ApplicationSet not honoring sourceRepos and destinations from globalProjects

[agaudreault]

Checklist:

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug

When using an ApplicationSet to generate applications, the sourceRepos and destinations that are configured on a global project are not working. For the application to be generated properly, the project specified in the .spec.template.spec.project of the ApplicationSet must have the sourceRepos configured directly. Even if the sourceRepos shows up in the ArgoCD as being inherited.

To Reproduce

1. Create a project project1
2. Create a global project project2 with sourceRepos
3. Add label to project1 to inherit from project2 and configure argoCD config map for globalProjects and destinations
4. Create an ApplicationSet using project1 and using sources from a repo defined in project2. It must create at least one Application to generate the error.

Expected behavior

It should work if the sourceRepos are inherited

Screenshots

The ApplicationSet has the following status:

status:
  conditions:
    - lastTransitionTime: '2022-05-04T03:11:45Z'
      message: >-
        application spec is invalid: InvalidSpecError: application repo
        https://github.com/org/apps is not permitted in project 'project1'
      reason: ApplicationValidationError
      status: 'True'
      type: ErrorOccurred
    - lastTransitionTime: '2022-04-29T19:40:18Z'
      message: Successfully generated parameters for all Applications
      reason: ParametersGenerated
      status: 'True'
      type: ParametersGenerated
    - lastTransitionTime: '2022-05-04T03:11:45Z'
      message: >-
        application spec is invalid: InvalidSpecError: application repo
        https://github.com/org/apps is not permitted in project 'project1'
      reason: ApplicationValidationError
      status: 'False'
      type: ResourcesUpToDate

And for destinations

status:
  conditions:
    - lastTransitionTime: '2022-05-04T17:20:47Z'
      message: >-
        application spec is invalid: InvalidSpecError: application destination
        {https://domain.eks.amazonaws.com
        example-ns} is not permitted in project 'project1' (and 2 more)
      reason: ApplicationValidationError
      status: 'True'
      type: ErrorOccurred
    - lastTransitionTime: '2022-04-29T15:03:34Z'
      message: Successfully generated parameters for all Applications
      reason: ParametersGenerated
      status: 'True'
      type: ParametersGenerated
    - lastTransitionTime: '2022-05-04T17:20:47Z'
      message: >-
        application spec is invalid: InvalidSpecError: application destination
        {https://domain.eks.amazonaws.com
        example-ns} is not permitted in project 'project1' (and 2 more)
      reason: ApplicationValidationError
      status: 'False'
      type: ResourcesUpToDate

Version

ArgoCD version 2.3.3
ApplicationSet version 0.4.1

[X4mp]

We are experiencing the same issue here. Could you find a workaround to make this work? What is an alternative to the global project?

[rumstead]

Also facing this. We have been adding source repos to each project if using appsets.

[rumstead]

The source repos aren't populated by the global project here. It is because validateGeneratedApplications never calls GetAppProjectByName.

You can see the application controller does when it creates/updates an application. validate -> get the project via the client -> GetAppProjectByName

[rumstead]

@crenshaw-dev any thoughts on how to "share" the project lister to the appset controller?

I did a copy and pasta of the Application Controller and it doesn't seem to like it.

settingsMgr := settings_util.NewSettingsManager(ctx, r.KubeClientset, namespace)
factory := appinformer.NewSharedInformerFactoryWithOptions(r.ArgoAppClientset, 30, appinformer.WithNamespace(namespace), appinformer.WithTweakListOptions(func(options *metav1.ListOptions) {}))
projLister := factory.Argoproj().V1alpha1().AppProjects().Lister()
log.WithField("project", app.Spec.GetProject()).WithField("namespace", namespace).Info("Getting project")
project, err := argoutil.GetAppProjectByName(app.Spec.GetProject(), projLister, namespace, settingsMgr, r.ArgoDB, ctx)
if err != nil {
	return nil, err
}

❯ k get appprojects.argoproj.io -n argocd test
NAME   AGE
test   25m

time="2022-06-24T21:24:50Z" level=info msg="Getting project" namespace=argocd project=test
time="2022-06-24T21:24:50Z" level=error msg="error occurred during application validation: appproject.argoproj.io \"test\" not found"

EDIT: It is because the cache is never built.

[crenshaw-dev]

@rumstead unfortunately I'm not super familiar with that code... I feel like there's gotta be somewhere that the global projects are being injected before GetAppProjectByName, but I'm not sure where.

[rumstead]

@rumstead unfortunately I'm not super familiar with that code... I feel like there's gotta be somewhere that the global projects are being injected before GetAppProjectByName, but I'm not sure where.

Hmm, maybe I couldn't find anything else.

You can see GetAppProjectByName call GetAppVirtualProject which does the merging here

[rumstead]

I am not sure what is the best way to expose the app project cache. My PR is a stop-gap to unblock global projects.

1. Update the argo db to expose the app project informer/lister similar to secrets?
2. Make the argo GetAppVirtualProject more generic and get the global project and projects in the app set controller... doesn't feel DRY
3. Other?

EDIT: My PR would lose a lot of other validations. Not sure if we want that...

@crenshaw-dev to your point, the application controller looks to hold the cache, here.

[mvaalexp]

Did anyone find a work around or solution for this?

[rumstead]

Add the source repos and such to the inherited app projects :-/

[agaudreault]

I think we should drop the validation of the project/appSpec and let the applicationSet controller generate the app. Why? Because the validation will be performed anyway by the controller after the apps are created.
I prefer having the apps in error, then my applicationSet not able to generate them.

The other alternatives would be to

• Have the argoSettings + projLister loaded in the ApplicationSet.
  • I think it just introduces coupling with the components in the code.
• Expose the GetAppProjectByName as an API on the controller
  • It introduces coupling in the architecture.