, fmt.Errorf("error parsing value as string %v", err)
 					}
-					params[fmt.Sprintf("values.%s", k)] = value
+					params[key] = v
 				}
-			} else {
-				v, ok := value.(string)
-				if !ok {
-					return nil, fmt.Errorf("error parsing value as string %v", err)
-				}
-				params[key] = v
+				res[i] = params
 			}
 		}
-
-		res[i] = params
 	}
 
 	return res, nil

applicationset/generators/list_test.go

@@ -5,21 +5,22 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 func TestGenerateListParams(t *testing.T) {
 	testCases := []struct {
 		elements []apiextensionsv1.JSON
-		expected []map[string]string
+		expected []map[string]interface{}
 	}{
 		{
 			elements: []apiextensionsv1.JSON{{Raw: []byte(`{"cluster": "cluster","url": "url"}`)}},
-			expected: []map[string]string{{"cluster": "cluster", "url": "url"}},
+			expected: []map[string]interface{}{{"cluster": "cluster", "url": "url"}},
 		}, {
 			elements: []apiextensionsv1.JSON{{Raw: []byte(`{"cluster": "cluster","url": "url","values":{"foo":"bar"}}`)}},
-			expected: []map[string]string{{"cluster": "cluster", "url": "url", "values.foo": "bar"}},
+			expected: []map[string]interface{}{{"cluster": "cluster", "url": "url", "values.foo": "bar"}},
 		},
 	}
 
@@ -27,13 +28,57 @@ func TestGenerateListParams(t *testing.T) {
 
 		var listGenerator = NewListGenerator()
 
+		applicationSetInfo := argoprojiov1alpha1.ApplicationSet{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "set",
+			},
+			Spec: argoprojiov1alpha1.ApplicationSetSpec{},
+		}
+
 		got, err := listGenerator.GenerateParams(&argoprojiov1alpha1.ApplicationSetGenerator{
 			List: &argoprojiov1alpha1.ListGenerator{
 				Elements: testCase.elements,
-			}}, nil)
+			}}, &applicationSetInfo)
 
 		assert.NoError(t, err)
 		assert.ElementsMatch(t, testCase.expected, got)
 
 	}
 }
+
+func TestGenerateListParamsGoTemplate(t *testing.T) {
+	testCases := []struct {
+		elements []apiextensionsv1.JSON
+		expected []map[string]interface{}
+	}{
+		{
+			elements: []apiextensionsv1.JSON{{Raw: []byte(`{"cluster": "cluster","url": "url"}`)}},
+			expected: []map[string]interface{}{{"cluster": "cluster", "url": "url"}},
+		}, {
+			elements: []apiextensionsv1.JSON{{Raw: []byte(`{"cluster": "cluster","url": "url","values":{"foo":"bar"}}`)}},
+			expected: []map[string]interface{}{{"cluster": "cluster", "url": "url", "values": map[string]interface{}{"foo": "bar"}}},
+		},
+	}
+
+	for _, testCase := range testCases {
+
+		var listGenerator = NewListGenerator()
+
+		applicationSetInfo := argoprojiov1alpha1.ApplicationSet{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "set",
+			},
+			Spec: argoprojiov1alpha1.ApplicationSetSpec{
+				GoTemplate: true,
+			},
+		}
+
+		got, err := listGenerator.GenerateParams(&argoprojiov1alpha1.ApplicationSetGenerator{
+			List: &argoprojiov1alpha1.ListGenerator{
+				Elements: testCase.elements,
+			}}, &applicationSetInfo)
+
+		assert.NoError(t, err)
+		assert.ElementsMatch(t, testCase.expected, got)
+	}
+}

applicationset/generators/matrix.go

@@ -4,8 +4,10 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/imdario/mergo"
+
 	"github.com/argoproj/argo-cd/v2/applicationset/utils"
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 var _ Generator = (*MatrixGenerator)(nil)
@@ -28,7 +30,7 @@ func NewMatrixGenerator(supportedGenerators map[string]Generator) Generator {
 	return m
 }
 
-func (m *MatrixGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, appSet *argoprojiov1alpha1.ApplicationSet) ([]map[string]string, error) {
+func (m *MatrixGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, appSet *argoprojiov1alpha1.ApplicationSet) ([]map[string]interface{}, error) {
 
 	if appSetGenerator.Matrix == nil {
 		return nil, EmptyAppSetGeneratorError
@@ -42,31 +44,42 @@ func (m *MatrixGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.App
 		return nil, ErrMoreThanTwoGenerators
 	}
 
-	res := []map[string]string{}
+	res := []map[string]interface{}{}
 
-	g0, err := m.getParams(appSetGenerator.Matrix.Generators[0], appSet)
+	g0, err := m.getParams(appSetGenerator.Matrix.Generators[0], appSet, nil)
 	if err != nil {
 		return nil, err
 	}
-	g1, err := m.getParams(appSetGenerator.Matrix.Generators[1], appSet)
-	if err != nil {
-		return nil, err
-	}
-
 	for _, a := range g0 {
+		g1, err := m.getParams(appSetGenerator.Matrix.Generators[1], appSet, a)
+		if err != nil {
+			return nil, fmt.Errorf("failed to get params for second generator in the matrix generator: %w", err)
+		}
 		for _, b := range g1 {
-			val, err := utils.CombineStringMaps(a, b)
-			if err != nil {
-				return nil, err
+
+			if appSet.Spec.GoTemplate {
+				tmp := map[string]interface{}{}
+				if err := mergo.Merge(&tmp, a); err != nil {
+					return nil, fmt.Errorf("failed to merge params from the first generator in the matrix generator with temp map: %w", err)
+				}
+				if err := mergo.Merge(&tmp, b); err != nil {
+					return nil, fmt.Errorf("failed to merge params from the first generator in the matrix generator with the second: %w", err)
+				}
+				res = append(res, tmp)
+			} else {
+				val, err := utils.CombineStringMaps(a, b)
+				if err != nil {
+					return nil, fmt.Errorf("failed to combine string maps with merging params for the matrix generator: %w", err)
+				}
+				res = append(res, utils.ConvertToMapStringInterface(val))
 			}
-			res = append(res, val)
 		}
 	}
 
 	return res, nil
 }
 
-func (m *MatrixGenerator) getParams(appSetBaseGenerator argoprojiov1alpha1.ApplicationSetNestedGenerator, appSet *argoprojiov1alpha1.ApplicationSet) ([]map[string]string, error) {
+func (m *MatrixGenerator) getParams(appSetBaseGenerator argoprojiov1alpha1.ApplicationSetNestedGenerator, appSet *argoprojiov1alpha1.ApplicationSet, params map[string]interface{}) ([]map[string]interface{}, error) {
 	var matrix *argoprojiov1alpha1.MatrixGenerator
 	if appSetBaseGenerator.Matrix != nil {
 		// Since nested matrix generator is represented as a JSON object in the CRD, we unmarshall it back to a Go struct here.
@@ -101,10 +114,12 @@ func (m *MatrixGenerator) getParams(appSetBaseGenerator argoprojiov1alpha1.Appli
 			PullRequest:             appSetBaseGenerator.PullRequest,
 			Matrix:                  matrix,
 			Merge:                   mergeGenerator,
+			Selector:                appSetBaseGenerator.Selector,
 		},
 		m.supportedGenerators,
 		argoprojiov1alpha1.ApplicationSetTemplate{},
-		appSet)
+		appSet,
+		params)
 
 	if err != nil {
 		return nil, fmt.Errorf("child generator returned an error on parameter generation: %v", err)

applicationset/generators/matrix_test.go

@@ -1,14 +1,22 @@
 package generators
 
 import (
+	"context"
 	"testing"
 	"time"
 
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	kubefake "k8s.io/client-go/kubernetes/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 func TestMatrixGenerate(t *testing.T) {
@@ -27,7 +35,7 @@ func TestMatrixGenerate(t *testing.T) {
 		name           string
 		baseGenerators []argoprojiov1alpha1.ApplicationSetNestedGenerator
 		expectedErr    error
-		expected       []map[string]string
+		expected       []map[string]interface{}
 	}{
 		{
 			name: "happy flow - generate params",
@@ -39,7 +47,7 @@ func TestMatrixGenerate(t *testing.T) {
 					List: listGenerator,
 				},
 			},
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{"path": "app1", "path.basename": "app1", "path.basenameNormalized": "app1", "cluster": "Cluster", "url": "Url"},
 				{"path": "app2", "path.basename": "app2", "path.basenameNormalized": "app2", "cluster": "Cluster", "url": "Url"},
 			},
@@ -64,7 +72,7 @@ func TestMatrixGenerate(t *testing.T) {
 					},
 				},
 			},
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{"a": "1", "b": "1"},
 				{"a": "1", "b": "2"},
 				{"a": "2", "b": "1"},
@@ -127,8 +135,13 @@ func TestMatrixGenerate(t *testing.T) {
 		testCaseCopy := testCase // Since tests may run in parallel
 
 		t.Run(testCaseCopy.name, func(t *testing.T) {
-			mock := &generatorMock{}
-			appSet := &argoprojiov1alpha1.ApplicationSet{}
+			genMock := &generatorMock{}
+			appSet := &argoprojiov1alpha1.ApplicationSet{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "set",
+				},
+				Spec: argoprojiov1alpha1.ApplicationSetSpec{},
+			}
 
 			for _, g := range testCaseCopy.baseGenerators {
 
@@ -136,7 +149,7 @@ func TestMatrixGenerate(t *testing.T) {
 					Git:  g.Git,
 					List: g.List,
 				}
-				mock.On("GenerateParams", &gitGeneratorSpec, appSet).Return([]map[string]string{
+				genMock.On("GenerateParams", mock.AnythingOfType("*v1alpha1.ApplicationSetGenerator"), appSet).Return([]map[string]interface{}{
 					{
 						"path":                    "app1",
 						"path.basename":           "app1",
@@ -149,13 +162,13 @@ func TestMatrixGenerate(t *testing.T) {
 					},
 				}, nil)
 
-				mock.On("GetTemplate", &gitGeneratorSpec).
+				genMock.On("GetTemplate", &gitGeneratorSpec).
 					Return(&argoprojiov1alpha1.ApplicationSetTemplate{})
 			}
 
 			var matrixGenerator = NewMatrixGenerator(
 				map[string]Generator{
-					"Git":  mock,
+					"Git":  genMock,
 					"List": &ListGenerator{},
 				},
 			)
@@ -168,7 +181,202 @@ func TestMatrixGenerate(t *testing.T) {
 			}, appSet)
 
 			if testCaseCopy.expectedErr != nil {
-				assert.EqualError(t, err, testCaseCopy.expectedErr.Error())
+				assert.ErrorIs(t, err, testCaseCopy.expectedErr)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, testCaseCopy.expected, got)
+			}
+
+		})
+
+	}
+}
+
+func TestMatrixGenerateGoTemplate(t *testing.T) {
+
+	gitGenerator := &argoprojiov1alpha1.GitGenerator{
+		RepoURL:     "RepoURL",
+		Revision:    "Revision",
+		Directories: []argoprojiov1alpha1.GitDirectoryGeneratorItem{{Path: "*"}},
+	}
+
+	listGenerator := &argoprojiov1alpha1.ListGenerator{
+		Elements: []apiextensionsv1.JSON{{Raw: []byte(`{"cluster": "Cluster","url": "Url"}`)}},
+	}
+
+	testCases := []struct {
+		name           string
+		baseGenerators []argoprojiov1alpha1.ApplicationSetNestedGenerator
+		expectedErr    error
+		expected       []map[string]interface{}
+	}{
+		{
+			name: "happy flow - generate params",
+			baseGenerators: []argoprojiov1alpha1.ApplicationSetNestedGenerator{
+				{
+					Git: gitGenerator,
+				},
+				{
+					List: listGenerator,
+				},
+			},
+			expected: []map[string]interface{}{
+				{
+					"path": map[string]string{
+						"path":               "app1",
+						"basename":           "app1",
+						"basenameNormalized": "app1",
+					},
+					"cluster": "Cluster",
+					"url":     "Url",
+				},
+				{
+					"path": map[string]string{
+						"path":               "app2",
+						"basename":           "app2",
+						"basenameNormalized": "app2",
+					},
+					"cluster": "Cluster",
+					"url":     "Url",
+				},
+			},
+		},
+		{
+			name: "happy flow - generate params from two lists",
+			baseGenerators: []argoprojiov1alpha1.ApplicationSetNestedGenerator{
+				{
+					List: &argoprojiov1alpha1.ListGenerator{
+						Elements: []apiextensionsv1.JSON{
+							{Raw: []byte(`{"a": "1"}`)},
+							{Raw: []byte(`{"a": "2"}`)},
+						},
+					},
+				},
+				{
+					List: &argoprojiov1alpha1.ListGenerator{
+						Elements: []apiextensionsv1.JSON{
+							{Raw: []byte(`{"b": "1"}`)},
+							{Raw: []byte(`{"b": "2"}`)},
+						},
+					},
+				},
+			},
+			expected: []map[string]interface{}{
+				{"a": "1", "b": "1"},
+				{"a": "1", "b": "2"},
+				{"a": "2", "b": "1"},
+				{"a": "2", "b": "2"},
+			},
+		},
+		{
+			name: "returns error if there is less than two base generators",
+			baseGenerators: []argoprojiov1alpha1.ApplicationSetNestedGenerator{
+				{
+					Git: gitGenerator,
+				},
+			},
+			expectedErr: ErrLessThanTwoGenerators,
+		},
+		{
+			name: "returns error if there is more than two base generators",
+			baseGenerators: []argoprojiov1alpha1.ApplicationSetNestedGenerator{
+				{
+					List: listGenerator,
+				},
+				{
+					List: listGenerator,
+				},
+				{
+					List: listGenerator,
+				},
+			},
+			expectedErr: ErrMoreThanTwoGenerators,
+		},
+		{
+			name: "returns error if there is more than one inner generator in the first base generator",
+			baseGenerators: []argoprojiov1alpha1.ApplicationSetNestedGenerator{
+				{
+					Git:  gitGenerator,
+					List: listGenerator,
+				},
+				{
+					Git: gitGenerator,
+				},
+			},
+			expectedErr: ErrMoreThenOneInnerGenerators,
+		},
+		{
+			name: "returns error if there is more than one inner generator in the second base generator",
+			baseGenerators: []argoprojiov1alpha1.ApplicationSetNestedGenerator{
+				{
+					List: listGenerator,
+				},
+				{
+					Git:  gitGenerator,
+					List: listGenerator,
+				},
+			},
+			expectedErr: ErrMoreThenOneInnerGenerators,
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCaseCopy := testCase // Since tests may run in parallel
+
+		t.Run(testCaseCopy.name, func(t *testing.T) {
+			genMock := &generatorMock{}
+			appSet := &argoprojiov1alpha1.ApplicationSet{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "set",
+				},
+				Spec: argoprojiov1alpha1.ApplicationSetSpec{
+					GoTemplate: true,
+				},
+			}
+
+			for _, g := range testCaseCopy.baseGenerators {
+
+				gitGeneratorSpec := argoprojiov1alpha1.ApplicationSetGenerator{
+					Git:  g.Git,
+					List: g.List,
+				}
+				genMock.On("GenerateParams", mock.AnythingOfType("*v1alpha1.ApplicationSetGenerator"), appSet).Return([]map[string]interface{}{
+					{
+						"path": map[string]string{
+							"path":               "app1",
+							"basename":           "app1",
+							"basenameNormalized": "app1",
+						},
+					},
+					{
+						"path": map[string]string{
+							"path":               "app2",
+							"basename":           "app2",
+							"basenameNormalized": "app2",
+						},
+					},
+				}, nil)
+
+				genMock.On("GetTemplate", &gitGeneratorSpec).
+					Return(&argoprojiov1alpha1.ApplicationSetTemplate{})
+			}
+
+			var matrixGenerator = NewMatrixGenerator(
+				map[string]Generator{
+					"Git":  genMock,
+					"List": &ListGenerator{},
+				},
+			)
+
+			got, err := matrixGenerator.GenerateParams(&argoprojiov1alpha1.ApplicationSetGenerator{
+				Matrix: &argoprojiov1alpha1.MatrixGenerator{
+					Generators: testCaseCopy.baseGenerators,
+					Template:   argoprojiov1alpha1.ApplicationSetTemplate{},
+				},
+			}, appSet)
+
+			if testCaseCopy.expectedErr != nil {
+				assert.ErrorIs(t, err, testCaseCopy.expectedErr)
 			} else {
 				assert.NoError(t, err)
 				assert.Equal(t, testCaseCopy.expected, got)
@@ -260,6 +468,344 @@ func TestMatrixGetRequeueAfter(t *testing.T) {
 	}
 }
 
+func TestInterpolatedMatrixGenerate(t *testing.T) {
+	interpolatedGitGenerator := &argoprojiov1alpha1.GitGenerator{
+		RepoURL:  "RepoURL",
+		Revision: "Revision",
+		Files: []argoprojiov1alpha1.GitFileGeneratorItem{
+			{Path: "examples/git-generator-files-discovery/cluster-config/dev/config.json"},
+			{Path: "examples/git-generator-files-discovery/cluster-config/prod/config.json"},
+		},
+	}
+
+	interpolatedClusterGenerator := &argoprojiov1alpha1.ClusterGenerator{
+		Selector: metav1.LabelSelector{
+			MatchLabels:      map[string]string{"environment": "{{path.basename}}"},
+			MatchExpressions: nil,
+		},
+	}
+	testCases := []struct {
+		name           string
+		baseGenerators []argoprojiov1alpha1.ApplicationSetNestedGenerator
+		expectedErr    error
+		expected       []map[string]interface{}
+		clientError    bool
+	}{
+		{
+			name: "happy flow - generate interpolated params",
+			baseGenerators: []argoprojiov1alpha1.ApplicationSetNestedGenerator{
+				{
+					Git: interpolatedGitGenerator,
+				},
+				{
+					Clusters: interpolatedClusterGenerator,
+				},
+			},
+			expected: []map[string]interface{}{
+				{"path": "examples/git-generator-files-discovery/cluster-config/dev/config.json", "path.basename": "dev", "path.basenameNormalized": "dev", "name": "dev-01", "nameNormalized": "dev-01", "server": "https://dev-01.example.com", "metadata.labels.environment": "dev", "metadata.labels.argocd.argoproj.io/secret-type": "cluster"},
+				{"path": "examples/git-generator-files-discovery/cluster-config/prod/config.json", "path.basename": "prod", "path.basenameNormalized": "prod", "name": "prod-01", "nameNormalized": "prod-01", "server": "https://prod-01.example.com", "metadata.labels.environment": "prod", "metadata.labels.argocd.argoproj.io/secret-type": "cluster"},
+			},
+			clientError: false,
+		},
+	}
+	clusters := []client.Object{
+		&corev1.Secret{
+			TypeMeta: metav1.TypeMeta{
+				Kind:       "Secret",
+				APIVersion: "v1",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "dev-01",
+				Namespace: "namespace",
+				Labels: map[string]string{
+					"argocd.argoproj.io/secret-type": "cluster",
+					"environment":                    "dev",
+				},
+			},
+			Data: map[string][]byte{
+				"config": []byte("{}"),
+				"name":   []byte("dev-01"),
+				"server": []byte("https://dev-01.example.com"),
+			},
+			Type: corev1.SecretType("Opaque"),
+		},
+		&corev1.Secret{
+			TypeMeta: metav1.TypeMeta{
+				Kind:       "Secret",
+				APIVersion: "v1",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "prod-01",
+				Namespace: "namespace",
+				Labels: map[string]string{
+					"argocd.argoproj.io/secret-type": "cluster",
+					"environment":                    "prod",
+				},
+			},
+			Data: map[string][]byte{
+				"config": []byte("{}"),
+				"name":   []byte("prod-01"),
+				"server": []byte("https://prod-01.example.com"),
+			},
+			Type: corev1.SecretType("Opaque"),
+		},
+	}
+	// convert []client.Object to []runtime.Object, for use by kubefake package
+	runtimeClusters := []runtime.Object{}
+	for _, clientCluster := range clusters {
+		runtimeClusters = append(runtimeClusters, clientCluster)
+	}
+
+	for _, testCase := range testCases {
+		testCaseCopy := testCase // Since tests may run in parallel
+
+		t.Run(testCaseCopy.name, func(t *testing.T) {
+			genMock := &generatorMock{}
+			appSet := &argoprojiov1alpha1.ApplicationSet{}
+
+			appClientset := kubefake.NewSimpleClientset(runtimeClusters...)
+			fakeClient := fake.NewClientBuilder().WithObjects(clusters...).Build()
+			cl := &possiblyErroringFakeCtrlRuntimeClient{
+				fakeClient,
+				testCase.clientError,
+			}
+			var clusterGenerator = NewClusterGenerator(cl, context.Background(), appClientset, "namespace")
+
+			for _, g := range testCaseCopy.baseGenerators {
+
+				gitGeneratorSpec := argoprojiov1alpha1.ApplicationSetGenerator{
+					Git:      g.Git,
+					Clusters: g.Clusters,
+				}
+				genMock.On("GenerateParams", mock.AnythingOfType("*v1alpha1.ApplicationSetGenerator"), appSet).Return([]map[string]interface{}{
+					{
+						"path":                    "examples/git-generator-files-discovery/cluster-config/dev/config.json",
+						"path.basename":           "dev",
+						"path.basenameNormalized": "dev",
+					},
+					{
+						"path":                    "examples/git-generator-files-discovery/cluster-config/prod/config.json",
+						"path.basename":           "prod",
+						"path.basenameNormalized": "prod",
+					},
+				}, nil)
+				genMock.On("GetTemplate", &gitGeneratorSpec).
+					Return(&argoprojiov1alpha1.ApplicationSetTemplate{})
+			}
+			var matrixGenerator = NewMatrixGenerator(
+				map[string]Generator{
+					"Git":      genMock,
+					"Clusters": clusterGenerator,
+				},
+			)
+
+			got, err := matrixGenerator.GenerateParams(&argoprojiov1alpha1.ApplicationSetGenerator{
+				Matrix: &argoprojiov1alpha1.MatrixGenerator{
+					Generators: testCaseCopy.baseGenerators,
+					Template:   argoprojiov1alpha1.ApplicationSetTemplate{},
+				},
+			}, appSet)
+
+			if testCaseCopy.expectedErr != nil {
+				assert.ErrorIs(t, err, testCaseCopy.expectedErr)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, testCaseCopy.expected, got)
+			}
+
+		})
+	}
+}
+
+func TestInterpolatedMatrixGenerateGoTemplate(t *testing.T) {
+	interpolatedGitGenerator := &argoprojiov1alpha1.GitGenerator{
+		RepoURL:  "RepoURL",
+		Revision: "Revision",
+		Files: []argoprojiov1alpha1.GitFileGeneratorItem{
+			{Path: "examples/git-generator-files-discovery/cluster-config/dev/config.json"},
+			{Path: "examples/git-generator-files-discovery/cluster-config/prod/config.json"},
+		},
+	}
+
+	interpolatedClusterGenerator := &argoprojiov1alpha1.ClusterGenerator{
+		Selector: metav1.LabelSelector{
+			MatchLabels:      map[string]string{"environment": "{{.path.basename}}"},
+			MatchExpressions: nil,
+		},
+	}
+	testCases := []struct {
+		name           string
+		baseGenerators []argoprojiov1alpha1.ApplicationSetNestedGenerator
+		expectedErr    error
+		expected       []map[string]interface{}
+		clientError    bool
+	}{
+		{
+			name: "happy flow - generate interpolated params",
+			baseGenerators: []argoprojiov1alpha1.ApplicationSetNestedGenerator{
+				{
+					Git: interpolatedGitGenerator,
+				},
+				{
+					Clusters: interpolatedClusterGenerator,
+				},
+			},
+			expected: []map[string]interface{}{
+				{
+					"path": map[string]string{
+						"path":               "examples/git-generator-files-discovery/cluster-config/dev/config.json",
+						"basename":           "dev",
+						"basenameNormalized": "dev",
+					},
+					"name":           "dev-01",
+					"nameNormalized": "dev-01",
+					"server":         "https://dev-01.example.com",
+					"metadata": map[string]interface{}{
+						"labels": map[string]string{
+							"environment":                    "dev",
+							"argocd.argoproj.io/secret-type": "cluster",
+						},
+					},
+				},
+				{
+					"path": map[string]string{
+						"path":               "examples/git-generator-files-discovery/cluster-config/prod/config.json",
+						"basename":           "prod",
+						"basenameNormalized": "prod",
+					},
+					"name":           "prod-01",
+					"nameNormalized": "prod-01",
+					"server":         "https://prod-01.example.com",
+					"metadata": map[string]interface{}{
+						"labels": map[string]string{
+							"environment":                    "prod",
+							"argocd.argoproj.io/secret-type": "cluster",
+						},
+					},
+				},
+			},
+			clientError: false,
+		},
+	}
+	clusters := []client.Object{
+		&corev1.Secret{
+			TypeMeta: metav1.TypeMeta{
+				Kind:       "Secret",
+				APIVersion: "v1",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "dev-01",
+				Namespace: "namespace",
+				Labels: map[string]string{
+					"argocd.argoproj.io/secret-type": "cluster",
+					"environment":                    "dev",
+				},
+			},
+			Data: map[string][]byte{
+				"config": []byte("{}"),
+				"name":   []byte("dev-01"),
+				"server": []byte("https://dev-01.example.com"),
+			},
+			Type: corev1.SecretType("Opaque"),
+		},
+		&corev1.Secret{
+			TypeMeta: metav1.TypeMeta{
+				Kind:       "Secret",
+				APIVersion: "v1",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "prod-01",
+				Namespace: "namespace",
+				Labels: map[string]string{
+					"argocd.argoproj.io/secret-type": "cluster",
+					"environment":                    "prod",
+				},
+			},
+			Data: map[string][]byte{
+				"config": []byte("{}"),
+				"name":   []byte("prod-01"),
+				"server": []byte("https://prod-01.example.com"),
+			},
+			Type: corev1.SecretType("Opaque"),
+		},
+	}
+	// convert []client.Object to []runtime.Object, for use by kubefake package
+	runtimeClusters := []runtime.Object{}
+	for _, clientCluster := range clusters {
+		runtimeClusters = append(runtimeClusters, clientCluster)
+	}
+
+	for _, testCase := range testCases {
+		testCaseCopy := testCase // Since tests may run in parallel
+
+		t.Run(testCaseCopy.name, func(t *testing.T) {
+			genMock := &generatorMock{}
+			appSet := &argoprojiov1alpha1.ApplicationSet{
+				Spec: argoprojiov1alpha1.ApplicationSetSpec{
+					GoTemplate: true,
+				},
+			}
+
+			appClientset := kubefake.NewSimpleClientset(runtimeClusters...)
+			fakeClient := fake.NewClientBuilder().WithObjects(clusters...).Build()
+			cl := &possiblyErroringFakeCtrlRuntimeClient{
+				fakeClient,
+				testCase.clientError,
+			}
+			var clusterGenerator = NewClusterGenerator(cl, context.Background(), appClientset, "namespace")
+
+			for _, g := range testCaseCopy.baseGenerators {
+
+				gitGeneratorSpec := argoprojiov1alpha1.ApplicationSetGenerator{
+					Git:      g.Git,
+					Clusters: g.Clusters,
+				}
+				genMock.On("GenerateParams", mock.AnythingOfType("*v1alpha1.ApplicationSetGenerator"), appSet).Return([]map[string]interface{}{
+
+					{
+						"path": map[string]string{
+							"path":               "examples/git-generator-files-discovery/cluster-config/dev/config.json",
+							"basename":           "dev",
+							"basenameNormalized": "dev",
+						},
+					},
+					{
+						"path": map[string]string{
+							"path":               "examples/git-generator-files-discovery/cluster-config/prod/config.json",
+							"basename":           "prod",
+							"basenameNormalized": "prod",
+						},
+					},
+				}, nil)
+				genMock.On("GetTemplate", &gitGeneratorSpec).
+					Return(&argoprojiov1alpha1.ApplicationSetTemplate{})
+			}
+			var matrixGenerator = NewMatrixGenerator(
+				map[string]Generator{
+					"Git":      genMock,
+					"Clusters": clusterGenerator,
+				},
+			)
+
+			got, err := matrixGenerator.GenerateParams(&argoprojiov1alpha1.ApplicationSetGenerator{
+				Matrix: &argoprojiov1alpha1.MatrixGenerator{
+					Generators: testCaseCopy.baseGenerators,
+					Template:   argoprojiov1alpha1.ApplicationSetTemplate{},
+				},
+			}, appSet)
+
+			if testCaseCopy.expectedErr != nil {
+				assert.ErrorIs(t, err, testCaseCopy.expectedErr)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, testCaseCopy.expected, got)
+			}
+
+		})
+
+	}
+}
+
 type generatorMock struct {
 	mock.Mock
 }
@@ -270,10 +816,10 @@ func (g *generatorMock) GetTemplate(appSetGenerator *argoprojiov1alpha1.Applicat
 	return args.Get(0).(*argoprojiov1alpha1.ApplicationSetTemplate)
 }
 
-func (g *generatorMock) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, appSet *argoprojiov1alpha1.ApplicationSet) ([]map[string]string, error) {
+func (g *generatorMock) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, appSet *argoprojiov1alpha1.ApplicationSet) ([]map[string]interface{}, error) {
 	args := g.Called(appSetGenerator, appSet)
 
-	return args.Get(0).([]map[string]string), args.Error(1)
+	return args.Get(0).([]map[string]interface{}), args.Error(1)
 }
 
 func (g *generatorMock) GetRequeueAfter(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator) time.Duration {

applicationset/generators/merge.go

@@ -5,8 +5,10 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/imdario/mergo"
+
 	"github.com/argoproj/argo-cd/v2/applicationset/utils"
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 var _ Generator = (*MergeGenerator)(nil)
@@ -32,8 +34,8 @@ func NewMergeGenerator(supportedGenerators map[string]Generator) Generator {
 
 // getParamSetsForAllGenerators generates params for each child generator in a MergeGenerator. Param sets are returned
 // in slices ordered according to the order of the given generators.
-func (m *MergeGenerator) getParamSetsForAllGenerators(generators []argoprojiov1alpha1.ApplicationSetNestedGenerator, appSet *argoprojiov1alpha1.ApplicationSet) ([][]map[string]string, error) {
-	var paramSets [][]map[string]string
+func (m *MergeGenerator) getParamSetsForAllGenerators(generators []argoprojiov1alpha1.ApplicationSetNestedGenerator, appSet *argoprojiov1alpha1.ApplicationSet) ([][]map[string]interface{}, error) {
+	var paramSets [][]map[string]interface{}
 	for _, generator := range generators {
 		generatorParamSets, err := m.getParams(generator, appSet)
 		if err != nil {
@@ -46,7 +48,7 @@ func (m *MergeGenerator) getParamSetsForAllGenerators(generators []argoprojiov1a
 }
 
