Adding or removing match_expressions in a selector forces a new argocd_application_set resource

[ahublersos]

Adding or removing new match_expressions blocks to an argocd_application_set resource, either in a generator's selector or in a post-filter selector requires a new resources to be created. It doesn't look like this is required by the ArgoCD API, and it means that if we need to add a new match expression in the future the applications in our application set are destroyed and then recreated.

Terraform Version, ArgoCD Provider Version and ArgoCD Version

Terraform version: Terraform v1.5.3
ArgoCD provider version: 6.0.2
ArgoCD version: 2.8.0

Affected Resource(s)

• argocd_application_set

Terraform Configuration Files

resource "argocd_application_set" "clusters_selector" {
  metadata {
    name = "clusters-selector"
  }

  spec {
    generator {
      clusters {
        selector {
          match_expressions {
            key      = "argocd.argoproj.io/secret-type"
            operator = "In"
            values   = ["cluster"]
          }
        }
      }
    }

    template {
      metadata {
        name = "{{name}}-clusters-selector"
      }

      spec {
        source {
          repo_url        = "https://github.com/argoproj/argocd-example-apps/"
          target_revision = "HEAD"
          path            = "guestbook"
        }

        destination {
          server    = "{{server}}"
          namespace = "default"
        }
      }
    }
  }
}

Steps to Reproduce

1. Add a second match_expressions block inside the clusters selector (or in a post-filter selector block) EX:

          match_expressions {
            key      = "envLabel"
            operator = "In"
            values = [
              "env-dev"
            ]

2. terraform apply

Expected Behavior

Terraform should update the application_set with the new match_expressions block in-place.

  # argocd_application_set.clusters_selector will be updated in-place
  ~ resource "argocd_application_set" "clusters_selector" {
        id = "clusters-selector"

      ~ spec {
            # (1 unchanged attribute hidden)

          ~ generator {
              ~ clusters {
                    # (2 unchanged attributes hidden)

                  ~ selector {
                        # (1 unchanged attribute hidden)

                      + match_expressions {
                          + key      = "envLabel"
                          + operator = "In"
                          + values   = [
                              + "env-dev",
                            ]
                        }

                        # (2 unchanged blocks hidden)
                    }
                }
            }

            # (2 unchanged blocks hidden)
        }

        # (1 unchanged block hidden)
    }

Actual Behavior

Terraform should update the application_set with the new match_expressions block in-place.

  # argocd_application_set.clusters_selector must be replaced
  ~ resource "argocd_application_set" "clusters_selector" {
        id = "clusters-selector" -> (known after apply)

      ~ spec {
            - go_template = false -> null

          ~ generator {
              ~ clusters {
                    - values  = {} -> null
                    # (1 unchanged attribute hidden)

                  ~ selector {
                        - match_labels = {} -> null

                      + match_expressions { # forces replacement
                          + key      = "envLabel"
                          + operator = "In"
                          + values   = [
                              + "env-dev",
                            ]
                        }

                        # (2 unchanged blocks hidden)
                    }
                }
            }

            # (2 unchanged blocks hidden)
        }

        # (1 unchanged block hidden)
    }

Important Factoids

I tried a custom provider build with ForceNew: false, set in the matchExpressionsSchema in schema_label_selector.go and I was able to add and remove match_expression blocks from an applicationset without recreating it. The argo server logs show the applicationset being updated without any apparent issues.

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment