From 1372529d5674405d214e8d96f91388a52db76b63 Mon Sep 17 00:00:00 2001
From: Yi Cai <yicai@redhat.com>
Date: Fri, 5 Jan 2024 11:53:08 -0500
Subject: [PATCH 01/13] fix(ui):Fixed log horizontal scroll for issue #16411
 (#16727)

* Fixed log horizontal scroll

Signed-off-by: Yi Cai <yicai@redhat.com>

* Updated log line-height

Signed-off-by: Yi Cai <yicai@redhat.com>

---------

Signed-off-by: Yi Cai <yicai@redhat.com>
---
 .../components/pod-logs-viewer/pod-logs-viewer.tsx            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ui/src/app/applications/components/pod-logs-viewer/pod-logs-viewer.tsx b/ui/src/app/applications/components/pod-logs-viewer/pod-logs-viewer.tsx
index 1ef2d83815821..309287fab2f37 100644
--- a/ui/src/app/applications/components/pod-logs-viewer/pod-logs-viewer.tsx
+++ b/ui/src/app/applications/components/pod-logs-viewer/pod-logs-viewer.tsx
@@ -149,9 +149,9 @@ export const PodsLogsViewer = (props: PodLogsProps) => {
     const logsContent = (width: number, height: number, isWrapped: boolean) => (
         <div ref={logsContainerRef} onScroll={handleScroll} style={{width, height, overflow: 'scroll'}}>
             {logs.map((log, lineNum) => (
-                <pre key={lineNum} style={{whiteSpace: isWrapped ? 'normal' : 'pre'}} className='noscroll'>
+                <div key={lineNum} style={{whiteSpace: isWrapped ? 'normal' : 'pre', lineHeight: '16px'}} className='noscroll'>
                     <Ansi>{renderLog(log, lineNum)}</Ansi>
-                </pre>
+                </div>
             ))}
         </div>
     );

From 4afddf71cce23105b0989a497054c5faa85dfa92 Mon Sep 17 00:00:00 2001
From: Alexander Matyushentsev <AMatyushentsev@gmail.com>
Date: Fri, 5 Jan 2024 08:53:52 -0800
Subject: [PATCH 02/13] feat: webhook should use 'rename' to copy app manifests
 of previous commit (#16754)

Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com>
---
 .../commands/argocd_application_controller.go |  12 +-
 .../commands/argocd_repo_server.go            |   6 +-
 cmd/argocd-server/commands/argocd_server.go   |  13 +-
 cmd/argocd/commands/headless/headless.go      |   6 +
 .../server-commands/argocd-server.md          | 147 ++++++++++--------
 reposerver/cache/cache.go                     |   9 +-
 server/cache/cache.go                         |   3 +-
 server/server.go                              |   3 +-
 util/cache/appstate/cache.go                  |   3 +-
 util/cache/cache.go                           | 110 ++++++++++---
 util/cache/client.go                          |   1 +
 util/cache/inmemory.go                        |  10 ++
 util/cache/mocks/cacheclient.go               |  11 +-
 util/cache/redis.go                           |   4 +
 util/cache/twolevelclient.go                  |   8 +
 util/webhook/webhook.go                       |  10 +-
 16 files changed, 243 insertions(+), 113 deletions(-)

diff --git a/cmd/argocd-application-controller/commands/argocd_application_controller.go b/cmd/argocd-application-controller/commands/argocd_application_controller.go
index 796a645f03393..d5ef88a1702b6 100644
--- a/cmd/argocd-application-controller/commands/argocd_application_controller.go
+++ b/cmd/argocd-application-controller/commands/argocd_application_controller.go
@@ -6,11 +6,12 @@ import (
 	"math"
 	"time"
 
-	"github.com/argoproj/argo-cd/v2/pkg/ratelimiter"
 	"github.com/argoproj/pkg/stats"
 	"github.com/redis/go-redis/v9"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	kubeerrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/tools/clientcmd"
 
@@ -20,6 +21,7 @@ import (
 	"github.com/argoproj/argo-cd/v2/controller/sharding"
 	"github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 	appclientset "github.com/argoproj/argo-cd/v2/pkg/client/clientset/versioned"
+	"github.com/argoproj/argo-cd/v2/pkg/ratelimiter"
 	"github.com/argoproj/argo-cd/v2/reposerver/apiclient"
 	cacheutil "github.com/argoproj/argo-cd/v2/util/cache"
 	appstatecache "github.com/argoproj/argo-cd/v2/util/cache/appstate"
@@ -31,8 +33,6 @@ import (
 	"github.com/argoproj/argo-cd/v2/util/settings"
 	"github.com/argoproj/argo-cd/v2/util/tls"
 	"github.com/argoproj/argo-cd/v2/util/trace"
-	kubeerrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
 const (
@@ -227,8 +227,10 @@ func NewCommand() *cobra.Command {
 	command.Flags().Float64Var(&workqueueRateLimit.BackoffFactor, "wq-backoff-factor", env.ParseFloat64FromEnv("WORKQUEUE_BACKOFF_FACTOR", 1.5, 0, math.MaxFloat64), "Set Workqueue Per Item Rate Limiter Backoff Factor, default is 1.5")
 	command.Flags().BoolVar(&enableDynamicClusterDistribution, "dynamic-cluster-distribution-enabled", env.ParseBoolFromEnv(common.EnvEnableDynamicClusterDistribution, false), "Enables dynamic cluster distribution.")
 	command.Flags().BoolVar(&serverSideDiff, "server-side-diff-enabled", env.ParseBoolFromEnv(common.EnvServerSideDiff, false), "Feature flag to enable ServerSide diff. Default (\"false\")")
-	cacheSource = appstatecache.AddCacheFlagsToCmd(&command, func(client *redis.Client) {
-		redisClient = client
+	cacheSource = appstatecache.AddCacheFlagsToCmd(&command, cacheutil.Options{
+		OnClientCreated: func(client *redis.Client) {
+			redisClient = client
+		},
 	})
 	return &command
 }
diff --git a/cmd/argocd-repo-server/commands/argocd_repo_server.go b/cmd/argocd-repo-server/commands/argocd_repo_server.go
index 2a16d192e01bd..84b50e7cd5ab9 100644
--- a/cmd/argocd-repo-server/commands/argocd_repo_server.go
+++ b/cmd/argocd-repo-server/commands/argocd_repo_server.go
@@ -210,8 +210,10 @@ func NewCommand() *cobra.Command {
 	command.Flags().StringVar(&helmManifestMaxExtractedSize, "helm-manifest-max-extracted-size", env.StringFromEnv("ARGOCD_REPO_SERVER_HELM_MANIFEST_MAX_EXTRACTED_SIZE", "1G"), "Maximum size of helm manifest archives when extracted")
 	command.Flags().BoolVar(&disableManifestMaxExtractedSize, "disable-helm-manifest-max-extracted-size", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_DISABLE_HELM_MANIFEST_MAX_EXTRACTED_SIZE", false), "Disable maximum size of helm manifest archives when extracted")
 	tlsConfigCustomizerSrc = tls.AddTLSFlagsToCmd(&command)
-	cacheSrc = reposervercache.AddCacheFlagsToCmd(&command, func(client *redis.Client) {
-		redisClient = client
+	cacheSrc = reposervercache.AddCacheFlagsToCmd(&command, cacheutil.Options{
+		OnClientCreated: func(client *redis.Client) {
+			redisClient = client
+		},
 	})
 	return &command
 }
diff --git a/cmd/argocd-server/commands/argocd_server.go b/cmd/argocd-server/commands/argocd_server.go
index 6eeb5b299ce0f..72fe765c32c56 100644
--- a/cmd/argocd-server/commands/argocd_server.go
+++ b/cmd/argocd-server/commands/argocd_server.go
@@ -18,8 +18,10 @@ import (
 	"github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 	appclientset "github.com/argoproj/argo-cd/v2/pkg/client/clientset/versioned"
 	"github.com/argoproj/argo-cd/v2/reposerver/apiclient"
+	reposervercache "github.com/argoproj/argo-cd/v2/reposerver/cache"
 	"github.com/argoproj/argo-cd/v2/server"
 	servercache "github.com/argoproj/argo-cd/v2/server/cache"
+	cacheutil "github.com/argoproj/argo-cd/v2/util/cache"
 	"github.com/argoproj/argo-cd/v2/util/cli"
 	"github.com/argoproj/argo-cd/v2/util/dex"
 	"github.com/argoproj/argo-cd/v2/util/env"
@@ -64,6 +66,7 @@ func NewCommand() *cobra.Command {
 		enableGZip               bool
 		tlsConfigCustomizerSrc   func() (tls.ConfigCustomizer, error)
 		cacheSrc                 func() (*servercache.Cache, error)
+		repoServerCacheSrc       func() (*reposervercache.Cache, error)
 		frameOptions             string
 		contentSecurityPolicy    string
 		repoServerPlaintext      bool
@@ -105,6 +108,8 @@ func NewCommand() *cobra.Command {
 			errors.CheckError(err)
 			cache, err := cacheSrc()
 			errors.CheckError(err)
+			repoServerCache, err := repoServerCacheSrc()
+			errors.CheckError(err)
 
 			kubeclientset := kubernetes.NewForConfigOrDie(config)
 
@@ -183,6 +188,7 @@ func NewCommand() *cobra.Command {
 				EnableGZip:            enableGZip,
 				TLSConfigCustomizer:   tlsConfigCustomizer,
 				Cache:                 cache,
+				RepoServerCache:       repoServerCache,
 				XFrameOptions:         frameOptions,
 				ContentSecurityPolicy: contentSecurityPolicy,
 				RedisClient:           redisClient,
@@ -254,8 +260,11 @@ func NewCommand() *cobra.Command {
 	command.Flags().StringSliceVar(&applicationNamespaces, "application-namespaces", env.StringsFromEnv("ARGOCD_APPLICATION_NAMESPACES", []string{}, ","), "List of additional namespaces where application resources can be managed in")
 	command.Flags().BoolVar(&enableProxyExtension, "enable-proxy-extension", env.ParseBoolFromEnv("ARGOCD_SERVER_ENABLE_PROXY_EXTENSION", false), "Enable Proxy Extension feature")
 	tlsConfigCustomizerSrc = tls.AddTLSFlagsToCmd(command)
-	cacheSrc = servercache.AddCacheFlagsToCmd(command, func(client *redis.Client) {
-		redisClient = client
+	cacheSrc = servercache.AddCacheFlagsToCmd(command, cacheutil.Options{
+		OnClientCreated: func(client *redis.Client) {
+			redisClient = client
+		},
 	})
+	repoServerCacheSrc = reposervercache.AddCacheFlagsToCmd(command, cacheutil.Options{FlagPrefix: "repo-server-"})
 	return command
 }
diff --git a/cmd/argocd/commands/headless/headless.go b/cmd/argocd/commands/headless/headless.go
index 5c9828fc9f131..d48019a2216b9 100644
--- a/cmd/argocd/commands/headless/headless.go
+++ b/cmd/argocd/commands/headless/headless.go
@@ -78,6 +78,12 @@ func (c *forwardCacheClient) Set(item *cache.Item) error {
 	})
 }
 
+func (c *forwardCacheClient) Rename(oldKey string, newKey string, expiration time.Duration) error {
+	return c.doLazy(func(client cache.CacheClient) error {
+		return client.Rename(oldKey, newKey, expiration)
+	})
+}
+
 func (c *forwardCacheClient) Get(key string, obj interface{}) error {
 	return c.doLazy(func(client cache.CacheClient) error {
 		return client.Get(key, obj)
diff --git a/docs/operator-manual/server-commands/argocd-server.md b/docs/operator-manual/server-commands/argocd-server.md
index e3dcc937243df..1da27d735e1cd 100644
--- a/docs/operator-manual/server-commands/argocd-server.md
+++ b/docs/operator-manual/server-commands/argocd-server.md
@@ -25,73 +25,86 @@ argocd-server [flags]
 ### Options
 
 ```
-      --address string                                Listen on given address (default "0.0.0.0")
-      --app-state-cache-expiration duration           Cache expiration for app state (default 1h0m0s)
-      --application-namespaces strings                List of additional namespaces where application resources can be managed in
-      --as string                                     Username to impersonate for the operation
-      --as-group stringArray                          Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
-      --as-uid string                                 UID to impersonate for the operation
-      --basehref string                               Value for base href in index.html. Used if Argo CD is running behind reverse proxy under subpath different from / (default "/")
-      --certificate-authority string                  Path to a cert file for the certificate authority
-      --client-certificate string                     Path to a client certificate file for TLS
-      --client-key string                             Path to a client key file for TLS
-      --cluster string                                The name of the kubeconfig cluster to use
-      --connection-status-cache-expiration duration   Cache expiration for cluster/repo connection status (default 1h0m0s)
-      --content-security-policy value                 Set Content-Security-Policy header in HTTP responses to value. To disable, set to "". (default "frame-ancestors 'self';")
-      --context string                                The name of the kubeconfig context to use
-      --default-cache-expiration duration             Cache expiration default (default 24h0m0s)
-      --dex-server string                             Dex server address (default "argocd-dex-server:5556")
-      --dex-server-plaintext                          Use a plaintext client (non-TLS) to connect to dex server
-      --dex-server-strict-tls                         Perform strict validation of TLS certificates when connecting to dex server
-      --disable-auth                                  Disable client authentication
-      --disable-compression                           If true, opt-out of response compression for all requests to the server
-      --enable-gzip                                   Enable GZIP compression (default true)
-      --enable-proxy-extension                        Enable Proxy Extension feature
-      --gloglevel int                                 Set the glog logging level
-  -h, --help                                          help for argocd-server
-      --insecure                                      Run server without TLS
-      --insecure-skip-tls-verify                      If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
-      --kubeconfig string                             Path to a kube config. Only required if out-of-cluster
-      --logformat string                              Set the logging format. One of: text|json (default "text")
-      --login-attempts-expiration duration            Cache expiration for failed login attempts (default 24h0m0s)
-      --loglevel string                               Set the logging level. One of: debug|info|warn|error (default "info")
-      --metrics-address string                        Listen for metrics on given address (default "0.0.0.0")
-      --metrics-port int                              Start metrics on given port (default 8083)
-  -n, --namespace string                              If present, the namespace scope for this CLI request
-      --oidc-cache-expiration duration                Cache expiration for OIDC state (default 3m0s)
-      --otlp-address string                           OpenTelemetry collector address to send traces to
-      --otlp-attrs strings                            List of OpenTelemetry collector extra attrs when send traces, each attribute is separated by a colon(e.g. key:value)
-      --otlp-headers stringToString                   List of OpenTelemetry collector extra headers sent with traces, headers are comma-separated key-value pairs(e.g. key1=value1,key2=value2) (default [])
-      --otlp-insecure                                 OpenTelemetry collector insecure mode (default true)
-      --password string                               Password for basic authentication to the API server
-      --port int                                      Listen on given port (default 8080)
-      --proxy-url string                              If provided, this URL will be used to connect via proxy
-      --redis string                                  Redis server hostname and port (e.g. argocd-redis:6379). 
-      --redis-ca-certificate string                   Path to Redis server CA certificate (e.g. /etc/certs/redis/ca.crt). If not specified, system trusted CAs will be used for server certificate validation.
-      --redis-client-certificate string               Path to Redis client certificate (e.g. /etc/certs/redis/client.crt).
-      --redis-client-key string                       Path to Redis client key (e.g. /etc/certs/redis/client.crt).
-      --redis-compress string                         Enable compression for data sent to Redis with the required compression algorithm. (possible values: gzip, none) (default "gzip")
-      --redis-insecure-skip-tls-verify                Skip Redis server certificate validation.
-      --redis-use-tls                                 Use TLS when connecting to Redis. 
-      --redisdb int                                   Redis database.
-      --repo-server string                            Repo server address (default "argocd-repo-server:8081")
-      --repo-server-plaintext                         Use a plaintext client (non-TLS) to connect to repository server
-      --repo-server-strict-tls                        Perform strict validation of TLS certificates when connecting to repo server
-      --repo-server-timeout-seconds int               Repo server RPC call timeout seconds. (default 60)
-      --request-timeout string                        The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
-      --rootpath string                               Used if Argo CD is running behind reverse proxy under subpath different from /
-      --sentinel stringArray                          Redis sentinel hostname and port (e.g. argocd-redis-ha-announce-0:6379). 
-      --sentinelmaster string                         Redis sentinel master group name. (default "master")
-      --server string                                 The address and port of the Kubernetes API server
-      --staticassets string                           Directory path that contains additional static assets (default "/shared/app")
-      --tls-server-name string                        If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
-      --tlsciphers string                             The list of acceptable ciphers to be used when establishing TLS connections. Use 'list' to list available ciphers. (default "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_RSA_WITH_AES_256_GCM_SHA384")
-      --tlsmaxversion string                          The maximum SSL/TLS version that is acceptable (one of: 1.0|1.1|1.2|1.3) (default "1.3")
-      --tlsminversion string                          The minimum SSL/TLS version that is acceptable (one of: 1.0|1.1|1.2|1.3) (default "1.2")
-      --token string                                  Bearer token for authentication to the API server
-      --user string                                   The name of the kubeconfig user to use
-      --username string                               Username for basic authentication to the API server
-      --x-frame-options value                         Set X-Frame-Options header in HTTP responses to value. To disable, set to "". (default "sameorigin")
+      --address string                                  Listen on given address (default "0.0.0.0")
+      --app-state-cache-expiration duration             Cache expiration for app state (default 1h0m0s)
+      --application-namespaces strings                  List of additional namespaces where application resources can be managed in
+      --as string                                       Username to impersonate for the operation
+      --as-group stringArray                            Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
+      --as-uid string                                   UID to impersonate for the operation
+      --basehref string                                 Value for base href in index.html. Used if Argo CD is running behind reverse proxy under subpath different from / (default "/")
+      --certificate-authority string                    Path to a cert file for the certificate authority
+      --client-certificate string                       Path to a client certificate file for TLS
+      --client-key string                               Path to a client key file for TLS
+      --cluster string                                  The name of the kubeconfig cluster to use
+      --connection-status-cache-expiration duration     Cache expiration for cluster/repo connection status (default 1h0m0s)
+      --content-security-policy value                   Set Content-Security-Policy header in HTTP responses to value. To disable, set to "". (default "frame-ancestors 'self';")
+      --context string                                  The name of the kubeconfig context to use
+      --default-cache-expiration duration               Cache expiration default (default 24h0m0s)
+      --dex-server string                               Dex server address (default "argocd-dex-server:5556")
+      --dex-server-plaintext                            Use a plaintext client (non-TLS) to connect to dex server
+      --dex-server-strict-tls                           Perform strict validation of TLS certificates when connecting to dex server
+      --disable-auth                                    Disable client authentication
+      --disable-compression                             If true, opt-out of response compression for all requests to the server
+      --enable-gzip                                     Enable GZIP compression (default true)
+      --enable-proxy-extension                          Enable Proxy Extension feature
+      --gloglevel int                                   Set the glog logging level
+  -h, --help                                            help for argocd-server
+      --insecure                                        Run server without TLS
+      --insecure-skip-tls-verify                        If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
+      --kubeconfig string                               Path to a kube config. Only required if out-of-cluster
+      --logformat string                                Set the logging format. One of: text|json (default "text")
+      --login-attempts-expiration duration              Cache expiration for failed login attempts (default 24h0m0s)
+      --loglevel string                                 Set the logging level. One of: debug|info|warn|error (default "info")
+      --metrics-address string                          Listen for metrics on given address (default "0.0.0.0")
+      --metrics-port int                                Start metrics on given port (default 8083)
+  -n, --namespace string                                If present, the namespace scope for this CLI request
+      --oidc-cache-expiration duration                  Cache expiration for OIDC state (default 3m0s)
+      --otlp-address string                             OpenTelemetry collector address to send traces to
+      --otlp-attrs strings                              List of OpenTelemetry collector extra attrs when send traces, each attribute is separated by a colon(e.g. key:value)
+      --otlp-headers stringToString                     List of OpenTelemetry collector extra headers sent with traces, headers are comma-separated key-value pairs(e.g. key1=value1,key2=value2) (default [])
+      --otlp-insecure                                   OpenTelemetry collector insecure mode (default true)
+      --password string                                 Password for basic authentication to the API server
+      --port int                                        Listen on given port (default 8080)
+      --proxy-url string                                If provided, this URL will be used to connect via proxy
+      --redis string                                    Redis server hostname and port (e.g. argocd-redis:6379). 
+      --redis-ca-certificate string                     Path to Redis server CA certificate (e.g. /etc/certs/redis/ca.crt). If not specified, system trusted CAs will be used for server certificate validation.
+      --redis-client-certificate string                 Path to Redis client certificate (e.g. /etc/certs/redis/client.crt).
+      --redis-client-key string                         Path to Redis client key (e.g. /etc/certs/redis/client.crt).
+      --redis-compress string                           Enable compression for data sent to Redis with the required compression algorithm. (possible values: gzip, none) (default "gzip")
+      --redis-insecure-skip-tls-verify                  Skip Redis server certificate validation.
+      --redis-use-tls                                   Use TLS when connecting to Redis. 
+      --redisdb int                                     Redis database.
+      --repo-cache-expiration duration                  Cache expiration for repo state, incl. app lists, app details, manifest generation, revision meta-data (default 24h0m0s)
+      --repo-server string                              Repo server address (default "argocd-repo-server:8081")
+      --repo-server-default-cache-expiration duration   Cache expiration default (default 24h0m0s)
+      --repo-server-plaintext                           Use a plaintext client (non-TLS) to connect to repository server
+      --repo-server-redis string                        Redis server hostname and port (e.g. argocd-redis:6379). 
+      --repo-server-redis-ca-certificate string         Path to Redis server CA certificate (e.g. /etc/certs/redis/ca.crt). If not specified, system trusted CAs will be used for server certificate validation.
+      --repo-server-redis-client-certificate string     Path to Redis client certificate (e.g. /etc/certs/redis/client.crt).
+      --repo-server-redis-client-key string             Path to Redis client key (e.g. /etc/certs/redis/client.crt).
+      --repo-server-redis-compress string               Enable compression for data sent to Redis with the required compression algorithm. (possible values: gzip, none) (default "gzip")
+      --repo-server-redis-insecure-skip-tls-verify      Skip Redis server certificate validation.
+      --repo-server-redis-use-tls                       Use TLS when connecting to Redis. 
+      --repo-server-redisdb int                         Redis database.
+      --repo-server-sentinel stringArray                Redis sentinel hostname and port (e.g. argocd-redis-ha-announce-0:6379). 
+      --repo-server-sentinelmaster string               Redis sentinel master group name. (default "master")
+      --repo-server-strict-tls                          Perform strict validation of TLS certificates when connecting to repo server
+      --repo-server-timeout-seconds int                 Repo server RPC call timeout seconds. (default 60)
+      --request-timeout string                          The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
+      --revision-cache-expiration duration              Cache expiration for cached revision (default 3m0s)
+      --rootpath string                                 Used if Argo CD is running behind reverse proxy under subpath different from /
+      --sentinel stringArray                            Redis sentinel hostname and port (e.g. argocd-redis-ha-announce-0:6379). 
+      --sentinelmaster string                           Redis sentinel master group name. (default "master")
+      --server string                                   The address and port of the Kubernetes API server
+      --staticassets string                             Directory path that contains additional static assets (default "/shared/app")
+      --tls-server-name string                          If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
+      --tlsciphers string                               The list of acceptable ciphers to be used when establishing TLS connections. Use 'list' to list available ciphers. (default "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_RSA_WITH_AES_256_GCM_SHA384")
+      --tlsmaxversion string                            The maximum SSL/TLS version that is acceptable (one of: 1.0|1.1|1.2|1.3) (default "1.3")
+      --tlsminversion string                            The minimum SSL/TLS version that is acceptable (one of: 1.0|1.1|1.2|1.3) (default "1.2")
+      --token string                                    Bearer token for authentication to the API server
+      --user string                                     The name of the kubeconfig user to use
+      --username string                                 Username for basic authentication to the API server
+      --x-frame-options value                           Set X-Frame-Options header in HTTP responses to value. To disable, set to "". (default "sameorigin")
 ```
 
 ### SEE ALSO
diff --git a/reposerver/cache/cache.go b/reposerver/cache/cache.go
index 79d3a02b62750..4437bd3ac0dd7 100644
--- a/reposerver/cache/cache.go
+++ b/reposerver/cache/cache.go
@@ -12,7 +12,6 @@ import (
 
 	"github.com/argoproj/gitops-engine/pkg/utils/text"
 	"github.com/go-git/go-git/v5/plumbing"
-	"github.com/redis/go-redis/v9"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 
@@ -44,7 +43,7 @@ func NewCache(cache *cacheutil.Cache, repoCacheExpiration time.Duration, revisio
 	return &Cache{cache, repoCacheExpiration, revisionCacheExpiration}
 }
 
-func AddCacheFlagsToCmd(cmd *cobra.Command, opts ...func(client *redis.Client)) func() (*Cache, error) {
+func AddCacheFlagsToCmd(cmd *cobra.Command, opts ...cacheutil.Options) func() (*Cache, error) {
 	var repoCacheExpiration time.Duration
 	var revisionCacheExpiration time.Duration
 
@@ -225,6 +224,12 @@ func LogDebugManifestCacheKeyFields(message string, reason string, revision stri
 	}
 }
 
+func (c *Cache) SetNewRevisionManifests(newRevision string, revision string, appSrc *appv1.ApplicationSource, srcRefs appv1.RefTargetRevisionMapping, clusterInfo ClusterRuntimeInfo, namespace string, trackingMethod string, appLabelKey string, appName string, refSourceCommitSHAs ResolvedRevisions) error {
+	oldKey := manifestCacheKey(revision, appSrc, srcRefs, namespace, trackingMethod, appLabelKey, appName, clusterInfo, refSourceCommitSHAs)
+	newKey := manifestCacheKey(newRevision, appSrc, srcRefs, namespace, trackingMethod, appLabelKey, appName, clusterInfo, refSourceCommitSHAs)
+	return c.cache.RenameItem(oldKey, newKey, c.repoCacheExpiration)
+}
+
 func (c *Cache) GetManifests(revision string, appSrc *appv1.ApplicationSource, srcRefs appv1.RefTargetRevisionMapping, clusterInfo ClusterRuntimeInfo, namespace string, trackingMethod string, appLabelKey string, appName string, res *CachedManifestResponse, refSourceCommitSHAs ResolvedRevisions) error {
 	err := c.cache.GetItem(manifestCacheKey(revision, appSrc, srcRefs, namespace, trackingMethod, appLabelKey, appName, clusterInfo, refSourceCommitSHAs), res)
 
diff --git a/server/cache/cache.go b/server/cache/cache.go
index ccbebd256be78..c2042c3f0e8d1 100644
--- a/server/cache/cache.go
+++ b/server/cache/cache.go
@@ -6,7 +6,6 @@ import (
 	"math"
 	"time"
 
-	"github.com/redis/go-redis/v9"
 	"github.com/spf13/cobra"
 
 	appv1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
@@ -33,7 +32,7 @@ func NewCache(
 	return &Cache{cache, connectionStatusCacheExpiration, oidcCacheExpiration, loginAttemptsExpiration}
 }
 
-func AddCacheFlagsToCmd(cmd *cobra.Command, opts ...func(client *redis.Client)) func() (*Cache, error) {
+func AddCacheFlagsToCmd(cmd *cobra.Command, opts ...cacheutil.Options) func() (*Cache, error) {
 	var connectionStatusCacheExpiration time.Duration
 	var oidcCacheExpiration time.Duration
 	var loginAttemptsExpiration time.Duration
diff --git a/server/server.go b/server/server.go
index 0f9b0ddadd800..6ebbc9723167f 100644
--- a/server/server.go
+++ b/server/server.go
@@ -213,6 +213,7 @@ type ArgoCDServerOpts struct {
 	AppClientset          appclientset.Interface
 	RepoClientset         repoapiclient.Clientset
 	Cache                 *servercache.Cache
+	RepoServerCache       *repocache.Cache
 	RedisClient           *redis.Client
 	TLSConfigCustomizer   tlsutil.ConfigCustomizer
 	XFrameOptions         string
@@ -1028,7 +1029,7 @@ func (a *ArgoCDServer) newHTTPServer(ctx context.Context, port int, grpcWebHandl
 
 	// Webhook handler for git events (Note: cache timeouts are hardcoded because API server does not write to cache and not really using them)
 	argoDB := db.NewDB(a.Namespace, a.settingsMgr, a.KubeClientset)
-	acdWebhookHandler := webhook.NewHandler(a.Namespace, a.ArgoCDServerOpts.ApplicationNamespaces, a.AppClientset, a.settings, a.settingsMgr, repocache.NewCache(a.Cache.GetCache(), 24*time.Hour, 3*time.Minute), a.Cache, argoDB)
+	acdWebhookHandler := webhook.NewHandler(a.Namespace, a.ArgoCDServerOpts.ApplicationNamespaces, a.AppClientset, a.settings, a.settingsMgr, a.RepoServerCache, a.Cache, argoDB)
 
 	mux.HandleFunc("/api/webhook", acdWebhookHandler.Handler)
 
diff --git a/util/cache/appstate/cache.go b/util/cache/appstate/cache.go
index d59d31befb12e..bb161a429eff9 100644
--- a/util/cache/appstate/cache.go
+++ b/util/cache/appstate/cache.go
@@ -6,7 +6,6 @@ import (
 	"sort"
 	"time"
 
-	"github.com/redis/go-redis/v9"
 	"github.com/spf13/cobra"
 
 	appv1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
@@ -29,7 +28,7 @@ func NewCache(cache *cacheutil.Cache, appStateCacheExpiration time.Duration) *Ca
 	return &Cache{cache, appStateCacheExpiration}
 }
 
-func AddCacheFlagsToCmd(cmd *cobra.Command, opts ...func(client *redis.Client)) func() (*Cache, error) {
+func AddCacheFlagsToCmd(cmd *cobra.Command, opts ...cacheutil.Options) func() (*Cache, error) {
 	var appStateCacheExpiration time.Duration
 
 	cmd.Flags().DurationVar(&appStateCacheExpiration, "app-state-cache-expiration", env.ParseDurationFromEnv("ARGOCD_APP_STATE_CACHE_EXPIRATION", 1*time.Hour, 0, 10*time.Hour), "Cache expiration for app state")
diff --git a/util/cache/cache.go b/util/cache/cache.go
index c9cb8c3b8607a..9ac058756f4ca 100644
--- a/util/cache/cache.go
+++ b/util/cache/cache.go
@@ -5,17 +5,17 @@ import (
 	"fmt"
 	"math"
 	"os"
+	"strings"
 	"time"
 
 	"crypto/tls"
 	"crypto/x509"
 
-	"github.com/redis/go-redis/v9"
-	"github.com/spf13/cobra"
-
 	"github.com/argoproj/argo-cd/v2/common"
 	certutil "github.com/argoproj/argo-cd/v2/util/cert"
 	"github.com/argoproj/argo-cd/v2/util/env"
+	"github.com/redis/go-redis/v9"
+	"github.com/spf13/cobra"
 )
 
 const (
@@ -77,8 +77,52 @@ func buildFailoverRedisClient(sentinelMaster, password, username string, redisDB
 	return client
 }
 
+type Options struct {
+	FlagPrefix      string
+	OnClientCreated func(client *redis.Client)
+}
+
+func (o *Options) callOnClientCreated(client *redis.Client) {
+	if o.OnClientCreated != nil {
+		o.OnClientCreated(client)
+	}
+}
+
+func (o *Options) getEnvPrefix() string {
+	return strings.Replace(strings.ToUpper(o.FlagPrefix), "-", "_", -1)
+}
+
+func mergeOptions(opts ...Options) Options {
+	var result Options
+	for _, o := range opts {
+		if o.FlagPrefix != "" {
+			result.FlagPrefix = o.FlagPrefix
+		}
+		if o.OnClientCreated != nil {
+			result.OnClientCreated = o.OnClientCreated
+		}
+	}
+	return result
+}
+
+func getFlagVal[T any](cmd *cobra.Command, o Options, name string, getVal func(name string) (T, error)) func() T {
+	return func() T {
+		var res T
+		var err error
+		if o.FlagPrefix != "" && cmd.Flags().Changed(o.FlagPrefix+name) {
+			res, err = getVal(o.FlagPrefix + name)
+		} else {
+			res, err = getVal(name)
+		}
+		if err != nil {
+			panic(err)
+		}
+		return res
+	}
+}
+
 // AddCacheFlagsToCmd adds flags which control caching to the specified command
-func AddCacheFlagsToCmd(cmd *cobra.Command, opts ...func(client *redis.Client)) func() (*Cache, error) {
+func AddCacheFlagsToCmd(cmd *cobra.Command, opts ...Options) func() (*Cache, error) {
 	redisAddress := ""
 	sentinelAddresses := make([]string, 0)
 	sentinelMaster := ""
@@ -89,20 +133,44 @@ func AddCacheFlagsToCmd(cmd *cobra.Command, opts ...func(client *redis.Client))
 	redisUseTLS := false
 	insecureRedis := false
 	compressionStr := ""
+	opt := mergeOptions(opts...)
 	var defaultCacheExpiration time.Duration
 
-	cmd.Flags().StringVar(&redisAddress, "redis", env.StringFromEnv("REDIS_SERVER", ""), "Redis server hostname and port (e.g. argocd-redis:6379). ")
-	cmd.Flags().IntVar(&redisDB, "redisdb", env.ParseNumFromEnv("REDISDB", 0, 0, math.MaxInt32), "Redis database.")
-	cmd.Flags().StringArrayVar(&sentinelAddresses, "sentinel", []string{}, "Redis sentinel hostname and port (e.g. argocd-redis-ha-announce-0:6379). ")
-	cmd.Flags().StringVar(&sentinelMaster, "sentinelmaster", "master", "Redis sentinel master group name.")
-	cmd.Flags().DurationVar(&defaultCacheExpiration, "default-cache-expiration", env.ParseDurationFromEnv("ARGOCD_DEFAULT_CACHE_EXPIRATION", 24*time.Hour, 0, math.MaxInt64), "Cache expiration default")
-	cmd.Flags().BoolVar(&redisUseTLS, "redis-use-tls", false, "Use TLS when connecting to Redis. ")
-	cmd.Flags().StringVar(&redisClientCertificate, "redis-client-certificate", "", "Path to Redis client certificate (e.g. /etc/certs/redis/client.crt).")
-	cmd.Flags().StringVar(&redisClientKey, "redis-client-key", "", "Path to Redis client key (e.g. /etc/certs/redis/client.crt).")
-	cmd.Flags().BoolVar(&insecureRedis, "redis-insecure-skip-tls-verify", false, "Skip Redis server certificate validation.")
-	cmd.Flags().StringVar(&redisCACertificate, "redis-ca-certificate", "", "Path to Redis server CA certificate (e.g. /etc/certs/redis/ca.crt). If not specified, system trusted CAs will be used for server certificate validation.")
-	cmd.Flags().StringVar(&compressionStr, CLIFlagRedisCompress, env.StringFromEnv("REDIS_COMPRESSION", string(RedisCompressionGZip)), "Enable compression for data sent to Redis with the required compression algorithm. (possible values: gzip, none)")
+	cmd.Flags().StringVar(&redisAddress, opt.FlagPrefix+"redis", env.StringFromEnv(opt.getEnvPrefix()+"REDIS_SERVER", ""), "Redis server hostname and port (e.g. argocd-redis:6379). ")
+	redisAddressSrc := getFlagVal(cmd, opt, "redis", cmd.Flags().GetString)
+	cmd.Flags().IntVar(&redisDB, opt.FlagPrefix+"redisdb", env.ParseNumFromEnv(opt.getEnvPrefix()+"REDISDB", 0, 0, math.MaxInt32), "Redis database.")
+	redisDBSrc := getFlagVal(cmd, opt, "redisdb", cmd.Flags().GetInt)
+	cmd.Flags().StringArrayVar(&sentinelAddresses, opt.FlagPrefix+"sentinel", []string{}, "Redis sentinel hostname and port (e.g. argocd-redis-ha-announce-0:6379). ")
+	sentinelAddressesSrc := getFlagVal(cmd, opt, "sentinel", cmd.Flags().GetStringArray)
+	cmd.Flags().StringVar(&sentinelMaster, opt.FlagPrefix+"sentinelmaster", "master", "Redis sentinel master group name.")
+	sentinelMasterSrc := getFlagVal(cmd, opt, "sentinelmaster", cmd.Flags().GetString)
+	cmd.Flags().DurationVar(&defaultCacheExpiration, opt.FlagPrefix+"default-cache-expiration", env.ParseDurationFromEnv("ARGOCD_DEFAULT_CACHE_EXPIRATION", 24*time.Hour, 0, math.MaxInt64), "Cache expiration default")
+	defaultCacheExpirationSrc := getFlagVal(cmd, opt, "default-cache-expiration", cmd.Flags().GetDuration)
+	cmd.Flags().BoolVar(&redisUseTLS, opt.FlagPrefix+"redis-use-tls", false, "Use TLS when connecting to Redis. ")
+	redisUseTLSSrc := getFlagVal(cmd, opt, "redis-use-tls", cmd.Flags().GetBool)
+	cmd.Flags().StringVar(&redisClientCertificate, opt.FlagPrefix+"redis-client-certificate", "", "Path to Redis client certificate (e.g. /etc/certs/redis/client.crt).")
+	redisClientCertificateSrc := getFlagVal(cmd, opt, "redis-client-certificate", cmd.Flags().GetString)
+	cmd.Flags().StringVar(&redisClientKey, opt.FlagPrefix+"redis-client-key", "", "Path to Redis client key (e.g. /etc/certs/redis/client.crt).")
+	redisClientKeySrc := getFlagVal(cmd, opt, "redis-client-key", cmd.Flags().GetString)
+	cmd.Flags().BoolVar(&insecureRedis, opt.FlagPrefix+"redis-insecure-skip-tls-verify", false, "Skip Redis server certificate validation.")
+	insecureRedisSrc := getFlagVal(cmd, opt, "redis-insecure-skip-tls-verify", cmd.Flags().GetBool)
+	cmd.Flags().StringVar(&redisCACertificate, opt.FlagPrefix+"redis-ca-certificate", "", "Path to Redis server CA certificate (e.g. /etc/certs/redis/ca.crt). If not specified, system trusted CAs will be used for server certificate validation.")
+	redisCACertificateSrc := getFlagVal(cmd, opt, "redis-ca-certificate", cmd.Flags().GetString)
+	cmd.Flags().StringVar(&compressionStr, opt.FlagPrefix+CLIFlagRedisCompress, env.StringFromEnv(opt.getEnvPrefix()+"REDIS_COMPRESSION", string(RedisCompressionGZip)), "Enable compression for data sent to Redis with the required compression algorithm. (possible values: gzip, none)")
+	compressionStrSrc := getFlagVal(cmd, opt, CLIFlagRedisCompress, cmd.Flags().GetString)
 	return func() (*Cache, error) {
+		redisAddress := redisAddressSrc()
+		redisDB := redisDBSrc()
+		sentinelAddresses := sentinelAddressesSrc()
+		sentinelMaster := sentinelMasterSrc()
+		defaultCacheExpiration := defaultCacheExpirationSrc()
+		redisUseTLS := redisUseTLSSrc()
+		redisClientCertificate := redisClientCertificateSrc()
+		redisClientKey := redisClientKeySrc()
+		insecureRedis := insecureRedisSrc()
+		redisCACertificate := redisCACertificateSrc()
+		compressionStr := compressionStrSrc()
+
 		var tlsConfig *tls.Config = nil
 		if redisUseTLS {
 			tlsConfig = &tls.Config{}
@@ -138,9 +206,7 @@ func AddCacheFlagsToCmd(cmd *cobra.Command, opts ...func(client *redis.Client))
 		}
 		if len(sentinelAddresses) > 0 {
 			client := buildFailoverRedisClient(sentinelMaster, password, username, redisDB, maxRetries, tlsConfig, sentinelAddresses)
-			for i := range opts {
-				opts[i](client)
-			}
+			opt.callOnClientCreated(client)
 			return NewCache(NewRedisCache(client, defaultCacheExpiration, compression)), nil
 		}
 		if redisAddress == "" {
@@ -148,9 +214,7 @@ func AddCacheFlagsToCmd(cmd *cobra.Command, opts ...func(client *redis.Client))
 		}
 
 		client := buildRedisClient(redisAddress, password, username, redisDB, maxRetries, tlsConfig)
-		for i := range opts {
-			opts[i](client)
-		}
+		opt.callOnClientCreated(client)
 		return NewCache(NewRedisCache(client, defaultCacheExpiration, compression)), nil
 	}
 }
@@ -168,6 +232,10 @@ func (c *Cache) SetClient(client CacheClient) {
 	c.client = client
 }
 
+func (c *Cache) RenameItem(oldKey string, newKey string, expiration time.Duration) error {
+	return c.client.Rename(fmt.Sprintf("%s|%s", oldKey, common.CacheVersion), fmt.Sprintf("%s|%s", newKey, common.CacheVersion), expiration)
+}
+
 func (c *Cache) SetItem(key string, item interface{}, expiration time.Duration, delete bool) error {
 	key = fmt.Sprintf("%s|%s", key, common.CacheVersion)
 	if delete {
diff --git a/util/cache/client.go b/util/cache/client.go
index 434c2a8da187a..c8c7b4a6baa80 100644
--- a/util/cache/client.go
+++ b/util/cache/client.go
@@ -17,6 +17,7 @@ type Item struct {
 
 type CacheClient interface {
 	Set(item *Item) error
+	Rename(oldKey string, newKey string, expiration time.Duration) error
 	Get(key string, obj interface{}) error
 	Delete(key string) error
 	OnUpdated(ctx context.Context, key string, callback func() error) error
diff --git a/util/cache/inmemory.go b/util/cache/inmemory.go
index f75688c275546..6d970c1d4f567 100644
--- a/util/cache/inmemory.go
+++ b/util/cache/inmemory.go
@@ -37,6 +37,16 @@ func (i *InMemoryCache) Set(item *Item) error {
 	return nil
 }
 
+func (i *InMemoryCache) Rename(oldKey string, newKey string, expiration time.Duration) error {
+	bufIf, found := i.memCache.Get(oldKey)
+	if !found {
+		return ErrCacheMiss
+	}
+	i.memCache.Set(newKey, bufIf, expiration)
+	i.memCache.Delete(oldKey)
+	return nil
+}
+
 // HasSame returns true if key with the same value already present in cache
 func (i *InMemoryCache) HasSame(key string, obj interface{}) (bool, error) {
 	var buf bytes.Buffer
diff --git a/util/cache/mocks/cacheclient.go b/util/cache/mocks/cacheclient.go
index e653847ec49a8..2fdd9fc37f8be 100644
--- a/util/cache/mocks/cacheclient.go
+++ b/util/cache/mocks/cacheclient.go
@@ -4,8 +4,9 @@ import (
 	"context"
 	"time"
 
-	cache "github.com/argoproj/argo-cd/v2/util/cache"
 	"github.com/stretchr/testify/mock"
+
+	"github.com/argoproj/argo-cd/v2/util/cache"
 )
 
 type MockCacheClient struct {
@@ -15,6 +16,14 @@ type MockCacheClient struct {
 	WriteDelay time.Duration
 }
 
+func (c *MockCacheClient) Rename(oldKey string, newKey string, expiration time.Duration) error {
+	args := c.Called(oldKey, newKey, expiration)
+	if len(args) > 0 && args.Get(0) != nil {
+		return args.Get(0).(error)
+	}
+	return c.BaseCache.Rename(oldKey, newKey, expiration)
+}
+
 func (c *MockCacheClient) Set(item *cache.Item) error {
 	args := c.Called(item)
 	if len(args) > 0 && args.Get(0) != nil {
diff --git a/util/cache/redis.go b/util/cache/redis.go
index c5365c4984e21..7d5303bb3a9fa 100644
--- a/util/cache/redis.go
+++ b/util/cache/redis.go
@@ -95,6 +95,10 @@ func (r *redisCache) unmarshal(data []byte, obj interface{}) error {
 	return nil
 }
 
+func (r *redisCache) Rename(oldKey string, newKey string, _ time.Duration) error {
+	return r.client.Rename(context.TODO(), r.getKey(oldKey), r.getKey(newKey)).Err()
+}
+
 func (r *redisCache) Set(item *Item) error {
 	expiration := item.Expiration
 	if expiration == 0 {
diff --git a/util/cache/twolevelclient.go b/util/cache/twolevelclient.go
index 14a4279e87c89..f221099844876 100644
--- a/util/cache/twolevelclient.go
+++ b/util/cache/twolevelclient.go
@@ -18,6 +18,14 @@ type twoLevelClient struct {
 	externalCache CacheClient
 }
 
+func (c *twoLevelClient) Rename(oldKey string, newKey string, expiration time.Duration) error {
+	err := c.inMemoryCache.Rename(oldKey, newKey, expiration)
+	if err != nil {
+		log.Warnf("Failed to move key '%s' in in-memory cache: %v", oldKey, err)
+	}
+	return c.externalCache.Rename(oldKey, newKey, expiration)
+}
+
 // Set stores the given value in both in-memory and external cache.
 // Skip storing the value in external cache if the same value already exists in memory to avoid requesting external cache.
 func (c *twoLevelClient) Set(item *Item) error {
diff --git a/util/webhook/webhook.go b/util/webhook/webhook.go
index 9955540ea04a9..25bd92e11802c 100644
--- a/util/webhook/webhook.go
+++ b/util/webhook/webhook.go
@@ -349,18 +349,12 @@ func (a *ArgoCDWebhookHandler) storePreviouslyCachedManifests(app *v1alpha1.Appl
 		return fmt.Errorf("error getting ref sources: %w", err)
 	}
 	source := app.Spec.GetSource()
-	cache.LogDebugManifestCacheKeyFields("getting manifests cache", "webhook app revision changed", change.shaBefore, &source, refSources, &clusterInfo, app.Spec.Destination.Namespace, trackingMethod, appInstanceLabelKey, app.Name, nil)
+	cache.LogDebugManifestCacheKeyFields("moving manifests cache", "webhook app revision changed", change.shaBefore, &source, refSources, &clusterInfo, app.Spec.Destination.Namespace, trackingMethod, appInstanceLabelKey, app.Name, nil)
 
-	var cachedManifests cache.CachedManifestResponse
-	if err := a.repoCache.GetManifests(change.shaBefore, &source, refSources, &clusterInfo, app.Spec.Destination.Namespace, trackingMethod, appInstanceLabelKey, app.Name, &cachedManifests, nil); err != nil {
+	if err := a.repoCache.SetNewRevisionManifests(change.shaAfter, change.shaBefore, &source, refSources, &clusterInfo, app.Spec.Destination.Namespace, trackingMethod, appInstanceLabelKey, app.Name, nil); err != nil {
 		return err
 	}
 
-	cache.LogDebugManifestCacheKeyFields("setting manifests cache", "webhook app revision changed", change.shaAfter, &source, refSources, &clusterInfo, app.Spec.Destination.Namespace, trackingMethod, appInstanceLabelKey, app.Name, nil)
-
-	if err = a.repoCache.SetManifests(change.shaAfter, &source, refSources, &clusterInfo, app.Spec.Destination.Namespace, trackingMethod, appInstanceLabelKey, app.Name, &cachedManifests, nil); err != nil {
-		return err
-	}
 	return nil
 }
 

From c4ac5aaa972e8080c186f9b5145114ca7217b28d Mon Sep 17 00:00:00 2001
From: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>
Date: Fri, 5 Jan 2024 15:13:35 -0500
Subject: [PATCH 03/13] docs: add context to configmap example (#16763)

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>
---
 docs/user-guide/diff-strategies.md | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/docs/user-guide/diff-strategies.md b/docs/user-guide/diff-strategies.md
index a7b3216fa7ec7..2890fe64cbb0e 100644
--- a/docs/user-guide/diff-strategies.md
+++ b/docs/user-guide/diff-strategies.md
@@ -56,7 +56,13 @@ Application.
 Add the following entry in the argocd-cmd-params-cm configmap:
 
 ```
-controller.diff.server.side: "true"
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cmd-params-cm
+data:
+  controller.diff.server.side: "true"
+...
 ```
 
 Note: It is necessary to restart the `argocd-application-controller`

From ecbd24da1074f03b49d20994e01ddaf7c0c73b27 Mon Sep 17 00:00:00 2001
From: mfreeman451 <mfreeman451@gmail.com>
Date: Fri, 5 Jan 2024 18:04:54 -0600
Subject: [PATCH 04/13] docs: Update signed-release-assets.md (#16755)

Missing \ in example

Signed-off-by: mfreeman451 <mfreeman451@gmail.com>
---
 docs/operator-manual/signed-release-assets.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/operator-manual/signed-release-assets.md b/docs/operator-manual/signed-release-assets.md
index 9aec6bb071047..b4e4f3fc97418 100644
--- a/docs/operator-manual/signed-release-assets.md
+++ b/docs/operator-manual/signed-release-assets.md
@@ -92,7 +92,7 @@ The attestation payload contains a non-forgeable provenance which is base64 enco
 ```bash
 slsa-verifier verify-image "$IMAGE" \
     --source-uri github.com/argoproj/argo-cd \
-    --source-tag v2.7.0
+    --source-tag v2.7.0 \
     --print-provenance | jq
 ```
 

From 40760eb8528766745328e67e124e2cf1f56d8d93 Mon Sep 17 00:00:00 2001
From: Lie Ryan <lie.1296@gmail.com>
Date: Mon, 8 Jan 2024 03:48:54 +1100
Subject: [PATCH 05/13] Document restarting argocd after modifying argocd-cm
 (#12405)