 // GenerateParams gets the params produced by the MergeGenerator.
-func (m *MergeGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, appSet *argoprojiov1alpha1.ApplicationSet) ([]map[string]string, error) {
+func (m *MergeGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, appSet *argoprojiov1alpha1.ApplicationSet) ([]map[string]interface{}, error) {
 	if appSetGenerator.Merge == nil {
 		return nil, EmptyAppSetGeneratorError
 	}
@@ -73,16 +75,24 @@ func (m *MergeGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.Appl
 
 		for mergeKeyValue, baseParamSet := range baseParamSetsByMergeKey {
 			if overrideParamSet, exists := paramSetsByMergeKey[mergeKeyValue]; exists {
-				overriddenParamSet, err := utils.CombineStringMapsAllowDuplicates(baseParamSet, overrideParamSet)
-				if err != nil {
-					return nil, err
+
+				if appSet.Spec.GoTemplate {
+					if err := mergo.Merge(&baseParamSet, overrideParamSet, mergo.WithOverride); err != nil {
+						return nil, fmt.Errorf("failed to merge base param set with override param set: %w", err)
+					}
+					baseParamSetsByMergeKey[mergeKeyValue] = baseParamSet
+				} else {
+					overriddenParamSet, err := utils.CombineStringMapsAllowDuplicates(baseParamSet, overrideParamSet)
+					if err != nil {
+						return nil, err
+					}
+					baseParamSetsByMergeKey[mergeKeyValue] = utils.ConvertToMapStringInterface(overriddenParamSet)
 				}
-				baseParamSetsByMergeKey[mergeKeyValue] = overriddenParamSet
 			}
 		}
 	}
 
-	mergedParamSets := make([]map[string]string, len(baseParamSetsByMergeKey))
+	mergedParamSets := make([]map[string]interface{}, len(baseParamSetsByMergeKey))
 	var i = 0
 	for _, mergedParamSet := range baseParamSetsByMergeKey {
 		mergedParamSets[i] = mergedParamSet
@@ -95,7 +105,7 @@ func (m *MergeGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.Appl
 // getParamSetsByMergeKey converts the given list of parameter sets to a map of parameter sets where the key is the
 // unique key of the parameter set as determined by the given mergeKeys. If any two parameter sets share the same merge
 // key, getParamSetsByMergeKey will throw NonUniqueParamSets.
-func getParamSetsByMergeKey(mergeKeys []string, paramSets []map[string]string) (map[string]map[string]string, error) {
+func getParamSetsByMergeKey(mergeKeys []string, paramSets []map[string]interface{}) (map[string]map[string]interface{}, error) {
 	if len(mergeKeys) < 1 {
 		return nil, ErrNoMergeKeys
 	}
@@ -105,9 +115,9 @@ func getParamSetsByMergeKey(mergeKeys []string, paramSets []map[string]string) (
 		deDuplicatedMergeKeys[mergeKey] = false
 	}
 
-	paramSetsByMergeKey := make(map[string]map[string]string, len(paramSets))
+	paramSetsByMergeKey := make(map[string]map[string]interface{}, len(paramSets))
 	for _, paramSet := range paramSets {
-		paramSetKey := make(map[string]string)
+		paramSetKey := make(map[string]interface{})
 		for mergeKey := range deDuplicatedMergeKeys {
 			paramSetKey[mergeKey] = paramSet[mergeKey]
 		}
@@ -126,7 +136,7 @@ func getParamSetsByMergeKey(mergeKeys []string, paramSets []map[string]string) (
 }
 
 // getParams get the parameters generated by this generator.
-func (m *MergeGenerator) getParams(appSetBaseGenerator argoprojiov1alpha1.ApplicationSetNestedGenerator, appSet *argoprojiov1alpha1.ApplicationSet) ([]map[string]string, error) {
+func (m *MergeGenerator) getParams(appSetBaseGenerator argoprojiov1alpha1.ApplicationSetNestedGenerator, appSet *argoprojiov1alpha1.ApplicationSet) ([]map[string]interface{}, error) {
 
 	var matrix *argoprojiov1alpha1.MatrixGenerator
 	if appSetBaseGenerator.Matrix != nil {
@@ -160,10 +170,12 @@ func (m *MergeGenerator) getParams(appSetBaseGenerator argoprojiov1alpha1.Applic
 			PullRequest:             appSetBaseGenerator.PullRequest,
 			Matrix:                  matrix,
 			Merge:                   mergeGenerator,
+			Selector:                appSetBaseGenerator.Selector,
 		},
 		m.supportedGenerators,
 		argoprojiov1alpha1.ApplicationSetTemplate{},
-		appSet)
+		appSet,
+		map[string]interface{}{})
 
 	if err != nil {
 		return nil, fmt.Errorf("child generator returned an error on parameter generation: %v", err)

applicationset/generators/merge_test.go

@@ -8,7 +8,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 func getNestedListGenerator(json string) *argoprojiov1alpha1.ApplicationSetNestedGenerator {
@@ -35,7 +35,7 @@ func getTerminalListGeneratorMultiple(jsons []string) argoprojiov1alpha1.Applica
 	return generator
 }
 
-func listOfMapsToSet(maps []map[string]string) (map[string]bool, error) {
+func listOfMapsToSet(maps []map[string]interface{}) (map[string]bool, error) {
 	set := make(map[string]bool, len(maps))
 	for _, paramMap := range maps {
 		paramMapAsJson, err := json.Marshal(paramMap)
@@ -55,7 +55,7 @@ func TestMergeGenerate(t *testing.T) {
 		baseGenerators []argoprojiov1alpha1.ApplicationSetNestedGenerator
 		mergeKeys      []string
 		expectedErr    error
-		expected       []map[string]string
+		expected       []map[string]interface{}
 	}{
 		{
 			name:           "no generators",
@@ -79,7 +79,7 @@ func TestMergeGenerate(t *testing.T) {
 				*getNestedListGenerator(`{"a": "3_1","b": "different","c": "3_3"}`), // gets ignored because its merge key value isn't in the base params set
 			},
 			mergeKeys: []string{"b"},
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{"a": "2_1", "b": "same", "c": "1_3"},
 			},
 		},
@@ -90,7 +90,7 @@ func TestMergeGenerate(t *testing.T) {
 				*getNestedListGenerator(`{"a": "a"}`),
 			},
 			mergeKeys: []string{"b"},
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{"a": "a"},
 			},
 		},
@@ -101,7 +101,7 @@ func TestMergeGenerate(t *testing.T) {
 				*getNestedListGenerator(`{"b": "b"}`),
 			},
 			mergeKeys: []string{"b"},
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{"a": "a"},
 			},
 		},
@@ -119,7 +119,7 @@ func TestMergeGenerate(t *testing.T) {
 				*getNestedListGenerator(`{"a": "1", "b": "1", "c": "added"}`),
 			},
 			mergeKeys: []string{"a", "b"},
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{"a": "1", "b": "1", "c": "added"},
 				{"a": "1", "b": "2"},
 				{"a": "2", "b": "1"},
@@ -141,7 +141,7 @@ func TestMergeGenerate(t *testing.T) {
 				*getNestedListGenerator(`{"a": "1", "b": "3", "d": "added"}`),
 			},
 			mergeKeys: []string{"a", "b"},
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{"a": "1", "b": "3", "c": "added", "d": "added"},
 				{"a": "2", "b": "2"},
 			},
@@ -213,9 +213,9 @@ func TestParamSetsAreUniqueByMergeKeys(t *testing.T) {
 	testCases := []struct {
 		name        string
 		mergeKeys   []string
-		paramSets   []map[string]string
+		paramSets   []map[string]interface{}
 		expectedErr error
-		expected    map[string]map[string]string
+		expected    map[string]map[string]interface{}
 	}{
 		{
 			name:        "no merge keys",
@@ -225,28 +225,37 @@ func TestParamSetsAreUniqueByMergeKeys(t *testing.T) {
 		{
 			name:      "no paramSets",
 			mergeKeys: []string{"key"},
-			expected:  make(map[string]map[string]string),
+			expected:  make(map[string]map[string]interface{}),
 		},
 		{
 			name:      "simple key, unique paramSets",
 			mergeKeys: []string{"key"},
-			paramSets: []map[string]string{{"key": "a"}, {"key": "b"}},
-			expected: map[string]map[string]string{
+			paramSets: []map[string]interface{}{{"key": "a"}, {"key": "b"}},
+			expected: map[string]map[string]interface{}{
 				`{"key":"a"}`: {"key": "a"},
 				`{"key":"b"}`: {"key": "b"},
 			},
 		},
+		{
+			name:      "simple key object, unique paramSets",
+			mergeKeys: []string{"key"},
+			paramSets: []map[string]interface{}{{"key": map[string]interface{}{"hello": "world"}}, {"key": "b"}},
+			expected: map[string]map[string]interface{}{
+				`{"key":{"hello":"world"}}`: {"key": map[string]interface{}{"hello": "world"}},
+				`{"key":"b"}`:               {"key": "b"},
+			},
+		},
 		{
 			name:        "simple key, non-unique paramSets",
 			mergeKeys:   []string{"key"},
-			paramSets:   []map[string]string{{"key": "a"}, {"key": "b"}, {"key": "b"}},
+			paramSets:   []map[string]interface{}{{"key": "a"}, {"key": "b"}, {"key": "b"}},
 			expectedErr: fmt.Errorf("%w. Duplicate key was %s", ErrNonUniqueParamSets, `{"key":"b"}`),
 		},
 		{
 			name:      "simple key, duplicated key name, unique paramSets",
 			mergeKeys: []string{"key", "key"},
-			paramSets: []map[string]string{{"key": "a"}, {"key": "b"}},
-			expected: map[string]map[string]string{
+			paramSets: []map[string]interface{}{{"key": "a"}, {"key": "b"}},
+			expected: map[string]map[string]interface{}{
 				`{"key":"a"}`: {"key": "a"},
 				`{"key":"b"}`: {"key": "b"},
 			},
@@ -254,32 +263,46 @@ func TestParamSetsAreUniqueByMergeKeys(t *testing.T) {
 		{
 			name:        "simple key, duplicated key name, non-unique paramSets",
 			mergeKeys:   []string{"key", "key"},
-			paramSets:   []map[string]string{{"key": "a"}, {"key": "b"}, {"key": "b"}},
+			paramSets:   []map[string]interface{}{{"key": "a"}, {"key": "b"}, {"key": "b"}},
 			expectedErr: fmt.Errorf("%w. Duplicate key was %s", ErrNonUniqueParamSets, `{"key":"b"}`),
 		},
 		{
 			name:      "compound key, unique paramSets",
 			mergeKeys: []string{"key1", "key2"},
-			paramSets: []map[string]string{
+			paramSets: []map[string]interface{}{
 				{"key1": "a", "key2": "a"},
 				{"key1": "a", "key2": "b"},
 				{"key1": "b", "key2": "a"},
 			},
-			expected: map[string]map[string]string{
+			expected: map[string]map[string]interface{}{
 				`{"key1":"a","key2":"a"}`: {"key1": "a", "key2": "a"},
 				`{"key1":"a","key2":"b"}`: {"key1": "a", "key2": "b"},
 				`{"key1":"b","key2":"a"}`: {"key1": "b", "key2": "a"},
 			},
 		},
+		{
+			name:      "compound key object, unique paramSets",
+			mergeKeys: []string{"key1", "key2"},
+			paramSets: []map[string]interface{}{
+				{"key1": "a", "key2": map[string]interface{}{"hello": "world"}},
+				{"key1": "a", "key2": "b"},
+				{"key1": "b", "key2": "a"},
+			},
+			expected: map[string]map[string]interface{}{
+				`{"key1":"a","key2":{"hello":"world"}}`: {"key1": "a", "key2": map[string]interface{}{"hello": "world"}},
+				`{"key1":"a","key2":"b"}`:               {"key1": "a", "key2": "b"},
+				`{"key1":"b","key2":"a"}`:               {"key1": "b", "key2": "a"},
+			},
+		},
 		{
 			name:      "compound key, duplicate key names, unique paramSets",
 			mergeKeys: []string{"key1", "key1", "key2"},
-			paramSets: []map[string]string{
+			paramSets: []map[string]interface{}{
 				{"key1": "a", "key2": "a"},
 				{"key1": "a", "key2": "b"},
 				{"key1": "b", "key2": "a"},
 			},
-			expected: map[string]map[string]string{
+			expected: map[string]map[string]interface{}{
 				`{"key1":"a","key2":"a"}`: {"key1": "a", "key2": "a"},
 				`{"key1":"a","key2":"b"}`: {"key1": "a", "key2": "b"},
 				`{"key1":"b","key2":"a"}`: {"key1": "b", "key2": "a"},
@@ -288,7 +311,7 @@ func TestParamSetsAreUniqueByMergeKeys(t *testing.T) {
 		{
 			name:      "compound key, non-unique paramSets",
 			mergeKeys: []string{"key1", "key2"},
-			paramSets: []map[string]string{
+			paramSets: []map[string]interface{}{
 				{"key1": "a", "key2": "a"},
 				{"key1": "a", "key2": "a"},
 				{"key1": "b", "key2": "a"},
@@ -298,7 +321,7 @@ func TestParamSetsAreUniqueByMergeKeys(t *testing.T) {
 		{
 			name:      "compound key, duplicate key names, non-unique paramSets",
 			mergeKeys: []string{"key1", "key1", "key2"},
-			paramSets: []map[string]string{
+			paramSets: []map[string]interface{}{
 				{"key1": "a", "key2": "a"},
 				{"key1": "a", "key2": "a"},
 				{"key1": "b", "key2": "a"},

