matchLabels selector doesn't allow dots in the name of the key

[fad3t]

Describe the bug

I'm using ApplicationSets to conditionally deploy resources to clusters.
For example, I would like to deploy a web application only on clusters that have the webApp.enabled property set to "true".

I'm using the matchLabel selector to set the condition, however it seems it doesn't support dots in key names.

To Reproduce

Here's a sample definition of a cluster (clusters/test.yaml):

---
cluster:
  name: test-01
  namespace: dev
  virtualIp: 10.10.10.1
webApp:
  enabled: "true"
  values: |
    service:
      type: LoadBalancer

And the corresponding ApplicationSet, which doesn't work -- no Application gets created:

---
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: web-app 
spec:
  goTemplate: true
  syncPolicy:
    preserveResourcesOnDeletion: false
  generators:
  - git:
      repoURL: https://gitlab.com/test/test.git
      revision: main
      files:
      - path: clusters/*.yaml
    selector:
      matchLabels:
        webApp.enabled: "true"
  template:
    metadata:
      name: '{{.cluster.name}}-web-app'
    spec:
      project: default
      source:
        repoURL: https://gitlab.com/test/test.git
        targetRevision: main
        path: addons/web
        helm:
          values: '{{.webApp.values}}'
      destination:
        server: 'https://{{.cluster.virtualIp}}:6443'
        namespace: default
      syncPolicy:
        syncOptions:
        - ServerSideApply=true

I was able to work around by putting the key at the root at the document (webAppEnabled), however I would prefer to have it part of the webApp object. The following definition works:

---
cluster:
  name: test-01
  namespace: dev
  virtualIp: 10.10.10.1
webAppEnabled: "true"
webApp:
  values: |
    service:
      type: LoadBalancer

---
  <..>
  generators:
  - git:
      repoURL: https://gitlab.com/test/test.git
      revision: main
      files:
      - path: clusters/*.yaml
    selector:
      matchLabels:
        webAppEnabled: "true"
    <..>

Am I missing something here, or is this not supported by the ApplicationSet controller?

Expected behavior

I would expect the ApplicationSet controller to accept dots in the name of the key, as it is possible in Kubernetes.

Version

argocd-server: v2.5.4+86b2dde

[pc-tzimmerman]

Is the matchLabels selector even supported for git generators?

You'll notice that the cluster generator page in the documentation contains a Table of contents entry for Label selector. However, the git generator page does not.

The yaml is accepted by the admission controller when you define an ApplicationSet using a git generator with the matchLabels selector. However, in my experience, it just prevents the ApplicationSet from matching any clusters successfully. And no applications are created as a result.

[fad3t]

That's what I thought too, until I found argoproj/applicationset#361 (fixed by #9312).
So it seems selectors are available for all kinds of generators, however here the point is about supporting label keys with dots in it (webApp.enabled instead of webAppEnabled).
I didn't test it, but I expect this behavior to be the same with other types of generators.