ApplicationSet controller

argocd-applicationset-controller watches ApplicationSet CRs and produces Application CRs from them. It is the "fan-out" component for multi-cluster, multi-environment, and PR-preview workflows.

Purpose

• Reconcile ApplicationSet resources by running configured generators and templates.
• Create, update, and prune child Application resources to match the generator output.
• Provide multiple generation strategies — explicit lists, all clusters, Git directories/files, SCM providers, pull requests, custom plugins, and matrix/merge compositions.
• Optionally drive progressive rollouts across environments.

Where it lives

Path	Purpose
cmd/argocd-applicationset-controller/commands/	Binary entry point.
applicationset/controllers/applicationset_controller.go	The reconciler (~80 KB). Drives the loop using controller-runtime.
applicationset/controllers/template/	Template substitution helpers.
applicationset/controllers/clustereventhandler.go	Watches Cluster Secrets so cluster generators react instantly.
applicationset/generators/	Generator implementations (one file per type).
applicationset/services/	Provider clients (SCM providers, pull request APIs, plugins).
applicationset/utils/	Templating + parameter helpers.
applicationset/status/	Computes per-app rollout status.
applicationset/metrics/	Prometheus metrics.
applicationset/webhook/	Webhook receiver for instant generator refresh.
applicationset/examples/	Worked examples for each generator type.

Generator catalog

Generator	File	Source of items
List	generators/list.go	Inline list of param maps.
Cluster	generators/cluster.go	Registered destination clusters (util/db/cluster.go).
Git (file & directory)	generators/git.go	Files or subdirectories within a Git repo.
Matrix	generators/matrix.go	Cartesian product of two child generators.
Merge	generators/merge.go	Field-merge of two child generators.
SCM Provider	generators/scm_provider.go + services/scm_provider/	All repos in a GitHub/GitLab/Bitbucket/Gitea/Azure DevOps/AWS CodeCommit org.
Pull Request	generators/pull_request.go + services/pull_request/	Open PRs in the same providers.
Plugin	generators/plugin.go + services/plugin/	A user-supplied HTTP service.
DuckType	generators/duck_type.go	Items pulled from any cluster-scoped CRD that exposes a list.

The generator interface is defined in applicationset/generators/interface.go, and the spec processor in generator_spec_processor.go fans an ApplicationSet out into rendered Application candidates.

Reconciliation flow

graph LR
    AS[ApplicationSet CR] --> Recon[ApplicationSetReconciler]
    Recon --> Gens[Run generators]
    Gens --> Params[Parameter sets]
    Params --> Tmpl[Template substitution]
    Tmpl --> Apps[Desired Applications]
    Recon --> Live[List existing children]
    Apps --> Diff[Diff: create/update/prune]
    Diff --> K8s[(Kubernetes API)]
    Diff --> Status[Update ApplicationSet status]

The reconciler in applicationset_controller.go orchestrates the loop. Notable knobs and behaviors:

• Progressive syncs. When ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_PROGRESSIVE_SYNCS=true, the controller respects the strategy.rollingSync field and pauses cohort-by-cohort rollouts until each cohort is healthy. Status tracking is in applicationset/status/.
• Deletion order. ReverseDeletionOrder and AllAtOnceDeletionOrder constants in applicationset_controller.go describe how children are deleted on AppSet removal.
• Validation. Bad ApplicationSets get ReconcileRequeueOnValidationError requeue (3 minutes).
• Notification annotations. NotifiedAnnotationKey is propagated from the legacy notifications controller for parity.

Webhook fast path

applicationset/webhook/webhook.go listens for Git/SCM events and triggers immediate re-reconciliation of ApplicationSets whose generators reference the touched repo or PR — bypassing the polling cadence.

Cluster fan-out

For cluster-aware generators (Cluster, Matrix-with-cluster, Merge-with-cluster), clustereventhandler.go watches Secrets with the argocd.argoproj.io/secret-type=cluster label and enqueues affected ApplicationSets.

Templating

The template engine uses Go text/template with sprig functions, plus custom helpers in applicationset/utils/ and applicationset/controllers/template/. Parameter values are substituted into the template.spec section of the ApplicationSet.

generators/value_interpolation.go provides recursive variable interpolation across nested maps so generators can compose.

Service clients

External provider clients live under applicationset/services/:

• scm_provider/ — listing repos in GitHub, GitLab, Bitbucket Cloud/Server, Gitea, Azure DevOps, AWS CodeCommit.
• pull_request/ — listing open PRs in the same providers.
• plugin/ — HTTP plugin client used by the Plugin generator.
• internal/ — shared client helpers.

Authentication for these clients reuses util/github_app/, AWS SDK credentials in util/workloadidentity/, and provider-specific bearer tokens.

Configuration surface (selected flags)

• --argocd-repo-server — peer address (used by Git generator for auth lookups when needed).
• --metrics-addr, --probe-addr — controller-runtime endpoints.
• --enable-progressive-syncs (or env var) — opt-in for rolling sync.
• --policy {sync,create-only,create-update,create-delete} — what the controller is allowed to do to its children.

Entry points for modification

• New generator → drop a file in applicationset/generators/, implement the Generator interface, and register it in applicationset/generators/generator_spec_processor.go.
• New SCM provider → drop a client in applicationset/services/scm_provider/.
• New PR provider → drop a client in applicationset/services/pull_request/.
• Tweak progressive rollout policy → applicationset/status/.

See also: features/applicationsets, primitives/applicationset.