applicationset/generators/pull_request.go

@@ -9,9 +9,11 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
+	"github.com/gosimple/slug"
+
 	"github.com/argoproj/argo-cd/v2/applicationset/services/pull_request"
 	pullrequest "github.com/argoproj/argo-cd/v2/applicationset/services/pull_request"
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 var _ Generator = (*PullRequestGenerator)(nil)
@@ -23,11 +25,13 @@ const (
 type PullRequestGenerator struct {
 	client                    client.Client
 	selectServiceProviderFunc func(context.Context, *argoprojiov1alpha1.PullRequestGenerator, *argoprojiov1alpha1.ApplicationSet) (pullrequest.PullRequestService, error)
+	auth                      SCMAuthProviders
 }
 
-func NewPullRequestGenerator(client client.Client) Generator {
+func NewPullRequestGenerator(client client.Client, auth SCMAuthProviders) Generator {
 	g := &PullRequestGenerator{
 		client: client,
+		auth:   auth,
 	}
 	g.selectServiceProviderFunc = g.selectServiceProvider
 	return g
@@ -47,7 +51,7 @@ func (g *PullRequestGenerator) GetTemplate(appSetGenerator *argoprojiov1alpha1.A
 	return &appSetGenerator.PullRequest.Template
 }
 
-func (g *PullRequestGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, applicationSetInfo *argoprojiov1alpha1.ApplicationSet) ([]map[string]string, error) {
+func (g *PullRequestGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, applicationSetInfo *argoprojiov1alpha1.ApplicationSet) ([]map[string]interface{}, error) {
 	if appSetGenerator == nil {
 		return nil, EmptyAppSetGeneratorError
 	}
@@ -66,12 +70,32 @@ func (g *PullRequestGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha
 	if err != nil {
 		return nil, fmt.Errorf("error listing repos: %v", err)
 	}
-	params := make([]map[string]string, 0, len(pulls))
+	params := make([]map[string]interface{}, 0, len(pulls))
+
+	// In order to follow the DNS label standard as defined in RFC 1123,
+	// we need to limit the 'branch' to 50 to give room to append/suffix-ing it
+	// with 13 more characters. Also, there is the need to clean it as recommended
+	// here https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#dns-label-names
+	slug.MaxLength = 50
+
+	// Converting underscores to dashes
+	slug.CustomSub = map[string]string{
+		"_": "-",
+	}
+
+	var shortSHALength int
 	for _, pull := range pulls {
-		params = append(params, map[string]string{
-			"number":   strconv.Itoa(pull.Number),
-			"branch":   pull.Branch,
-			"head_sha": pull.HeadSHA,
+		shortSHALength = 8
+		if len(pull.HeadSHA) < 8 {
+			shortSHALength = len(pull.HeadSHA)
+		}
+
+		params = append(params, map[string]interface{}{
+			"number":         strconv.Itoa(pull.Number),
+			"branch":         pull.Branch,
+			"branch_slug":    slug.Make(pull.Branch),
+			"head_sha":       pull.HeadSHA,
+			"head_short_sha": pull.HeadSHA[:shortSHALength],
 		})
 	}
 	return params, nil
@@ -80,12 +104,15 @@ func (g *PullRequestGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha
 // selectServiceProvider selects the provider to get pull requests from the configuration
 func (g *PullRequestGenerator) selectServiceProvider(ctx context.Context, generatorConfig *argoprojiov1alpha1.PullRequestGenerator, applicationSetInfo *argoprojiov1alpha1.ApplicationSet) (pullrequest.PullRequestService, error) {
 	if generatorConfig.Github != nil {
-		providerConfig := generatorConfig.Github
+		return g.github(ctx, generatorConfig.Github, applicationSetInfo)
+	}
+	if generatorConfig.GitLab != nil {
+		providerConfig := generatorConfig.GitLab
 		token, err := g.getSecretRef(ctx, providerConfig.TokenRef, applicationSetInfo.Namespace)
 		if err != nil {
 			return nil, fmt.Errorf("error fetching Secret token: %v", err)
 		}
-		return pullrequest.NewGithubService(ctx, token, providerConfig.API, providerConfig.Owner, providerConfig.Repo, providerConfig.Labels)
+		return pullrequest.NewGitLabService(ctx, token, providerConfig.API, providerConfig.Project, providerConfig.Labels, providerConfig.PullRequestState)
 	}
 	if generatorConfig.Gitea != nil {
 		providerConfig := generatorConfig.Gitea
@@ -110,6 +137,24 @@ func (g *PullRequestGenerator) selectServiceProvider(ctx context.Context, genera
 	return nil, fmt.Errorf("no Pull Request provider implementation configured")
 }
 
+func (g *PullRequestGenerator) github(ctx context.Context, cfg *argoprojiov1alpha1.PullRequestGeneratorGithub, applicationSetInfo *argoprojiov1alpha1.ApplicationSet) (pullrequest.PullRequestService, error) {
+	// use an app if it was configured
+	if cfg.AppSecretName != "" {
+		auth, err := g.auth.GitHubApps.GetAuthSecret(ctx, cfg.AppSecretName)
+		if err != nil {
+			return nil, fmt.Errorf("error getting GitHub App secret: %v", err)
+		}
+		return pullrequest.NewGithubAppService(*auth, cfg.API, cfg.Owner, cfg.Repo, cfg.Labels)
+	}
+
+	// always default to token, even if not set (public access)
+	token, err := g.getSecretRef(ctx, cfg.TokenRef, applicationSetInfo.Namespace)
+	if err != nil {
+		return nil, fmt.Errorf("error fetching Secret token: %v", err)
+	}
+	return pullrequest.NewGithubService(ctx, token, cfg.API, cfg.Owner, cfg.Repo, cfg.Labels)
+}
+
 // getSecretRef gets the value of the key for the specified Secret resource.
 func (g *PullRequestGenerator) getSecretRef(ctx context.Context, ref *argoprojiov1alpha1.SecretRef, namespace string) (string, error) {
 	if ref == nil {