Signed-off-by: Lie Ryan <lie.1296@gmail.com>
Co-authored-by: Blake Pettersson <blake.pettersson@gmail.com>
---
 docs/user-guide/kustomize.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/user-guide/kustomize.md b/docs/user-guide/kustomize.md
index 9c2bf1fc655a4..647e753649cce 100644
--- a/docs/user-guide/kustomize.md
+++ b/docs/user-guide/kustomize.md
@@ -131,6 +131,9 @@ data:
     kustomize.buildOptions: --load-restrictor LoadRestrictionsNone
     kustomize.buildOptions.v4.4.0: --output /tmp
 ```
+
+After modifying `kustomize.buildOptions`, you may need to restart ArgoCD for the changes to take effect.
+
 ## Custom Kustomize versions
 
 Argo CD supports using multiple Kustomize versions simultaneously and specifies required version per application.

From c5b9c670737544f497c2f648d06e4540f568505f Mon Sep 17 00:00:00 2001
From: Alexander Matyushentsev <AMatyushentsev@gmail.com>
Date: Mon, 8 Jan 2024 16:04:46 -0800
Subject: [PATCH 06/13] fix: support specifying username/password for redis
 holding manifests in argocd-server (#16786)

Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com>
---
 util/cache/cache.go | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/util/cache/cache.go b/util/cache/cache.go
index 9ac058756f4ca..d34fba5d38f7b 100644
--- a/util/cache/cache.go
+++ b/util/cache/cache.go
@@ -199,6 +199,14 @@ func AddCacheFlagsToCmd(cmd *cobra.Command, opts ...Options) func() (*Cache, err
 		}
 		password := os.Getenv(envRedisPassword)
 		username := os.Getenv(envRedisUsername)
+		if opt.FlagPrefix != "" {
+			if val := os.Getenv(opt.getEnvPrefix() + envRedisUsername); val != "" {
+				username = val
+			}
+			if val := os.Getenv(opt.getEnvPrefix() + envRedisPassword); val != "" {
+				password = val
+			}
+		}
 		maxRetries := env.ParseNumFromEnv(envRedisRetryCount, defaultRedisRetryCount, 0, math.MaxInt32)
 		compression, err := CompressionTypeFromString(compressionStr)
 		if err != nil {

From 8ebe1cd3c441aab85c13cc03d297b846c9886b99 Mon Sep 17 00:00:00 2001
From: Ishita Sequeira <46771830+ishitasequeira@users.noreply.github.com>
Date: Mon, 8 Jan 2024 21:58:34 -0500
Subject: [PATCH 07/13] fix: add list permission deployments (#16785)

* add list permissions for deployments to application controller

Signed-off-by: ishitasequeira <ishiseq29@gmail.com>

* revert redis-ha chart changes

Signed-off-by: ishitasequeira <ishiseq29@gmail.com>

* revert redis-ha chart changes

Signed-off-by: ishitasequeira <ishiseq29@gmail.com>

---------

Signed-off-by: ishitasequeira <ishiseq29@gmail.com>
---
 .../argocd-application-controller-role.yaml               | 8 ++++++++
 manifests/core-install.yaml                               | 8 ++++++++
 manifests/ha/install.yaml                                 | 8 ++++++++
 manifests/ha/namespace-install.yaml                       | 8 ++++++++
 manifests/install.yaml                                    | 8 ++++++++
 manifests/namespace-install.yaml                          | 8 ++++++++
 6 files changed, 48 insertions(+)

diff --git a/manifests/base/application-controller/argocd-application-controller-role.yaml b/manifests/base/application-controller/argocd-application-controller-role.yaml
index 27e0bc7bfe9cb..a672268eb1dd9 100644
--- a/manifests/base/application-controller/argocd-application-controller-role.yaml
+++ b/manifests/base/application-controller/argocd-application-controller-role.yaml
@@ -36,3 +36,11 @@ rules:
   verbs:
   - create
   - list
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
diff --git a/manifests/core-install.yaml b/manifests/core-install.yaml
index c9028a44a1ae0..08d7d972e6362 100644
--- a/manifests/core-install.yaml
+++ b/manifests/core-install.yaml
@@ -20595,6 +20595,14 @@ rules:
   verbs:
   - create
   - list
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
diff --git a/manifests/ha/install.yaml b/manifests/ha/install.yaml
index 81f365bb8a86d..a7086ae8a6c06 100644
--- a/manifests/ha/install.yaml
+++ b/manifests/ha/install.yaml
@@ -20631,6 +20631,14 @@ rules:
   verbs:
   - create
   - list
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
diff --git a/manifests/ha/namespace-install.yaml b/manifests/ha/namespace-install.yaml
index ad1a7baa8b017..01a8da2ffd7b9 100644
--- a/manifests/ha/namespace-install.yaml
+++ b/manifests/ha/namespace-install.yaml
@@ -109,6 +109,14 @@ rules:
   verbs:
   - create
   - list
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
diff --git a/manifests/install.yaml b/manifests/install.yaml
index 3d1bbf942afb5..8d30e076d8bf7 100644
--- a/manifests/install.yaml
+++ b/manifests/install.yaml
@@ -20622,6 +20622,14 @@ rules:
   verbs:
   - create
   - list
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
diff --git a/manifests/namespace-install.yaml b/manifests/namespace-install.yaml
index 6fa2cdb2b6de0..76301680f195a 100644
--- a/manifests/namespace-install.yaml
+++ b/manifests/namespace-install.yaml
@@ -100,6 +100,14 @@ rules:
   verbs:
   - create
   - list
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role

From 20246596962814b732f20b8cc638156df80c4066 Mon Sep 17 00:00:00 2001
From: mugi <62197019+mugioka@users.noreply.github.com>
Date: Tue, 9 Jan 2024 12:57:27 +0900
Subject: [PATCH 08/13] chore(manifests): add ClsuterRole/ClusterRoleBinding
 for applicationset controller. (#16699)

Closes https://github.com/argoproj/argo-cd/issues/16698.

Signed-off-by: mugioka <okamugi0722@gmail.com>
---
 USERS.md                                      |  1 +
 ...applicationset-controller-clusterrole.yaml | 88 +++++++++++++++++++
 ...tionset-controller-clusterrolebinding.yaml | 16 ++++
 .../kustomization.yaml                        |  6 ++
 4 files changed, 111 insertions(+)
 create mode 100644 manifests/cluster-rbac/applicationset-controller/argocd-applicationset-controller-clusterrole.yaml
 create mode 100644 manifests/cluster-rbac/applicationset-controller/argocd-applicationset-controller-clusterrolebinding.yaml
 create mode 100644 manifests/cluster-rbac/applicationset-controller/kustomization.yaml

diff --git a/USERS.md b/USERS.md
index 9059df8450c33..60dd3b881c10b 100644
--- a/USERS.md
+++ b/USERS.md
@@ -40,6 +40,7 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Boozt](https://www.booztgroup.com/)
 1. [Boticario](https://www.boticario.com.br/)
 1. [Bulder Bank](https://bulderbank.no)
+1. [CAM](https://cam-inc.co.jp)
 1. [Camptocamp](https://camptocamp.com)
 1. [Candis](https://www.candis.io)
 1. [Capital One](https://www.capitalone.com)
diff --git a/manifests/cluster-rbac/applicationset-controller/argocd-applicationset-controller-clusterrole.yaml b/manifests/cluster-rbac/applicationset-controller/argocd-applicationset-controller-clusterrole.yaml
new file mode 100644
index 0000000000000..259a48e7aee9e
--- /dev/null
+++ b/manifests/cluster-rbac/applicationset-controller/argocd-applicationset-controller-clusterrole.yaml
@@ -0,0 +1,88 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: argocd-applicationset-controller
+    app.kubernetes.io/part-of: argocd
+    app.kubernetes.io/component: applicationset-controller
+  name: argocd-applicationset-controller
+rules:
+- apiGroups:
+  - argoproj.io
+  resources:
+  - applications
+  - applicationsets
+  - applicationsets/finalizers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - argoproj.io
+  resources:
+  - applicationsets/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - argoproj.io
+  resources:
+  - appprojects
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - create
+  - update
+  - delete
+  - get
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  - extensions
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
diff --git a/manifests/cluster-rbac/applicationset-controller/argocd-applicationset-controller-clusterrolebinding.yaml b/manifests/cluster-rbac/applicationset-controller/argocd-applicationset-controller-clusterrolebinding.yaml
new file mode 100644
index 0000000000000..820f16f472e4e
--- /dev/null
+++ b/manifests/cluster-rbac/applicationset-controller/argocd-applicationset-controller-clusterrolebinding.yaml
@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: argocd-applicationset-controller
+    app.kubernetes.io/part-of: argocd
+    app.kubernetes.io/component: applicationset-controller
+  name: argocd-applicationset-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: argocd-applicationset-controller
+subjects:
+- kind: ServiceAccount
+  name: argocd-applicationset-controller
+  namespace: argocd
diff --git a/manifests/cluster-rbac/applicationset-controller/kustomization.yaml b/manifests/cluster-rbac/applicationset-controller/kustomization.yaml
new file mode 100644
index 0000000000000..b8f18c57a14f7
--- /dev/null
+++ b/manifests/cluster-rbac/applicationset-controller/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- argocd-applicationset-controller-clusterrole.yaml
+- argocd-applicationset-controller-clusterrolebinding.yaml

From 9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205 Mon Sep 17 00:00:00 2001
From: Anand Francis Joseph <anjoseph@redhat.com>
Date: Tue, 9 Jan 2024 20:11:12 +0530
Subject: [PATCH 09/13] Added socks5 proxy support for ssh based git URL,
 upgraded go-git to 5.10.1 (#15864)

Signed-off-by: Anand Francis Joseph <anjoseph@redhat.com>
---
 Dockerfile                                    |  2 +-
 cmd/argocd/commands/repo.go                   |  6 ++
 docs/user-guide/commands/argocd_repo_add.md   |  6 ++
 go.mod                                        | 13 ++--
 go.sum                                        | 38 +++++-----
 .../application/v1alpha1/repository_types.go  |  2 +-
 util/git/client.go                            |  1 -
 util/git/creds.go                             | 24 ++++++-
 util/git/creds_test.go                        | 72 ++++++++++++++++++-
 util/git/workaround.go                        | 20 ++++++
 10 files changed, 151 insertions(+), 33 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 2c31b5077f67e..461a42305f3ae 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -51,7 +51,7 @@ RUN groupadd -g $ARGOCD_USER_ID argocd && \
     apt-get update && \
     apt-get dist-upgrade -y && \
     apt-get install -y \
-    git git-lfs tini gpg tzdata && \
+    git git-lfs tini gpg tzdata connect-proxy && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
diff --git a/cmd/argocd/commands/repo.go b/cmd/argocd/commands/repo.go
index 2bf9714a06f11..1a5b4388fbeba 100644
--- a/cmd/argocd/commands/repo.go
+++ b/cmd/argocd/commands/repo.go
@@ -64,6 +64,12 @@ func NewRepoAddCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
   # Add a Git repository via SSH on a non-default port - need to use ssh:// style URLs here
   argocd repo add ssh://git@git.example.com:2222/repos/repo --ssh-private-key-path ~/id_rsa
 
+  # Add a Git repository via SSH using socks5 proxy with no proxy credentials
+  argocd repo add ssh://git@github.com/argoproj/argocd-example-apps --ssh-private-key-path ~/id_rsa --proxy socks5://your.proxy.server.ip:1080
+
+  # Add a Git repository via SSH using socks5 proxy with proxy credentials
+  argocd repo add ssh://git@github.com/argoproj/argocd-example-apps --ssh-private-key-path ~/id_rsa --proxy socks5://username:password@your.proxy.server.ip:1080
+
   # Add a private Git repository via HTTPS using username/password and TLS client certificates:
   argocd repo add https://git.example.com/repos/repo --username git --password secret --tls-client-cert-path ~/mycert.crt --tls-client-cert-key-path ~/mycert.key
 
diff --git a/docs/user-guide/commands/argocd_repo_add.md b/docs/user-guide/commands/argocd_repo_add.md
index 263dda07af7dc..8399d48302509 100644
--- a/docs/user-guide/commands/argocd_repo_add.md
+++ b/docs/user-guide/commands/argocd_repo_add.md
@@ -17,6 +17,12 @@ argocd repo add REPOURL [flags]
   # Add a Git repository via SSH on a non-default port - need to use ssh:// style URLs here
   argocd repo add ssh://git@git.example.com:2222/repos/repo --ssh-private-key-path ~/id_rsa
 
+  # Add a Git repository via SSH using socks5 proxy with no proxy credentials
+  argocd repo add ssh://git@github.com/argoproj/argocd-example-apps --ssh-private-key-path ~/id_rsa --proxy socks5://your.proxy.server.ip:1080
+
+  # Add a Git repository via SSH using socks5 proxy with proxy credentials
+  argocd repo add ssh://git@github.com/argoproj/argocd-example-apps --ssh-private-key-path ~/id_rsa --proxy socks5://username:password@your.proxy.server.ip:1080
+
