[2.10-rc4] ApplicationSet templatePatch when unused for an Application results in (nearly) empty spec

[morey-tech]

Checklist:

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug
Related to #14893

When using the new ApplicationSet templatePatch field to define the syncPolicy for an Application, and one of the Applications is left with auto-sync disabled (therefore created in an unknown state), results in the Application spec being nearly empty:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: prd-guestbook
  namespace: argocd
spec:
  destination: {}  # This should be populated from the AppSet spec, along with the missing `source`.
  project: examples # Somehow this survives?

And the UI breaking with the error:

Something went wrong!

Consider submitting an issue [here](https://github.com/argoproj/argo-cd/issues/new?labels=bug&template=bug_report.md).


Stacktrace:

TypeError: Cannot read properties of undefined (reading 'chart')
    at https://localhost:8080/main.586a0e8f59b9479ba603.js:2:1930620
    at Array.map (<anonymous>)
    at Object.children (https://localhost:8080/main.586a0e8f59b9479ba603.js:2:1929808)
    at Yr.render (https://localhost:8080/main.586a0e8f59b9479ba603.js:2:1478481)
    at zi (https://localhost:8080/main.586a0e8f59b9479ba603.js:2:771988)
    at Hi (https://localhost:8080/main.586a0e8f59b9479ba603.js:2:771783)
    at Es (https://localhost:8080/main.586a0e8f59b9479ba603.js:2:807407)
    at Sl (https://localhost:8080/main.586a0e8f59b9479ba603.js:2:798866)
    at xl (https://localhost:8080/main.586a0e8f59b9479ba603.js:2:798791)
    at hl (https://localhost:8080/main.586a0e8f59b9479ba603.js:2:795814)

To Reproduce

1. Deploy Argo CD 2.10-rc4

   kubectl create ns argocd
   kubectl apply -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.10.0-rc4/manifests/ha/install.yaml

2. Deploy an ApplicationSet that uses the templatePatch and where one of the Applications will be in an unknown state.

   apiVersion: argoproj.io/v1alpha1
   kind: ApplicationSet
   metadata:
     name: guestbooks
     # namespace: argocd
   spec:
     goTemplate: true
     generators:
     - list:
         elements:
           - env: dev
             autoSync: true
             prune: true
           - env: stg
             autoSync: true
             prune: false
          # This one will break because it's false.
           - env: prd
             autoSync: false
             prune: false
     template:
       metadata:
         name: '{{.env}}-guestbook'
       spec:
         project: examples
         source:
           repoURL: https://github.com/argoproj/argocd-example-apps
           targetRevision: HEAD
           path: helm-guestbook
         destination:
           name: 'in-cluster'
           namespace: '{{.env}}-guestbook'
         syncPolicy:
           syncOptions:
           - CreateNamespace=true
     templatePatch: |
       spec:
       {{- if .autoSync }}
         syncPolicy:
           automated:
             prune: {{ .prune }}
       {{- end }}

3. Check the generated Applications. Those with autoSync enabled work fine:

   kind: Application
   metadata:
     name: dev-guestbook
     namespace: argocd
   spec:
     destination:
       name: in-cluster
       namespace: dev-guestbook
     project: examples
     source:
       path: helm-guestbook
       repoURL: https://github.com/argoproj/argocd-example-apps
       targetRevision: HEAD
     syncPolicy:
       automated:
         prune: true
       syncOptions:
       - CreateNamespace=true

   Those without autoSync: false will be broken (breaking the UI as well).

   apiVersion: argoproj.io/v1alpha1
   kind: Application
   metadata:
     name: prd-guestbook
     namespace: argocd
   spec:
     destination: {}
     project: examples

Expected behavior

I would expect that the resulting Application manifest would contain exactly what is in the spec.template when autoSync: false is used. Specifically, prd-guestbook should look like:

kind: Application
metadata:
  name: prd-guestbook
  namespace: argocd
spec:
  destination:
    name: in-cluster
    namespace: prd-guestbook
  project: examples
  source:
    path: helm-guestbook
    repoURL: https://github.com/argoproj/argocd-example-apps
    targetRevision: HEAD
  syncPolicy:
    syncOptions:
    - CreateNamespace=true

Screenshots

Version

Paste the output from `argocd version` here.
{
    "Version": "v2.10.0-rc4+c6469ae"
}

Logs

# argocd-applicationset-controller
time="2024-01-30T15:54:38Z" level=info msg="generated 3 applications" applicationset=argocd/guestbooks generator="{&ListGenerator{Elements:[]JSON{{[123 34 97 117 116 111 83 121 110 99 34 58 116 114 117 101 44 34 101 110 118 34 58 34 100 101 118 34 44 34 112 114 117 110 101 34 58 116 114 117 101 125]},{[123 34 97 117 116 111 83 121 110 99 34 58 116 114 117 101 44 34 101 110 118 34 58 34 115 116 103 34 44 34 112 114 117 110 101 34 58 102 97 108 115 101 125]},{[123 34 97 117 116 111 83 121 110 99 34 58 102 97 108 115 101 44 34 101 110 118 34 58 34 112 114 100 34 44 34 112 114 117 110 101 34 58 102 97 108 115 101 125]},},Template:ApplicationSetTemplate{ApplicationSetTemplateMeta:ApplicationSetTemplateMeta{Name:,Namespace:,Labels:map[string]string{},Annotations:map[string]string{},Finalizers:[],},Spec:ApplicationSpec{Source:nil,Destination:ApplicationDestination{Server:,Namespace:,Name:,},Project:,SyncPolicy:nil,IgnoreDifferences:[]ResourceIgnoreDifferences{},Info:[]Info{},RevisionHistoryLimit:nil,Sources:[]ApplicationSource{},},},ElementsYaml:,} nil nil nil nil nil nil nil nil nil}"
time="2024-01-30T15:54:38Z" level=info msg="end reconcile" applicationset=argocd/guestbooks requeueAfter=0s

[crenshaw-dev]

What happens if you do this?

  templatePatch: |
+   {{- if .autoSync }}
    spec:
-   {{- if .autoSync }}
      syncPolicy:
        automated:
          prune: {{ .prune }}
    {{- end }}

[morey-tech]

That works!

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: prd-guestbook
  namespace: argocd
spec:
  destination:
    name: in-cluster
    namespace: prd-guestbook
  project: examples
  source:
    path: helm-guestbook
    repoURL: https://github.com/argoproj/argocd-example-apps
    targetRevision: HEAD
  syncPolicy:
    syncOptions:
    - CreateNamespace=true

So if an empty spec is left in the templatePatch it will produce an empty destination and no source, but leave in project.

If this is "expected," I'll make a docs update with a warning.

[crenshaw-dev]

but leave in project.

project only survives, because there's a security feature that disallows patching that field.

I think the docs should probably emphasize that, when writing a templatePatch, you're crafting a patch. So if the patch looks like spec: # nothing in here, it will effectively clear out existing fields.