applicationset/generators/pull_request_test.go

@@ -11,14 +11,14 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
 	pullrequest "github.com/argoproj/argo-cd/v2/applicationset/services/pull_request"
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 func TestPullRequestGithubGenerateParams(t *testing.T) {
 	ctx := context.Background()
 	cases := []struct {
 		selectFunc  func(context.Context, *argoprojiov1alpha1.PullRequestGenerator, *argoprojiov1alpha1.ApplicationSet) (pullrequest.PullRequestService, error)
-		expected    []map[string]string
+		expected    []map[string]interface{}
 		expectedErr error
 	}{
 		{
@@ -35,11 +35,63 @@ func TestPullRequestGithubGenerateParams(t *testing.T) {
 					nil,
 				)
 			},
-			expected: []map[string]string{
+			expected: []map[string]interface{}{
 				{
-					"number":   "1",
-					"branch":   "branch1",
-					"head_sha": "089d92cbf9ff857a39e6feccd32798ca700fb958",
+					"number":         "1",
+					"branch":         "branch1",
+					"branch_slug":    "branch1",
+					"head_sha":       "089d92cbf9ff857a39e6feccd32798ca700fb958",
+					"head_short_sha": "089d92cb",
+				},
+			},
+			expectedErr: nil,
+		},
+		{
+			selectFunc: func(context.Context, *argoprojiov1alpha1.PullRequestGenerator, *argoprojiov1alpha1.ApplicationSet) (pullrequest.PullRequestService, error) {
+				return pullrequest.NewFakeService(
+					ctx,
+					[]*pullrequest.PullRequest{
+						&pullrequest.PullRequest{
+							Number:  2,
+							Branch:  "feat/areally+long_pull_request_name_to_test_argo_slugification_and_branch_name_shortening_feature",
+							HeadSHA: "9b34ff5bd418e57d58891eb0aa0728043ca1e8be",
+						},
+					},
+					nil,
+				)
+			},
+			expected: []map[string]interface{}{
+				{
+					"number":         "2",
+					"branch":         "feat/areally+long_pull_request_name_to_test_argo_slugification_and_branch_name_shortening_feature",
+					"branch_slug":    "feat-areally-long-pull-request-name-to-test-argo",
+					"head_sha":       "9b34ff5bd418e57d58891eb0aa0728043ca1e8be",
+					"head_short_sha": "9b34ff5b",
+				},
+			},
+			expectedErr: nil,
+		},
+		{
+			selectFunc: func(context.Context, *argoprojiov1alpha1.PullRequestGenerator, *argoprojiov1alpha1.ApplicationSet) (pullrequest.PullRequestService, error) {
+				return pullrequest.NewFakeService(
+					ctx,
+					[]*pullrequest.PullRequest{
+						&pullrequest.PullRequest{
+							Number:  1,
+							Branch:  "a-very-short-sha",
+							HeadSHA: "abcd",
+						},
+					},
+					nil,
+				)
+			},
+			expected: []map[string]interface{}{
+				{
+					"number":         "1",
+					"branch":         "a-very-short-sha",
+					"branch_slug":    "a-very-short-sha",
+					"head_sha":       "abcd",
+					"head_short_sha": "abcd",
 				},
 			},
 			expectedErr: nil,
@@ -64,6 +116,7 @@ func TestPullRequestGithubGenerateParams(t *testing.T) {
 		generatorConfig := argoprojiov1alpha1.ApplicationSetGenerator{
 			PullRequest: &argoprojiov1alpha1.PullRequestGenerator{},
 		}
+
 		got, gotErr := gen.GenerateParams(&generatorConfig, nil)
 		assert.Equal(t, c.expectedErr, gotErr)
 		assert.ElementsMatch(t, c.expected, got)

applicationset/generators/scm_provider.go

@@ -9,8 +9,10 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
+	"github.com/argoproj/argo-cd/v2/applicationset/services/github_app_auth"
 	"github.com/argoproj/argo-cd/v2/applicationset/services/scm_provider"
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	"github.com/argoproj/argo-cd/v2/applicationset/utils"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 var _ Generator = (*SCMProviderGenerator)(nil)
@@ -23,10 +25,23 @@ type SCMProviderGenerator struct {
 	client client.Client
 	// Testing hooks.
 	overrideProvider scm_provider.SCMProviderService
+	SCMAuthProviders
 }
 
-func NewSCMProviderGenerator(client client.Client) Generator {
-	return &SCMProviderGenerator{client: client}
+type SCMAuthProviders struct {
+	GitHubApps github_app_auth.Credentials
+}
+
+func NewSCMProviderGenerator(client client.Client, providers SCMAuthProviders) Generator {
+	return &SCMProviderGenerator{
+		client:           client,
+		SCMAuthProviders: providers,
+	}
+}
+
+// Testing generator
+func NewTestSCMProviderGenerator(overrideProvider scm_provider.SCMProviderService) Generator {
+	return &SCMProviderGenerator{overrideProvider: overrideProvider}
 }
 
 func (g *SCMProviderGenerator) GetRequeueAfter(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator) time.Duration {
@@ -43,7 +58,7 @@ func (g *SCMProviderGenerator) GetTemplate(appSetGenerator *argoprojiov1alpha1.A
 	return &appSetGenerator.SCMProvider.Template
 }
 
-func (g *SCMProviderGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, applicationSetInfo *argoprojiov1alpha1.ApplicationSet) ([]map[string]string, error) {
+func (g *SCMProviderGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, applicationSetInfo *argoprojiov1alpha1.ApplicationSet) ([]map[string]interface{}, error) {
 	if appSetGenerator == nil {
 		return nil, EmptyAppSetGeneratorError
 	}
@@ -60,13 +75,10 @@ func (g *SCMProviderGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha
 	if g.overrideProvider != nil {
 		provider = g.overrideProvider
 	} else if providerConfig.Github != nil {
-		token, err := g.getSecretRef(ctx, providerConfig.Github.TokenRef, applicationSetInfo.Namespace)
+		var err error
+		provider, err = g.githubProvider(ctx, providerConfig.Github, applicationSetInfo)
 		if err != nil {
-			return nil, fmt.Errorf("error fetching Github token: %v", err)
-		}
-		provider, err = scm_provider.NewGithubProvider(ctx, providerConfig.Github.Organization, token, providerConfig.Github.API, providerConfig.Github.AllBranches)
-		if err != nil {
-			return nil, fmt.Errorf("error initializing Github service: %v", err)
+			return nil, fmt.Errorf("scm provider: %w", err)
 		}
 	} else if providerConfig.Gitlab != nil {
 		token, err := g.getSecretRef(ctx, providerConfig.Gitlab.TokenRef, applicationSetInfo.Namespace)
@@ -101,6 +113,15 @@ func (g *SCMProviderGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha
 		if scmError != nil {
 			return nil, fmt.Errorf("error initializing Bitbucket Server service: %v", scmError)
 		}
+	} else if providerConfig.AzureDevOps != nil {
+		token, err := g.getSecretRef(ctx, providerConfig.AzureDevOps.AccessTokenRef, applicationSetInfo.Namespace)
+		if err != nil {
+			return nil, fmt.Errorf("error fetching Azure Devops access token: %v", err)
+		}
+		provider, err = scm_provider.NewAzureDevOpsProvider(ctx, token, providerConfig.AzureDevOps.Organization, providerConfig.AzureDevOps.API, providerConfig.AzureDevOps.TeamProject, providerConfig.AzureDevOps.AllBranches)
+		if err != nil {
+			return nil, fmt.Errorf("error initializing Azure Devops service: %v", err)
+		}
 	} else {
 		return nil, fmt.Errorf("no SCM provider implementation configured")
 	}
@@ -110,15 +131,23 @@ func (g *SCMProviderGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha
 	if err != nil {
 		return nil, fmt.Errorf("error listing repos: %v", err)
 	}
-	params := make([]map[string]string, 0, len(repos))
+	params := make([]map[string]interface{}, 0, len(repos))
+	var shortSHALength int
 	for _, repo := range repos {
-		params = append(params, map[string]string{
-			"organization": repo.Organization,
-			"repository":   repo.Repository,
-			"url":          repo.URL,
-			"branch":       repo.Branch,
-			"sha":          repo.SHA,
-			"labels":       strings.Join(repo.Labels, ","),
+		shortSHALength = 8
+		if len(repo.SHA) < 8 {
+			shortSHALength = len(repo.SHA)
+		}
+
+		params = append(params, map[string]interface{}{
+			"organization":     repo.Organization,
+			"repository":       repo.Repository,
+			"url":              repo.URL,
+			"branch":           repo.Branch,
+			"sha":              repo.SHA,
+			"short_sha":        repo.SHA[:shortSHALength],
+			"labels":           strings.Join(repo.Labels, ","),
+			"branchNormalized": utils.SanitizeName(repo.Branch),
 		})
 	}
 	return params, nil
@@ -146,3 +175,25 @@ func (g *SCMProviderGenerator) getSecretRef(ctx context.Context, ref *argoprojio
 	}
 	return string(tokenBytes), nil
 }
+
+func (g *SCMProviderGenerator) githubProvider(ctx context.Context, github *argoprojiov1alpha1.SCMProviderGeneratorGithub, applicationSetInfo *argoprojiov1alpha1.ApplicationSet) (scm_provider.SCMProviderService, error) {
+	if github.AppSecretName != "" {
+		auth, err := g.GitHubApps.GetAuthSecret(ctx, github.AppSecretName)
+		if err != nil {
+			return nil, fmt.Errorf("error fetching Github app secret: %v", err)
+		}
+
+		return scm_provider.NewGithubAppProviderFor(
+			*auth,
+			github.Organization,
+			github.API,
+			github.AllBranches,
+		)
+	}
+
+	token, err := g.getSecretRef(ctx, github.TokenRef, applicationSetInfo.Namespace)
+	if err != nil {
+		return nil, fmt.Errorf("error fetching Github token: %v", err)
+	}
+	return scm_provider.NewGithubProvider(ctx, github.Organization, token, github.API, github.AllBranches)
+}

applicationset/generators/scm_provider_test.go

@@ -10,7 +10,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
 	"github.com/argoproj/argo-cd/v2/applicationset/services/scm_provider"
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 func TestSCMProviderGetSecretRef(t *testing.T) {
@@ -87,7 +87,7 @@ func TestSCMProviderGenerateParams(t *testing.T) {
 				Repository:   "repo1",
 				URL:          "git@github.com:myorg/repo1.git",
 				Branch:       "main",
-				SHA:          "abcd1234",
+				SHA:          "0bc57212c3cbbec69d20b34c507284bd300def5b",
 				Labels:       []string{"prod", "staging"},
 			},
 			{
@@ -95,7 +95,7 @@ func TestSCMProviderGenerateParams(t *testing.T) {
 				Repository:   "repo2",
 				URL:          "git@github.com:myorg/repo2.git",
 				Branch:       "main",
-				SHA:          "00000000",
+				SHA:          "59d0",
 			},
 		},
 	}
@@ -109,7 +109,9 @@ func TestSCMProviderGenerateParams(t *testing.T) {
 	assert.Equal(t, "repo1", params[0]["repository"])
 	assert.Equal(t, "git@github.com:myorg/repo1.git", params[0]["url"])
 	assert.Equal(t, "main", params[0]["branch"])
-	assert.Equal(t, "abcd1234", params[0]["sha"])
+	assert.Equal(t, "0bc57212c3cbbec69d20b34c507284bd300def5b", params[0]["sha"])
+	assert.Equal(t, "0bc57212", params[0]["short_sha"])
+	assert.Equal(t, "59d0", params[1]["short_sha"])
 	assert.Equal(t, "prod,staging", params[0]["labels"])
 	assert.Equal(t, "repo2", params[1]["repository"])
 }

applicationset/services/github_app_auth/auth.go

@@ -0,0 +1,19 @@
+package github_app_auth
+
+import "context"
+
+// Authentication has the authentication information required to access the GitHub API and repositories.
+type Authentication struct {
+	// Id specifies the ID of the GitHub app used to access the repo
+	Id int64
+	// InstallationId specifies the installation ID of the GitHub App used to access the repo
+	InstallationId int64
+	// EnterpriseBaseURL specifies the base URL of GitHub Enterprise installation. If empty will default to https://api.github.com
+	EnterpriseBaseURL string
+	// PrivateKey in PEM format.
+	PrivateKey string
+}
+
+type Credentials interface {
+	GetAuthSecret(ctx context.Context, secretName string) (*Authentication, error)
+}

applicationset/services/internal/github_app/client.go

@@ -0,0 +1,33 @@
+package github_app
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/bradleyfalzon/ghinstallation/v2"
+	"github.com/google/go-github/v35/github"
+
+	"github.com/argoproj/argo-cd/v2/applicationset/services/github_app_auth"
+)
+
+// Client builds a github client for the given app authentication.
+func Client(g github_app_auth.Authentication, url string) (*github.Client, error) {
+	rt, err := ghinstallation.New(http.DefaultTransport, g.Id, g.InstallationId, []byte(g.PrivateKey))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create github app install: %w", err)
+	}
+	if url == "" {
+		url = g.EnterpriseBaseURL
+	}
+	var client *github.Client
+	httpClient := http.Client{Transport: rt}
+	if url == "" {
+		client = github.NewClient(&httpClient)
+	} else {
+		client, err = github.NewEnterpriseClient(url, url, &httpClient)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create github enterprise client: %w", err)
+		}
+	}
+	return client, nil
+}

applicationset/services/pull_request/bitbucket_server_test.go

@@ -7,7 +7,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	"github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 	"github.com/stretchr/testify/assert"
 )
 

applicationset/services/pull_request/fixtures/gitlab_mr_list_response.json

@@ -0,0 +1,89 @@
+[
+  {
+    "id": 35385049,
+    "iid": 15442,
+    "project_id": 278964,
+    "title": "Draft: Use structured logging for DB load balancer",
+    "description": "",
+    "state": "opened",
+    "created_at": "2019-08-20T10:58:54.413Z",
+    "updated_at": "2019-08-20T12:01:49.849Z",
+    "merged_by": null,
+    "merged_at": null,
+    "closed_by": null,
+    "closed_at": null,
+    "target_branch": "master",
+    "source_branch": "use-structured-logging-for-db-load-balancer",
+    "user_notes_count": 1,
+    "upvotes": 0,
+    "downvotes": 0,
+    "assignee": {
+      "id": 4088036,
+      "name": "Hordur Freyr Yngvason",
+      "username": "hfyngvason",
+      "state": "active",
+      "avatar_url": "https://assets.gitlab-static.net/uploads/-/system/user/avatar/4088036/avatar.png",
+      "web_url": "https://gitlab.com/hfyngvason"
+    },
+    "author": {
+      "id": 4088036,
+      "name": "Hordur Freyr Yngvason",
+      "username": "hfyngvason",
+      "state": "active",
+      "avatar_url": "https://assets.gitlab-static.net/uploads/-/system/user/avatar/4088036/avatar.png",
+      "web_url": "https://gitlab.com/hfyngvason"
+    },
+    "assignees": [
+      {
+        "id": 4088036,
+        "name": "Hordur Freyr Yngvason",
+        "username": "hfyngvason",
+        "state": "active",
+        "avatar_url": "https://assets.gitlab-static.net/uploads/-/system/user/avatar/4088036/avatar.png",
+        "web_url": "https://gitlab.com/hfyngvason"
+      }
+    ],
+    "reviewers": [
+      {
+        "id": 2535118,
+        "name": "Thong Kuah",
+        "username": "tkuah",
+        "state": "active",
+        "avatar_url": "https://secure.gravatar.com/avatar/f7b51bdd49a4914d29504d7ff4c3f7b9?s=80&d=identicon",
+        "web_url": "https://gitlab.com/tkuah"
+      }
+    ],
+    "source_project_id": 278964,
+    "target_project_id": 278964,
+    "labels": [
+      "backend",
+      "backstage",
+      "database",
+      "database::review pending",
+      "group::autodevops and kubernetes"
+    ],
+    "work_in_progress": true,
+    "milestone": null,
+    "merge_when_pipeline_succeeds": false,
+    "merge_status": "can_be_merged",
+    "sha": "2fc4e8b972ff3208ec63b6143e34ad67ff343ad7",
+    "merge_commit_sha": null,
+    "discussion_locked": null,
+    "should_remove_source_branch": null,
+    "force_remove_source_branch": true,
+    "reference": "!15442",
+    "web_url": "https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/15442",
+    "time_stats": {
+      "time_estimate": 0,
+      "total_time_spent": 0,
+      "human_time_estimate": null,
+      "human_total_time_spent": null
+    },
+    "squash": true,
+    "task_completion_status": {
+      "count": 12,
+      "completed_count": 0
+    },
+    "approvals_before_merge": 1
+  }
+]

applicationset/services/pull_request/gitea_test.go

@@ -2,13 +2,253 @@ package pull_request
 
 import (
 	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 )
 
+func giteaMockHandler(t *testing.T) func(http.ResponseWriter, *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Println(r.RequestURI)
+		switch r.RequestURI {
+		case "/api/v1/version":
+			_, err := io.WriteString(w, `{"version":"1.17.0+dev-452-g1f0541780"}`)
+			if err != nil {
+				t.Fail()
+			}
+		case "/api/v1/repos/test-argocd/pr-test/pulls?limit=0&page=1&state=open":
+			_, err := io.WriteString(w, `[{
+				"id": 50721,
+				"url": "https://gitea.com/test-argocd/pr-test/pulls/1",
+				"number": 1,
+				"user": {
+					"id": 4476,
+					"login": "graytshirt",
+					"full_name": "Dan",
+					"email": "graytshirt@noreply.gitea.io",
+					"avatar_url": "https://secure.gravatar.com/avatar/2446c67bcd59d71f6ae3cf376ec2ae37?d=identicon",
+					"language": "",
+					"is_admin": false,
+					"last_login": "0001-01-01T00:00:00Z",
+					"created": "2020-04-07T01:14:36+08:00",
+					"restricted": false,
+					"active": false,
+					"prohibit_login": false,
+					"location": "",
+					"website": "",
+					"description": "",
+					"visibility": "public",
+					"followers_count": 0,
+					"following_count": 4,
+					"starred_repos_count": 1,
+					"username": "graytshirt"
+				},
+				"title": "add an empty file",
+				"body": "",
+				"labels": [],
+				"milestone": null,
+				"assignee": null,
+				"assignees": null,
+				"state": "open",
+				"is_locked": false,
+				"comments": 0,
+				"html_url": "https://gitea.com/test-argocd/pr-test/pulls/1",
+				"diff_url": "https://gitea.com/test-argocd/pr-test/pulls/1.diff",
+				"patch_url": "https://gitea.com/test-argocd/pr-test/pulls/1.patch",
+				"mergeable": true,
+				"merged": false,
+				"merged_at": null,
+				"merge_commit_sha": null,
+				"merged_by": null,
+				"base": {
+					"label": "main",
+					"ref": "main",
+					"sha": "72687815ccba81ef014a96201cc2e846a68789d8",
+					"repo_id": 21618,
+					"repo": {
+						"id": 21618,
+						"owner": {
+							"id": 31480,
+							"login": "test-argocd",
+							"full_name": "",
+							"email": "",
+							"avatar_url": "https://gitea.com/avatars/22d1b1d3f61abf95951c4a958731d848",
+							"language": "",
+							"is_admin": false,
+							"last_login": "0001-01-01T00:00:00Z",
+							"created": "2022-04-06T02:28:06+08:00",
+							"restricted": false,
+							"active": false,
+							"prohibit_login": false,
+							"location": "",
+							"website": "",
+							"description": "",
+							"visibility": "public",
+							"followers_count": 0,
+							"following_count": 0,
+							"starred_repos_count": 0,
+							"username": "test-argocd"
+						},
+						"name": "pr-test",
+						"full_name": "test-argocd/pr-test",
+						"description": "",
+						"empty": false,
+						"private": false,
+						"fork": false,
+						"template": false,
+						"parent": null,
+						"mirror": false,
+						"size": 28,
+						"language": "",
+						"languages_url": "https://gitea.com/api/v1/repos/test-argocd/pr-test/languages",
+						"html_url": "https://gitea.com/test-argocd/pr-test",
+						"ssh_url": "git@gitea.com:test-argocd/pr-test.git",
+						"clone_url": "https://gitea.com/test-argocd/pr-test.git",
+						"original_url": "",
+						"website": "",
+						"stars_count": 0,
+						"forks_count": 0,
+						"watchers_count": 1,
+						"open_issues_count": 0,
+						"open_pr_counter": 1,
+						"release_counter": 0,
+						"default_branch": "main",
+						"archived": false,
+						"created_at": "2022-04-06T02:32:09+08:00",
+						"updated_at": "2022-04-06T02:33:12+08:00",
+						"permissions": {
+							"admin": false,
+							"push": false,
+							"pull": true
+						},
+						"has_issues": true,
+						"internal_tracker": {
+							"enable_time_tracker": true,
+							"allow_only_contributors_to_track_time": true,
+							"enable_issue_dependencies": true
+						},
+						"has_wiki": true,
+						"has_pull_requests": true,
+						"has_projects": true,
+						"ignore_whitespace_conflicts": false,
+						"allow_merge_commits": true,
+						"allow_rebase": true,
+						"allow_rebase_explicit": true,
+						"allow_squash_merge": true,
+						"default_merge_style": "merge",
+						"avatar_url": "",
+						"internal": false,
+						"mirror_interval": "",
+						"mirror_updated": "0001-01-01T00:00:00Z",
+						"repo_transfer": null
+					}
+				},
+				"head": {
+					"label": "test",
+					"ref": "test",
+					"sha": "7bbaf62d92ddfafd9cc8b340c619abaec32bc09f",
+					"repo_id": 21618,
+					"repo": {
+						"id": 21618,
+						"owner": {
+							"id": 31480,
+							"login": "test-argocd",
+							"full_name": "",
+							"email": "",
+							"avatar_url": "https://gitea.com/avatars/22d1b1d3f61abf95951c4a958731d848",
+							"language": "",
+							"is_admin": false,
+							"last_login": "0001-01-01T00:00:00Z",
+							"created": "2022-04-06T02:28:06+08:00",
+							"restricted": false,
+							"active": false,
+							"prohibit_login": false,
+							"location": "",
+							"website": "",
+							"description": "",
+							"visibility": "public",
+							"followers_count": 0,
+							"following_count": 0,
+							"starred_repos_count": 0,
+							"username": "test-argocd"
+						},
+						"name": "pr-test",
+						"full_name": "test-argocd/pr-test",
+						"description": "",
+						"empty": false,
+						"private": false,
+						"fork": false,
+						"template": false,
+						"parent": null,
+						"mirror": false,
+						"size": 28,
+						"language": "",
+						"languages_url": "https://gitea.com/api/v1/repos/test-argocd/pr-test/languages",
+						"html_url": "https://gitea.com/test-argocd/pr-test",
+						"ssh_url": "git@gitea.com:test-argocd/pr-test.git",
+						"clone_url": "https://gitea.com/test-argocd/pr-test.git",
+						"original_url": "",
+						"website": "",
+						"stars_count": 0,
+						"forks_count": 0,
+						"watchers_count": 1,
+						"open_issues_count": 0,
+						"open_pr_counter": 1,
+						"release_counter": 0,
+						"default_branch": "main",
+						"archived": false,
+						"created_at": "2022-04-06T02:32:09+08:00",
+						"updated_at": "2022-04-06T02:33:12+08:00",
+						"permissions": {
+							"admin": false,
+							"push": false,
+							"pull": true
+						},
+						"has_issues": true,
+						"internal_tracker": {
+							"enable_time_tracker": true,
+							"allow_only_contributors_to_track_time": true,
+							"enable_issue_dependencies": true
+						},
+						"has_wiki": true,
+						"has_pull_requests": true,
+						"has_projects": true,
+						"ignore_whitespace_conflicts": false,
+						"allow_merge_commits": true,
+						"allow_rebase": true,
+						"allow_rebase_explicit": true,
+						"allow_squash_merge": true,
+						"default_merge_style": "merge",
+						"avatar_url": "",
+						"internal": false,
+						"mirror_interval": "",
+						"mirror_updated": "0001-01-01T00:00:00Z",
+						"repo_transfer": null
+					}
+				},
+				"merge_base": "72687815ccba81ef014a96201cc2e846a68789d8",
+				"due_date": null,
+				"created_at": "2022-04-06T02:34:24+08:00",
+				"updated_at": "2022-04-06T02:34:24+08:00",
+				"closed_at": null
+			}]`)
+			if err != nil {
+				t.Fail()
+			}
+		}
+	}
+}
+
 func TestGiteaList(t *testing.T) {
-	host, err := NewGiteaService(context.Background(), "", "https://gitea.com", "test-argocd", "pr-test", false)
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		giteaMockHandler(t)(w, r)
+	}))
+	host, err := NewGiteaService(context.Background(), "", ts.URL, "test-argocd", "pr-test", false)
 	assert.Nil(t, err)
 	prs, err := host.List(context.Background())
 	assert.Nil(t, err)