   # Add a private Git repository via HTTPS using username/password and TLS client certificates:
   argocd repo add https://git.example.com/repos/repo --username git --password secret --tls-client-cert-path ~/mycert.crt --tls-client-cert-key-path ~/mycert.key
 
diff --git a/go.mod b/go.mod
index 377f5c2592d01..07dd99e4beff1 100644
--- a/go.mod
+++ b/go.mod
@@ -28,7 +28,7 @@ require (
 	github.com/evanphx/json-patch v5.6.0+incompatible
 	github.com/fsnotify/fsnotify v1.6.0
 	github.com/gfleury/go-bitbucket-v1 v0.0.0-20220301131131-8e7ed04b843e
-	github.com/go-git/go-git/v5 v5.8.1
+	github.com/go-git/go-git/v5 v5.10.1
 	github.com/go-logr/logr v1.3.0
 	github.com/go-openapi/loads v0.21.2
 	github.com/go-openapi/runtime v0.26.0
@@ -159,9 +159,8 @@ require (
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Microsoft/go-winio v0.6.1 // indirect
 	github.com/PagerDuty/go-pagerduty v1.7.0 // indirect
-	github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 // indirect
+	github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect
 	github.com/RocketChat/Rocket.Chat.Go.SDK v0.0.0-20210112200207-10ab4d695d60 // indirect
-	github.com/acomagu/bufpipe v1.0.4 // indirect
 	github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -184,7 +183,7 @@ require (
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.4.1 // indirect
+	github.com/go-git/go-billy/v5 v5.5.0 // indirect
 	github.com/go-jose/go-jose/v3 v3.0.1 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/analysis v0.21.4 // indirect
@@ -251,7 +250,7 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sergi/go-diff v1.1.0 // indirect
 	github.com/shopspring/decimal v1.2.0 // indirect
-	github.com/skeema/knownhosts v1.2.0 // indirect
+	github.com/skeema/knownhosts v1.2.1 // indirect
 	github.com/slack-go/slack v0.12.2 // indirect
 	github.com/spf13/cast v1.5.1 // indirect
 	github.com/stretchr/objx v0.5.0 // indirect
@@ -268,11 +267,11 @@ require (
 	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
 	go.starlark.net v0.0.0-20220328144851-d1966c6b9fcd // indirect
 	golang.org/x/mod v0.12.0 // indirect
-	golang.org/x/net v0.17.0
+	golang.org/x/net v0.18.0
 	golang.org/x/sys v0.15.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.3.0
-	golang.org/x/tools v0.12.0 // indirect
+	golang.org/x/tools v0.13.0 // indirect
 	gomodules.xyz/envconfig v1.3.1-0.20190308184047-426f31af0d45 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
 	gomodules.xyz/notify v0.1.1 // indirect
diff --git a/go.sum b/go.sum
index 495bafe5b4053..0c5e889f6bdf6 100644
--- a/go.sum
+++ b/go.sum
@@ -657,8 +657,8 @@ github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAE
 github.com/PagerDuty/go-pagerduty v1.7.0 h1:S1NcMKECxT5hJwV4VT+QzeSsSiv4oWl1s2821dUqG/8=
 github.com/PagerDuty/go-pagerduty v1.7.0/go.mod h1:PuFyJKRz1liIAH4h5KVXVD18Obpp1ZXRdxHvmGXooro=
 github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8/go.mod h1:I0gYDMZ6Z5GRU7l58bNFSkPTFN6Yl12dsUlAZ8xy98g=
-github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 h1:KLq8BE0KwCL+mmXnjLWEAOYO+2l2AE4YMmqG1ZpZHBs=
-github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 h1:kkhsdkhsCvIsutKu5zLMgWtgh9YxGCNAw8Ad8hjwfYg=
+github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/RocketChat/Rocket.Chat.Go.SDK v0.0.0-20210112200207-10ab4d695d60 h1:prBTRx78AQnXzivNT9Crhu564W/zPPr3ibSlpT9xKcE=
@@ -668,8 +668,6 @@ github.com/Shopify/toxiproxy v2.1.4+incompatible/go.mod h1:OXgGpZ6Cli1/URJOF1DMx
 github.com/TomOnTime/utfutil v0.0.0-20180511104225-09c41003ee1d h1:WtAMR0fPCOfK7TPGZ8ZpLLY18HRvL7XJ3xcs0wnREgo=
 github.com/TomOnTime/utfutil v0.0.0-20180511104225-09c41003ee1d/go.mod h1:WML6KOYjeU8N6YyusMjj2qRvaPNUEvrQvaxuFcMRFJY=
 github.com/VividCortex/gohistogram v1.0.0/go.mod h1:Pf5mBqqDxYaXu3hDrrU+w6nw50o/4+TcAqDqk/vUH7g=
-github.com/acomagu/bufpipe v1.0.4 h1:e3H4WUzM3npvo5uv95QuJM3cQspFNtFBzvJ2oNjKIDQ=
-github.com/acomagu/bufpipe v1.0.4/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
 github.com/afex/hystrix-go v0.0.0-20180502004556-fa1af6a1f4f5/go.mod h1:SkGFH1ia65gfNATL8TAiHDNxPzPdmEL5uirI2Uyuz6c=
 github.com/ajstarks/deck v0.0.0-20200831202436-30c9fc6549a9/go.mod h1:JynElWSGnm/4RlzPXRlREEwqTHAN3T56Bv2ITsFT3gY=
 github.com/ajstarks/deck/generate v0.0.0-20210309230005-c3f852c02e19/go.mod h1:T13YZdzov6OU0A1+RfKZiZN9ca6VeKdBdyDV+BY97Tk=
@@ -850,8 +848,8 @@ github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21/go.mod h1
 github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
 github.com/edsrzf/mmap-go v1.0.0/go.mod h1:YO35OhQPt3KJa3ryjFM5Bs14WD66h8eGKpfaBNrHW5M=
 github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
-github.com/elazarl/goproxy v0.0.0-20221015165544-a0805db90819 h1:RIB4cRk+lBqKK3Oy0r2gRX4ui7tuhiZq2SuTtTCi0/0=
-github.com/elazarl/goproxy v0.0.0-20221015165544-a0805db90819/go.mod h1:Ro8st/ElPeALwNFlcTpWmkr6IoMFfkjXAvTHpevnDsM=
+github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a h1:mATvB/9r/3gvcejNsXKSkQ6lcIaNec2nyfOdlTBR2lU=
+github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a/go.mod h1:Ro8st/ElPeALwNFlcTpWmkr6IoMFfkjXAvTHpevnDsM=
 github.com/emicklei/go-restful/v3 v3.8.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/emicklei/go-restful/v3 v3.9.0 h1:XwGDlfxEnQZzuopoqxwSEllNcCOM9DhhFyhFIIGKwxE=
 github.com/emicklei/go-restful/v3 v3.9.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
@@ -925,12 +923,12 @@ github.com/go-fonts/liberation v0.2.0/go.mod h1:K6qoJYypsmfVjWg8KOVDQhLc8UDgIK2H
 github.com/go-fonts/stix v0.1.0/go.mod h1:w/c1f0ldAUlJmLBvlbkvVXLAD+tAMqobIIQpmnUIzUY=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.4.1 h1:Uwp5tDRkPr+l/TnbHOQzp+tmJfLceOlbVucgpTz8ix4=
-github.com/go-git/go-billy/v5 v5.4.1/go.mod h1:vjbugF6Fz7JIflbVpl1hJsGjSHNltrSw45YK/ukIvQg=
-github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20230305113008-0c11038e723f h1:Pz0DHeFij3XFhoBRGUDPzSJ+w2UcK5/0JvF8DRI58r8=
-github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20230305113008-0c11038e723f/go.mod h1:8LHG1a3SRW71ettAD/jW13h8c6AqjVSeL11RAdgaqpo=
-github.com/go-git/go-git/v5 v5.8.1 h1:Zo79E4p7TRk0xoRgMq0RShiTHGKcKI4+DI6BfJc/Q+A=
-github.com/go-git/go-git/v5 v5.8.1/go.mod h1:FHFuoD6yGz5OSKEBK+aWN9Oah0q54Jxl0abmj6GnqAo=
+github.com/go-git/go-billy/v5 v5.5.0 h1:yEY4yhzCDuMGSv83oGxiBotRzhwhNr8VZyphhiu+mTU=
+github.com/go-git/go-billy/v5 v5.5.0/go.mod h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
+github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
+github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
+github.com/go-git/go-git/v5 v5.10.1 h1:tu8/D8i+TWxgKpzQ3Vc43e+kkhXqtsZCKI/egajKnxk=
+github.com/go-git/go-git/v5 v5.10.1/go.mod h1:uEuHjxkHap8kAl//V5F/nNWwqIYtP/402ddd05mp0wg=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -1377,8 +1375,6 @@ github.com/malexdev/utfutil v0.0.0-20180510171754-00c8d4a8e7a8 h1:A6SLdFpRzUUF5v
 github.com/malexdev/utfutil v0.0.0-20180510171754-00c8d4a8e7a8/go.mod h1:UtpLyb/EupVKXF/N0b4NRe1DNg+QYJsnsHQ038romhM=
 github.com/markbates/oncer v0.0.0-20181203154359-bf2de49a0be2/go.mod h1:Ld9puTsIW75CHf65OeIOkyKbteujpZVXDpWK6YGZbxE=
 github.com/markbates/safe v1.0.1/go.mod h1:nAqgmRi7cY2nqMc92/bSEeQA+R4OheNU2T1kNSCBdG0=
-github.com/matryer/is v1.2.0 h1:92UTHpy8CDwaJ08GqLDzhhuixiBUUD1p3AU6PHddz4A=
-github.com/matryer/is v1.2.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
@@ -1498,8 +1494,9 @@ github.com/onsi/gomega v1.22.1/go.mod h1:x6n7VNe4hw0vkyYUM4mjIXx3JbLiPaBPNgB7PRQ
 github.com/onsi/gomega v1.23.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2vQAg=
 github.com/onsi/gomega v1.24.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2vQAg=
 github.com/onsi/gomega v1.24.1/go.mod h1:3AOiACssS3/MajrniINInwbfOOtfZvplPzuRSmvt1jM=
-github.com/onsi/gomega v1.25.0 h1:Vw7br2PCDYijJHSfBOWhov+8cAnUf8MfMaIOV323l6Y=
 github.com/onsi/gomega v1.25.0/go.mod h1:r+zV744Re+DiYCIPRlYOTxn0YkOLcAnW8k1xXdMPGhM=
+github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI=
+github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
 github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
@@ -1625,8 +1622,8 @@ github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic
 github.com/sirupsen/logrus v1.9.2/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/skeema/knownhosts v1.2.0 h1:h9r9cf0+u7wSE+M183ZtMGgOJKiL96brpaz5ekfJCpM=
-github.com/skeema/knownhosts v1.2.0/go.mod h1:g4fPeYpque7P0xefxtGzV81ihjC8sX2IqpAoNkjxbMo=
+github.com/skeema/knownhosts v1.2.1 h1:SHWdIUa82uGZz+F+47k8SY4QhhI291cXCpopT1lK2AQ=
+github.com/skeema/knownhosts v1.2.1/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
 github.com/skratchdot/open-golang v0.0.0-20160302144031-75fb7ed4208c h1:fyKiXKO1/I/B6Y2U8T7WdQGWzwehOuGIrljPtt7YTTI=
 github.com/skratchdot/open-golang v0.0.0-20160302144031-75fb7ed4208c/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
 github.com/slack-go/slack v0.12.2 h1:x3OppyMyGIbbiyFhsBmpf9pwkUzMhthJMRNmNlA4LaQ=
@@ -1962,8 +1959,9 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ=
 golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
 golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/net v0.18.0 h1:mIYleuAkSbHh0tCv7RvjL3F6ZVbLjq4+R7zbOn3Kokg=
+golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -2263,8 +2261,8 @@ golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
 golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
-golang.org/x/tools v0.12.0 h1:YW6HUoUmYBpwSgyaGaZq1fHjrBjX1rlpZ54T6mu2kss=
-golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
+golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/pkg/apis/application/v1alpha1/repository_types.go b/pkg/apis/application/v1alpha1/repository_types.go
index 31e8c47971414..3a557813d87c6 100644
--- a/pkg/apis/application/v1alpha1/repository_types.go
+++ b/pkg/apis/application/v1alpha1/repository_types.go
@@ -196,7 +196,7 @@ func (repo *Repository) GetGitCreds(store git.CredsStore) git.Creds {
 		return git.NewHTTPSCreds(repo.Username, repo.Password, repo.TLSClientCertData, repo.TLSClientCertKey, repo.IsInsecure(), repo.Proxy, store, repo.ForceHttpBasicAuth)
 	}
 	if repo.SSHPrivateKey != "" {
-		return git.NewSSHCreds(repo.SSHPrivateKey, getCAPath(repo.Repo), repo.IsInsecure(), store)
+		return git.NewSSHCreds(repo.SSHPrivateKey, getCAPath(repo.Repo), repo.IsInsecure(), store, repo.Proxy)
 	}
 	if repo.GithubAppPrivateKey != "" && repo.GithubAppId != 0 && repo.GithubAppInstallationId != 0 {
 		return git.NewGitHubAppCreds(repo.GithubAppId, repo.GithubAppInstallationId, repo.GithubAppPrivateKey, repo.GitHubAppEnterpriseBaseURL, repo.Repo, repo.TLSClientCertData, repo.TLSClientCertKey, repo.IsInsecure(), repo.Proxy, store)
diff --git a/util/git/client.go b/util/git/client.go
index 6a8828d13f432..73c85b54f3c1f 100644
--- a/util/git/client.go
+++ b/util/git/client.go
@@ -741,7 +741,6 @@ func (m *nativeGitClient) runCmdOutput(cmd *exec.Cmd, ropts runOpts) (string, er
 			}
 		}
 	}
-
 	cmd.Env = proxy.UpsertEnv(cmd, m.proxy)
 	opts := executil.ExecRunOpts{
 		TimeoutBehavior: argoexec.TimeoutBehavior{
diff --git a/util/git/creds.go b/util/git/creds.go
index c3d09574eeb84..18698449082bf 100644
--- a/util/git/creds.go
+++ b/util/git/creds.go
@@ -8,6 +8,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net/url"
 	"os"
 	"strconv"
 	"strings"
@@ -241,10 +242,11 @@ type SSHCreds struct {
 	caPath        string
 	insecure      bool
 	store         CredsStore
+	proxy         string
 }
 
-func NewSSHCreds(sshPrivateKey string, caPath string, insecureIgnoreHostKey bool, store CredsStore) SSHCreds {
-	return SSHCreds{sshPrivateKey, caPath, insecureIgnoreHostKey, store}
+func NewSSHCreds(sshPrivateKey string, caPath string, insecureIgnoreHostKey bool, store CredsStore, proxy string) SSHCreds {
+	return SSHCreds{sshPrivateKey, caPath, insecureIgnoreHostKey, store, proxy}
 }
 
 type sshPrivateKeyFile string
@@ -303,7 +305,25 @@ func (c SSHCreds) Environ() (io.Closer, []string, error) {
 		knownHostsFile := certutil.GetSSHKnownHostsDataPath()
 		args = append(args, "-o", "StrictHostKeyChecking=yes", "-o", fmt.Sprintf("UserKnownHostsFile=%s", knownHostsFile))
 	}
+	// Handle SSH socks5 proxy settings
+	proxyEnv := []string{}
+	if c.proxy != "" {
+		parsedProxyURL, err := url.Parse(c.proxy)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to set environment variables related to socks5 proxy, could not parse proxy URL '%s': %w", c.proxy, err)
+		}
+		args = append(args, "-o", fmt.Sprintf("ProxyCommand='connect-proxy -S %s:%s -5 %%h %%p'",
+			parsedProxyURL.Hostname(),
+			parsedProxyURL.Port()))
