Deploy Application to different namespace than ApplicationSet

[florianmutter]

It seems that applications are always in the same namespace as applicationsets. We tried setting a namespace in template.metadata.namespace like in the following example:

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: development
spec:
  goTemplate: true
  goTemplateOptions: [ "missingkey=error" ]
  generators:
    - matrix:
        generators:
          - list:
              elements:
                - cluster: dev-1
                  url: https://kubernetes.default.svc
          - git:
              repoURL: https://github.com/example/new-deployment-process.git
              revision: HEAD
              directories:
                - path: "*/services/*/k8s/overlays/development"
                - path: "*/apps/*/k8s/overlays/development"
  template:
    metadata:
      name: 'development-{{index .path.segments 0}}-{{index .path.segments 2}}-{{.cluster}}'
      namespace: '{{index .path.segments 0}}'
    spec:
      project: development
      source:
        repoURL: https://github.com/fadi-nextgen-shop/new-deployment-process.git
        targetRevision: HEAD
        path: '{{.path.path}}'
        plugin:
          name: kustomize-env
          env:
            - name: TEAM
              value: "{{index .path.segments 0}}"
            - name: SERVICE_NAME
              value: "{{index .path.segments 2}}"
            - name: COMMIT_SHA
              value: ${ARGOCD_APP_REVISION}
            - name: ENV
              value: development
      destination:
        server: '{{.url}}'
        namespace: '{{index .path.segments 0}}'
      syncPolicy:
        automated:
          allowEmpty: true
          prune: true
          selfHeal: true
        syncOptions:
          - CreateNamespace=true

but the application is always in the argocd namespace. We also tried a static value and adding the namespace to applicationsetcontroller.namespaces but nothing worked.

NOTE: The application it self does what it is supposed to do and can deploy everything it wants. Its only the application itself that is in the wrong namespace

[florianmutter]

I found this code in the applicationset controller:

		// The app's namespace must be the same as the AppSet's namespace to preserve the appsets-in-any-namespace
		// security boundary.
		generatedApp.Namespace = applicationSet.Namespace

That explains this behavior. So no application in a different namespace. Could be added to the ApplicationSet documentation though.

[v-atsai]

This seems to still be the case in v3.4.4

argo-cd/applicationset/controllers/applicationset_controller.go

Lines 798 to 802 in ddea9e7

	var current argov1alpha1.ApplicationList
	err := r.List(ctx, &current, client.MatchingFields{".metadata.controller": applicationSet.Name}, client.InNamespace(applicationSet.Namespace))
	if err != nil {
	return nil, fmt.Errorf("error retrieving applications: %w", err)
	}