applicationset/services/pull_request/github.go

@@ -58,7 +58,7 @@ func (g *GithubService) List(ctx context.Context) ([]*PullRequest, error) {
 	for {
 		pulls, resp, err := g.client.PullRequests.List(ctx, g.owner, g.repo, opts)
 		if err != nil {
-			return nil, fmt.Errorf("error listing pull requests for %s/%s: %v", g.owner, g.repo, err)
+			return nil, fmt.Errorf("error listing pull requests for %s/%s: %w", g.owner, g.repo, err)
 		}
 		for _, pull := range pulls {
 			if !containLabels(g.labels, pull.Labels) {

applicationset/services/pull_request/github_app.go

@@ -0,0 +1,19 @@
+package pull_request
+
+import (
+	"github.com/argoproj/argo-cd/v2/applicationset/services/github_app_auth"
+	"github.com/argoproj/argo-cd/v2/applicationset/services/internal/github_app"
+)
+
+func NewGithubAppService(g github_app_auth.Authentication, url, owner, repo string, labels []string) (PullRequestService, error) {
+	client, err := github_app.Client(g, url)
+	if err != nil {
+		return nil, err
+	}
+	return &GithubService{
+		client: client,
+		owner:  owner,
+		repo:   repo,
+		labels: labels,
+	}, nil
+}

applicationset/services/pull_request/gitlab.go

@@ -0,0 +1,83 @@
+package pull_request
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	gitlab "github.com/xanzy/go-gitlab"
+)
+
+type GitLabService struct {
+	client           *gitlab.Client
+	project          string
+	labels           []string
+	pullRequestState string
+}
+
+var _ PullRequestService = (*GitLabService)(nil)
+
+func NewGitLabService(ctx context.Context, token, url, project string, labels []string, pullRequestState string) (PullRequestService, error) {
+	var clientOptionFns []gitlab.ClientOptionFunc
+
+	// Set a custom Gitlab base URL if one is provided
+	if url != "" {
+		clientOptionFns = append(clientOptionFns, gitlab.WithBaseURL(url))
+	}
+
+	if token == "" {
+		token = os.Getenv("GITLAB_TOKEN")
+	}
+
+	client, err := gitlab.NewClient(token, clientOptionFns...)
+	if err != nil {
+		return nil, fmt.Errorf("error creating Gitlab client: %v", err)
+	}
+
+	return &GitLabService{
+		client:           client,
+		project:          project,
+		labels:           labels,
+		pullRequestState: pullRequestState,
+	}, nil
+}
+
+func (g *GitLabService) List(ctx context.Context) ([]*PullRequest, error) {
+
+	// Filter the merge requests on labels, if they are specified.
+	var labels *gitlab.Labels
+	if len(g.labels) > 0 {
+		labels = (*gitlab.Labels)(&g.labels)
+	}
+
+	opts := &gitlab.ListProjectMergeRequestsOptions{
+		ListOptions: gitlab.ListOptions{
+			PerPage: 100,
+		},
+		Labels: labels,
+	}
+
+	if g.pullRequestState != "" {
+		opts.State = &g.pullRequestState
+	}
+
+	pullRequests := []*PullRequest{}
+	for {
+		mrs, resp, err := g.client.MergeRequests.ListProjectMergeRequests(g.project, opts)
+		if err != nil {
+			return nil, fmt.Errorf("error listing merge requests for project '%s': %v", g.project, err)
+		}
+		for _, mr := range mrs {
+			pullRequests = append(pullRequests, &PullRequest{
+				Number:  mr.IID,
+				Branch:  mr.SourceBranch,
+				HeadSHA: mr.SHA,
+			})
+		}
+		if resp.NextPage == 0 {
+			break
+		}
+		opts.Page = resp.NextPage
+	}
+	return pullRequests, nil
+}

applicationset/services/pull_request/gitlab_test.go

@@ -0,0 +1,122 @@
+package pull_request
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func writeMRListResponse(t *testing.T, w io.Writer) {
+	f, err := os.Open("fixtures/gitlab_mr_list_response.json")
+	if err != nil {
+		t.Fatalf("error opening fixture file: %v", err)
+	}
+
+	if _, err = io.Copy(w, f); err != nil {
+		t.Fatalf("error writing response: %v", err)
+	}
+}
+
+func TestGitLabServiceCustomBaseURL(t *testing.T) {
+	mux := http.NewServeMux()
+	server := httptest.NewServer(mux)
+	defer server.Close()
+
+	path := "/api/v4/projects/278964/merge_requests"
+
+	mux.HandleFunc(path, func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, path+"?per_page=100", r.URL.RequestURI())
+		writeMRListResponse(t, w)
+	})
+
+	svc, err := NewGitLabService(context.Background(), "", server.URL, "278964", nil, "")
+	assert.NoError(t, err)
+
+	_, err = svc.List(context.Background())
+	assert.NoError(t, err)
+}
+
+func TestGitLabServiceToken(t *testing.T) {
+	mux := http.NewServeMux()
+	server := httptest.NewServer(mux)
+	defer server.Close()
+
+	path := "/api/v4/projects/278964/merge_requests"
+
+	mux.HandleFunc(path, func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "token-123", r.Header.Get("Private-Token"))
+		writeMRListResponse(t, w)
+	})
+
+	svc, err := NewGitLabService(context.Background(), "token-123", server.URL, "278964", nil, "")
+	assert.NoError(t, err)
+
+	_, err = svc.List(context.Background())
+	assert.NoError(t, err)
+}
+
+func TestList(t *testing.T) {
+	mux := http.NewServeMux()
+	server := httptest.NewServer(mux)
+	defer server.Close()
+
+	path := "/api/v4/projects/278964/merge_requests"
+
+	mux.HandleFunc(path, func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, path+"?per_page=100", r.URL.RequestURI())
+		writeMRListResponse(t, w)
+	})
+
+	svc, err := NewGitLabService(context.Background(), "", server.URL, "278964", []string{}, "")
+	assert.NoError(t, err)
+
+	prs, err := svc.List(context.Background())
+	assert.NoError(t, err)
+	assert.Len(t, prs, 1)
+	assert.Equal(t, prs[0].Number, 15442)
+	assert.Equal(t, prs[0].Branch, "use-structured-logging-for-db-load-balancer")
+	assert.Equal(t, prs[0].HeadSHA, "2fc4e8b972ff3208ec63b6143e34ad67ff343ad7")
+}
+
+func TestListWithLabels(t *testing.T) {
+	mux := http.NewServeMux()
+	server := httptest.NewServer(mux)
+	defer server.Close()
+
+	path := "/api/v4/projects/278964/merge_requests"
+
+	mux.HandleFunc(path, func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, path+"?labels=feature%2Cready&per_page=100", r.URL.RequestURI())
+		writeMRListResponse(t, w)
+	})
+
+	svc, err := NewGitLabService(context.Background(), "", server.URL, "278964", []string{"feature", "ready"}, "")
+	assert.NoError(t, err)
+
+	_, err = svc.List(context.Background())
+	assert.NoError(t, err)
+}
+
+func TestListWithState(t *testing.T) {
+	mux := http.NewServeMux()
+	server := httptest.NewServer(mux)
+	defer server.Close()
+
+	path := "/api/v4/projects/278964/merge_requests"
+
+	mux.HandleFunc(path, func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, path+"?per_page=100&state=opened", r.URL.RequestURI())
+		writeMRListResponse(t, w)
+	})
+
+	svc, err := NewGitLabService(context.Background(), "", server.URL, "278964", []string{}, "opened")
+	assert.NoError(t, err)
+
+	_, err = svc.List(context.Background())
+	assert.NoError(t, err)
+}

applicationset/services/pull_request/utils.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"regexp"
 
-	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/applicationset/v1alpha1"
+	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 )
 
 func compileFilters(filters []argoprojiov1alpha1.PullRequestGeneratorFilter) ([]*Filter, error) {