+		if parsedProxyURL.User != nil {
+			proxyEnv = append(proxyEnv, fmt.Sprintf("SOCKS5_USER=%s", parsedProxyURL.User.Username()))
+			if socks5_passwd, isPasswdSet := parsedProxyURL.User.Password(); isPasswdSet {
+				proxyEnv = append(proxyEnv, fmt.Sprintf("SOCKS5_PASSWD=%s", socks5_passwd))
+			}
+		}
+	}
 	env = append(env, []string{fmt.Sprintf("GIT_SSH_COMMAND=%s", strings.Join(args, " "))}...)
+	env = append(env, proxyEnv...)
 	return sshPrivateKeyFile(file.Name()), env, nil
 }
 
diff --git a/util/git/creds_test.go b/util/git/creds_test.go
index 40cc39c10f1bc..23a705ed33574 100644
--- a/util/git/creds_test.go
+++ b/util/git/creds_test.go
@@ -205,7 +205,7 @@ func Test_SSHCreds_Environ(t *testing.T) {
 		caFile := path.Join(tempDir, "caFile")
 		err := os.WriteFile(caFile, []byte(""), os.FileMode(0600))
 		require.NoError(t, err)
-		creds := NewSSHCreds("sshPrivateKey", caFile, insecureIgnoreHostKey, &NoopCredsStore{})
+		creds := NewSSHCreds("sshPrivateKey", caFile, insecureIgnoreHostKey, &NoopCredsStore{}, "")
 		closer, env, err := creds.Environ()
 		require.NoError(t, err)
 		require.Len(t, env, 2)
@@ -232,6 +232,76 @@ func Test_SSHCreds_Environ(t *testing.T) {
 	}
 }
 
+func Test_SSHCreds_Environ_WithProxy(t *testing.T) {
+	for _, insecureIgnoreHostKey := range []bool{false, true} {
+		tempDir := t.TempDir()
+		caFile := path.Join(tempDir, "caFile")
+		err := os.WriteFile(caFile, []byte(""), os.FileMode(0600))
+		require.NoError(t, err)
+		creds := NewSSHCreds("sshPrivateKey", caFile, insecureIgnoreHostKey, &NoopCredsStore{}, "socks5://127.0.0.1:1080")
+		closer, env, err := creds.Environ()
+		require.NoError(t, err)
+		require.Len(t, env, 2)
+
+		assert.Equal(t, fmt.Sprintf("GIT_SSL_CAINFO=%s/caFile", tempDir), env[0], "CAINFO env var must be set")
+
+		assert.True(t, strings.HasPrefix(env[1], "GIT_SSH_COMMAND="))
+
+		if insecureIgnoreHostKey {
+			assert.Contains(t, env[1], "-o StrictHostKeyChecking=no")
+			assert.Contains(t, env[1], "-o UserKnownHostsFile=/dev/null")
+		} else {
+			assert.Contains(t, env[1], "-o StrictHostKeyChecking=yes")
+			hostsPath := cert.GetSSHKnownHostsDataPath()
+			assert.Contains(t, env[1], fmt.Sprintf("-o UserKnownHostsFile=%s", hostsPath))
+		}
+		assert.Contains(t, env[1], "-o ProxyCommand='connect-proxy -S 127.0.0.1:1080 -5 %h %p'")
+
+		envRegex := regexp.MustCompile("-i ([^ ]+)")
+		assert.Regexp(t, envRegex, env[1])
+		privateKeyFile := envRegex.FindStringSubmatch(env[1])[1]
+		assert.FileExists(t, privateKeyFile)
+		io.Close(closer)
+		assert.NoFileExists(t, privateKeyFile)
+	}
+}
+
+func Test_SSHCreds_Environ_WithProxyUserNamePassword(t *testing.T) {
+	for _, insecureIgnoreHostKey := range []bool{false, true} {
+		tempDir := t.TempDir()
+		caFile := path.Join(tempDir, "caFile")
+		err := os.WriteFile(caFile, []byte(""), os.FileMode(0600))
+		require.NoError(t, err)
+		creds := NewSSHCreds("sshPrivateKey", caFile, insecureIgnoreHostKey, &NoopCredsStore{}, "socks5://user:password@127.0.0.1:1080")
+		closer, env, err := creds.Environ()
+		require.NoError(t, err)
+		require.Len(t, env, 4)
+
+		assert.Equal(t, fmt.Sprintf("GIT_SSL_CAINFO=%s/caFile", tempDir), env[0], "CAINFO env var must be set")
+
+		assert.True(t, strings.HasPrefix(env[1], "GIT_SSH_COMMAND="))
+		assert.Equal(t, "SOCKS5_USER=user", env[2], "SOCKS5 user env var must be set")
+		assert.Equal(t, "SOCKS5_PASSWD=password", env[3], "SOCKS5 password env var must be set")
+
+		if insecureIgnoreHostKey {
+			assert.Contains(t, env[1], "-o StrictHostKeyChecking=no")
+			assert.Contains(t, env[1], "-o UserKnownHostsFile=/dev/null")
+		} else {
+			assert.Contains(t, env[1], "-o StrictHostKeyChecking=yes")
+			hostsPath := cert.GetSSHKnownHostsDataPath()
+			assert.Contains(t, env[1], fmt.Sprintf("-o UserKnownHostsFile=%s", hostsPath))
+		}
+		assert.Contains(t, env[1], "-o ProxyCommand='connect-proxy -S 127.0.0.1:1080 -5 %h %p'")
+
+		envRegex := regexp.MustCompile("-i ([^ ]+)")
+		assert.Regexp(t, envRegex, env[1])
+		privateKeyFile := envRegex.FindStringSubmatch(env[1])[1]
+		assert.FileExists(t, privateKeyFile)
+		io.Close(closer)
+		assert.NoFileExists(t, privateKeyFile)
+	}
+}
+
 const gcpServiceAccountKeyJSON = `{
   "type": "service_account",
   "project_id": "my-google-project",
diff --git a/util/git/workaround.go b/util/git/workaround.go
index c364c093c853e..47636125cf349 100644
--- a/util/git/workaround.go
+++ b/util/git/workaround.go
@@ -1,6 +1,9 @@
 package git
 
 import (
+	"fmt"
+	neturl "net/url"
+
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/transport"
@@ -30,6 +33,23 @@ func newClient(url string, insecure bool, creds Creds, proxy string) (transport.
 
 	if !IsHTTPSURL(url) && !IsHTTPURL(url) {
 		// use the default client for protocols other than HTTP/HTTPS
+		ep.InsecureSkipTLS = insecure
+		if proxy != "" {
+			parsedProxyURL, err := neturl.Parse(proxy)
+			if err != nil {
+				return nil, nil, fmt.Errorf("failed to create client for url '%s', error parsing proxy url '%s': %w", url, proxy, err)
+			}
+			var proxyUsername, proxyPasswd string
+			if parsedProxyURL.User != nil {
+				proxyUsername = parsedProxyURL.User.Username()
+				proxyPasswd, _ = parsedProxyURL.User.Password()
+			}
+			ep.Proxy = transport.ProxyOptions{
+				URL:      fmt.Sprintf("%s://%s:%s", parsedProxyURL.Scheme, parsedProxyURL.Hostname(), parsedProxyURL.Port()),
+				Username: proxyUsername,
+				Password: proxyPasswd,
+			}
+		}
 		c, err := client.NewClient(ep)
 		if err != nil {
 			return nil, nil, err

From d6da9f2a15fba708d70531c5b3f2797663fb3c08 Mon Sep 17 00:00:00 2001
From: Mahesh Kasbe <60398112+maheshkasabe@users.noreply.github.com>
Date: Wed, 10 Jan 2024 07:35:07 +0530
Subject: [PATCH 10/13] Added Openkruise workload integration health check
 scripts (#16238)

Signed-off-by: Mahesh <maheshkasbe010@gmail.com>
Co-authored-by: Ishita Sequeira <46771830+ishitasequeira@users.noreply.github.com>
---
 .../apps.kruise.io/AdvancedCronJob/health.lua | 36 ++++++++++++
 .../AdvancedCronJob/health_test.yaml          | 17 ++++++
 .../AdvancedCronJob/testdata/activeJobs.yaml  | 30 ++++++++++
 .../testdata/lastScheduleTime.yaml            | 23 ++++++++
 .../testdata/notScheduled.yaml                | 22 ++++++++
 .../AdvancedCronJob/testdata/suspended.yaml   | 23 ++++++++
 .../apps.kruise.io/BroadcastJob/health.lua    | 32 +++++++++++
 .../BroadcastJob/health_test.yaml             | 17 ++++++
 .../BroadcastJob/testdata/failed.yaml         | 31 ++++++++++
 .../BroadcastJob/testdata/running.yaml        | 22 ++++++++
 .../BroadcastJob/testdata/succeeded.yaml      | 31 ++++++++++
 .../BroadcastJob/testdata/suspended.yaml      | 31 ++++++++++
 .../apps.kruise.io/CloneSet/health.lua        | 33 +++++++++++
 .../apps.kruise.io/CloneSet/health_test.yaml  | 21 +++++++
 .../CloneSet/testdata/degraded.yaml           | 35 ++++++++++++
 .../CloneSet/testdata/healthy.yaml            | 36 ++++++++++++
 .../testdata/partition_suspended.yaml         | 31 ++++++++++
 .../CloneSet/testdata/suspended.yaml          | 35 ++++++++++++
 .../CloneSet/testdata/unknown.yaml            |  5 ++
 .../apps.kruise.io/DaemonSet/health.lua       | 35 ++++++++++++
 .../apps.kruise.io/DaemonSet/health_test.yaml | 21 +++++++
 .../DaemonSet/testdata/degraded.yaml          | 34 +++++++++++
 .../DaemonSet/testdata/healthy.yaml           | 34 +++++++++++
 .../testdata/partition_suspended.yaml         | 33 +++++++++++
 .../DaemonSet/testdata/suspended.yaml         | 33 +++++++++++
 .../DaemonSet/testdata/unknown.yaml           |  5 ++
 .../apps.kruise.io/StatefulSet/health.lua     | 35 ++++++++++++
 .../StatefulSet/health_test.yaml              | 21 +++++++
 .../StatefulSet/testdata/degraded.yaml        | 42 ++++++++++++++
 .../StatefulSet/testdata/healthy.yaml         | 41 ++++++++++++++
 .../testdata/partition_suspended.yaml         | 36 ++++++++++++
 .../StatefulSet/testdata/suspended.yaml       | 36 ++++++++++++
 .../StatefulSet/testdata/unknown.yaml         |  5 ++
 .../rollouts.kruise.io/Rollout/health.lua     | 31 ++++++++++
 .../Rollout/health_test.yaml                  | 17 ++++++
 .../Rollout/testdata/degraded.yaml            | 50 +++++++++++++++++
 .../Rollout/testdata/healthy.yaml             | 56 +++++++++++++++++++
 .../Rollout/testdata/progressing.yaml         | 48 ++++++++++++++++
 .../Rollout/testdata/suspended.yaml           | 50 +++++++++++++++++
 39 files changed, 1174 insertions(+)
 create mode 100644 resource_customizations/apps.kruise.io/AdvancedCronJob/health.lua
 create mode 100644 resource_customizations/apps.kruise.io/AdvancedCronJob/health_test.yaml
 create mode 100644 resource_customizations/apps.kruise.io/AdvancedCronJob/testdata/activeJobs.yaml
 create mode 100644 resource_customizations/apps.kruise.io/AdvancedCronJob/testdata/lastScheduleTime.yaml
 create mode 100644 resource_customizations/apps.kruise.io/AdvancedCronJob/testdata/notScheduled.yaml
 create mode 100644 resource_customizations/apps.kruise.io/AdvancedCronJob/testdata/suspended.yaml
 create mode 100644 resource_customizations/apps.kruise.io/BroadcastJob/health.lua
 create mode 100644 resource_customizations/apps.kruise.io/BroadcastJob/health_test.yaml
 create mode 100644 resource_customizations/apps.kruise.io/BroadcastJob/testdata/failed.yaml
 create mode 100644 resource_customizations/apps.kruise.io/BroadcastJob/testdata/running.yaml
 create mode 100644 resource_customizations/apps.kruise.io/BroadcastJob/testdata/succeeded.yaml
 create mode 100644 resource_customizations/apps.kruise.io/BroadcastJob/testdata/suspended.yaml
 create mode 100644 resource_customizations/apps.kruise.io/CloneSet/health.lua
 create mode 100644 resource_customizations/apps.kruise.io/CloneSet/health_test.yaml
 create mode 100644 resource_customizations/apps.kruise.io/CloneSet/testdata/degraded.yaml
 create mode 100644 resource_customizations/apps.kruise.io/CloneSet/testdata/healthy.yaml
 create mode 100644 resource_customizations/apps.kruise.io/CloneSet/testdata/partition_suspended.yaml
 create mode 100644 resource_customizations/apps.kruise.io/CloneSet/testdata/suspended.yaml
 create mode 100644 resource_customizations/apps.kruise.io/CloneSet/testdata/unknown.yaml
 create mode 100644 resource_customizations/apps.kruise.io/DaemonSet/health.lua
 create mode 100644 resource_customizations/apps.kruise.io/DaemonSet/health_test.yaml
 create mode 100644 resource_customizations/apps.kruise.io/DaemonSet/testdata/degraded.yaml
 create mode 100644 resource_customizations/apps.kruise.io/DaemonSet/testdata/healthy.yaml
 create mode 100644 resource_customizations/apps.kruise.io/DaemonSet/testdata/partition_suspended.yaml
 create mode 100644 resource_customizations/apps.kruise.io/DaemonSet/testdata/suspended.yaml
 create mode 100644 resource_customizations/apps.kruise.io/DaemonSet/testdata/unknown.yaml
 create mode 100644 resource_customizations/apps.kruise.io/StatefulSet/health.lua
 create mode 100644 resource_customizations/apps.kruise.io/StatefulSet/health_test.yaml
 create mode 100644 resource_customizations/apps.kruise.io/StatefulSet/testdata/degraded.yaml
 create mode 100644 resource_customizations/apps.kruise.io/StatefulSet/testdata/healthy.yaml
 create mode 100644 resource_customizations/apps.kruise.io/StatefulSet/testdata/partition_suspended.yaml
 create mode 100644 resource_customizations/apps.kruise.io/StatefulSet/testdata/suspended.yaml
 create mode 100644 resource_customizations/apps.kruise.io/StatefulSet/testdata/unknown.yaml
 create mode 100644 resource_customizations/rollouts.kruise.io/Rollout/health.lua
 create mode 100644 resource_customizations/rollouts.kruise.io/Rollout/health_test.yaml
 create mode 100644 resource_customizations/rollouts.kruise.io/Rollout/testdata/degraded.yaml
 create mode 100644 resource_customizations/rollouts.kruise.io/Rollout/testdata/healthy.yaml
 create mode 100644 resource_customizations/rollouts.kruise.io/Rollout/testdata/progressing.yaml
 create mode 100644 resource_customizations/rollouts.kruise.io/Rollout/testdata/suspended.yaml

diff --git a/resource_customizations/apps.kruise.io/AdvancedCronJob/health.lua b/resource_customizations/apps.kruise.io/AdvancedCronJob/health.lua
new file mode 100644
index 0000000000000..1e68d862722e1
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/AdvancedCronJob/health.lua
@@ -0,0 +1,36 @@
+hs = { status = "Progressing", message = "AdvancedCronJobs has active jobs" }
+-- Extract lastScheduleTime and convert to time objects
+lastScheduleTime = nil
+
+if obj.status.lastScheduleTime ~= nil then
+  local year, month, day, hour, min, sec = string.match(obj.status.lastScheduleTime, "(%d+)-(%d+)-(%d+)T(%d+):(%d+):(%d+)Z")
+  lastScheduleTime = os.time({year=year, month=month, day=day, hour=hour, min=min, sec=sec})
+end
+
+
+if lastScheduleTime == nil and obj.spec.paused == true then 
+    hs.status = "Suspended"
+    hs.message = "AdvancedCronJob is Paused"
+    return hs
+end
+
+-- AdvancedCronJobs are progressing if they have any object in the "active" state
+if obj.status.active ~= nil and #obj.status.active > 0 then
+    hs.status = "Progressing"
+    hs.message = "AdvancedCronJobs has active jobs"
+    return hs
+end
+-- AdvancedCronJobs are Degraded if they don't have lastScheduleTime
+if lastScheduleTime == nil then
+    hs.status = "Degraded"
+    hs.message = "AdvancedCronJobs has not run successfully"
+    return hs
+end
+-- AdvancedCronJobs are healthy if they have lastScheduleTime
+if lastScheduleTime ~= nil then
+    hs.status = "Healthy"
+    hs.message = "AdvancedCronJobs has run successfully"
+    return hs
+end
+
+return hs
diff --git a/resource_customizations/apps.kruise.io/AdvancedCronJob/health_test.yaml b/resource_customizations/apps.kruise.io/AdvancedCronJob/health_test.yaml
new file mode 100644
index 0000000000000..939c701955abb
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/AdvancedCronJob/health_test.yaml
@@ -0,0 +1,17 @@
+tests:
+  - healthStatus:
+      status: Healthy
+      message: AdvancedCronJobs has run successfully
+    inputPath: testdata/lastScheduleTime.yaml
+  - healthStatus:
+      status: Degraded
+      message: AdvancedCronJobs has not run successfully
+    inputPath: testdata/notScheduled.yaml
+  - healthStatus:
+      status: Progressing
+      message: AdvancedCronJobs has active jobs
+    inputPath: testdata/activeJobs.yaml
+  - healthStatus:
+      status: Suspended
+      message: AdvancedCronJob is Paused
+    inputPath: testdata/suspended.yaml
diff --git a/resource_customizations/apps.kruise.io/AdvancedCronJob/testdata/activeJobs.yaml b/resource_customizations/apps.kruise.io/AdvancedCronJob/testdata/activeJobs.yaml
new file mode 100644
index 0000000000000..5748143874d5e
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/AdvancedCronJob/testdata/activeJobs.yaml
@@ -0,0 +1,30 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: AdvancedCronJob
+metadata:
+  name: acj-test
+spec:
+  schedule: "*/1 * * * *"
+  template:
+    broadcastJobTemplate:
+      spec:
+        template:
+          spec:
+            containers:
+              - name: pi
+                image: perl
+                command: ["perl",  "-Mbignum=bpi", "-wle", "print bpi(2000)"]
+            restartPolicy: Never
+        completionPolicy:
+          type: Always
+          ttlSecondsAfterFinished: 30
+
+status:
+  active:
+    - apiVersion: apps.kruise.io/v1alpha1
+      kind: BroadcastJob
+      name: acj-test-1694882400
+      namespace: default
+      resourceVersion: '4012'
+      uid: 2b08a429-a43b-4382-8e5d-3db0c72b5b13
+  lastScheduleTime: '2023-09-16T16:40:00Z'
+  type: BroadcastJob
diff --git a/resource_customizations/apps.kruise.io/AdvancedCronJob/testdata/lastScheduleTime.yaml b/resource_customizations/apps.kruise.io/AdvancedCronJob/testdata/lastScheduleTime.yaml
new file mode 100644
index 0000000000000..bf48bdba777dc
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/AdvancedCronJob/testdata/lastScheduleTime.yaml
@@ -0,0 +1,23 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: AdvancedCronJob
+metadata:
+  name: acj-test
+spec:
+  schedule: "*/1 * * * *"
+  template:
+    broadcastJobTemplate:
+      spec:
+        template:
+          spec:
+            containers:
+              - name: pi
+                image: perl
+                command: ["perl",  "-Mbignum=bpi", "-wle", "print bpi(2000)"]
+            restartPolicy: Never
+        completionPolicy:
+          type: Always
+          ttlSecondsAfterFinished: 30
+
+status:
+  lastScheduleTime: "2023-09-16T16:29:00Z"
+  type: BroadcastJob
diff --git a/resource_customizations/apps.kruise.io/AdvancedCronJob/testdata/notScheduled.yaml b/resource_customizations/apps.kruise.io/AdvancedCronJob/testdata/notScheduled.yaml
new file mode 100644
index 0000000000000..cc8a9dd436d80
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/AdvancedCronJob/testdata/notScheduled.yaml
@@ -0,0 +1,22 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: AdvancedCronJob
+metadata:
+  name: acj-test
+spec:
+  schedule: "*/1 * * * *"
+  template:
+    broadcastJobTemplate:
+      spec:
+        template:
+          spec:
+            containers:
+              - name: pi
+                image: perl
+                command: ["perl",  "-Mbignum=bpi", "-wle", "print bpi(2000)"]
+            restartPolicy: Never
+        completionPolicy:
+          type: Always
+          ttlSecondsAfterFinished: 30
+
+status:
+  lastScheduleTime: null
diff --git a/resource_customizations/apps.kruise.io/AdvancedCronJob/testdata/suspended.yaml b/resource_customizations/apps.kruise.io/AdvancedCronJob/testdata/suspended.yaml
new file mode 100644
index 0000000000000..dc79f1b41218b
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/AdvancedCronJob/testdata/suspended.yaml
@@ -0,0 +1,23 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: AdvancedCronJob
+metadata:
+  name: acj-test
+spec:
+  schedule: "*/1 * * * *"
+  template:
+    broadcastJobTemplate:
+      spec:
+        template:
+          spec:
+            containers:
+              - name: pi
+                image: perl
+                command: ["perl",  "-Mbignum=bpi", "-wle", "print bpi(2000)"]
+            restartPolicy: Never
+        completionPolicy:
+          type: Always
+          ttlSecondsAfterFinished: 30
+  paused: true
+
+status:
+  type: BroadcastJob
diff --git a/resource_customizations/apps.kruise.io/BroadcastJob/health.lua b/resource_customizations/apps.kruise.io/BroadcastJob/health.lua
new file mode 100644
index 0000000000000..3b20ca8849975
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/BroadcastJob/health.lua
@@ -0,0 +1,32 @@
+hs={ status= "Progressing", message= "BroadcastJob is still running" }
+
+if obj.status ~= nil then 
+
+-- BroadcastJob are healthy if desired number and succeeded number is equal
+    if obj.status.desired == obj.status.succeeded and obj.status.phase == "completed" then 
+        hs.status = "Healthy"
+        hs.message = "BroadcastJob is completed successfully"
+        return hs
+    end
+-- BroadcastJob are progressing if active is not equal to 0
+    if obj.status.active ~= 0 and obj.status.phase == "running" then
+        hs.status = "Progressing"
+        hs.message = "BroadcastJob is still running"
+        return hs
+    end
+-- BroadcastJob are progressing if failed is not equal to 0
+    if obj.status.failed ~= 0  and obj.status.phase == "failed" then
+        hs.status = "Degraded"
+        hs.message = "BroadcastJob failed"
+        return hs
+    end
+
+    if obj.status.phase == "paused" and obj.spec.paused == true then 
+        hs.status = "Suspended"
+        hs.message = "BroadcastJob is Paused"
+        return hs
+    end
+
+end
+
+return hs
diff --git a/resource_customizations/apps.kruise.io/BroadcastJob/health_test.yaml b/resource_customizations/apps.kruise.io/BroadcastJob/health_test.yaml
new file mode 100644
index 0000000000000..e3e16e22bfeef
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/BroadcastJob/health_test.yaml
@@ -0,0 +1,17 @@
+tests:
+  - healthStatus:
+      status: Healthy
+      message: "BroadcastJob is completed successfully"
+    inputPath: testdata/succeeded.yaml
+  - healthStatus:
+      status: Degraded
+      message: "BroadcastJob failed"
+    inputPath: testdata/failed.yaml
+  - healthStatus:
+      status: Progressing
+      message: "BroadcastJob is still running"
+    inputPath: testdata/running.yaml
+  - healthStatus:
+      status: Suspended
+      message: "BroadcastJob is Paused"
+    inputPath: testdata/suspended.yaml
diff --git a/resource_customizations/apps.kruise.io/BroadcastJob/testdata/failed.yaml b/resource_customizations/apps.kruise.io/BroadcastJob/testdata/failed.yaml
new file mode 100644
index 0000000000000..88b85cae28189
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/BroadcastJob/testdata/failed.yaml
@@ -0,0 +1,31 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: BroadcastJob
+metadata:
+  name: failed-job
+spec:
+  template:
+    spec:
+      containers:
+        - name: guestbook
+          image: openkruise/guestbook:v3
+          command: ["exit",  "1"] # a dummy command to fail
+      restartPolicy: Never
+  completionPolicy:
+    type: Always
+    ttlSecondsAfterFinished: 60 # the job will be deleted after 60 seconds
+
+status:
+  active: 0
+  completionTime: '2023-09-17T14:31:38Z'
+  conditions:
+    - lastProbeTime: '2023-09-17T14:31:38Z'
+      lastTransitionTime: '2023-09-17T14:31:38Z'
+      message: failure policy is FailurePolicyTypeFailFast and failed pod is found
+      reason: Failed
+      status: 'True'
+      type: Failed
+  desired: 1
+  failed: 1
+  phase: failed
+  startTime: '2023-09-17T14:31:32Z'
+  succeeded: 0
diff --git a/resource_customizations/apps.kruise.io/BroadcastJob/testdata/running.yaml b/resource_customizations/apps.kruise.io/BroadcastJob/testdata/running.yaml
new file mode 100644
index 0000000000000..f679fa3ee0d50
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/BroadcastJob/testdata/running.yaml
@@ -0,0 +1,22 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: BroadcastJob
+metadata:
+  name: download-image
+spec:
+  template:
+    spec:
+      containers:
+        - name: guestbook
+          image: openkruise/guestbook:v3
+          command: ["echo",  "started"] # a dummy command to do nothing
+      restartPolicy: Never
+  completionPolicy:
+    type: Always
+    ttlSecondsAfterFinished: 60 # the job will be deleted after 60 seconds
+status:
+  active: 1
+  desired: 1
+  failed: 0
+  phase: running
+  startTime: '2023-09-17T14:43:30Z'
+  succeeded: 0
diff --git a/resource_customizations/apps.kruise.io/BroadcastJob/testdata/succeeded.yaml b/resource_customizations/apps.kruise.io/BroadcastJob/testdata/succeeded.yaml
new file mode 100644
index 0000000000000..61746b20cd907
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/BroadcastJob/testdata/succeeded.yaml
@@ -0,0 +1,31 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: BroadcastJob
+metadata:
+  name: download-image
+spec:
+  template:
+    spec:
+      containers:
+        - name: guestbook
+          image: openkruise/guestbook:v3
+          command: ["echo",  "started"] # a dummy command to do nothing
+      restartPolicy: Never
+  completionPolicy:
+    type: Always
+    ttlSecondsAfterFinished: 60 # the job will be deleted after 60 seconds
+status:
+  active: 0
+  completionTime: '2023-09-17T14:35:14Z'
+  conditions:
+    - lastProbeTime: '2023-09-17T14:35:14Z'
+      lastTransitionTime: '2023-09-17T14:35:14Z'
+      message: Job completed, 1 pods succeeded, 0 pods failed
+      reason: Complete
+      status: 'True'
+      type: Complete
+  desired: 1
+  failed: 0
+  phase: completed
+  startTime: '2023-09-17T14:35:07Z'
+  succeeded: 1
+
diff --git a/resource_customizations/apps.kruise.io/BroadcastJob/testdata/suspended.yaml b/resource_customizations/apps.kruise.io/BroadcastJob/testdata/suspended.yaml
new file mode 100644
index 0000000000000..60a9b587b8ec0
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/BroadcastJob/testdata/suspended.yaml
@@ -0,0 +1,31 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: BroadcastJob
+metadata:
+  name: download-image
+spec:
+  template:
+    spec:
+      containers:
+        - name: guestbook
+          image: openkruise/guestbook:v3
+          command: ["echo",  "started"] # a dummy command to do nothing
+      restartPolicy: Never
+  paused: true
+  completionPolicy:
+    type: Always
+    ttlSecondsAfterFinished: 60 # the job will be deleted after 60 seconds
+status:
+  active: 0
+  completionTime: '2023-09-17T14:35:14Z'
+  conditions:
+    - lastProbeTime: '2023-09-17T14:35:14Z'
+      lastTransitionTime: '2023-09-17T14:35:14Z'
+      message: Job completed, 1 pods succeeded, 0 pods failed
+      reason: Complete
+      status: 'True'
+      type: Complete
+  desired: 1
+  failed: 0
+  phase: paused
+  startTime: '2023-09-17T14:35:07Z'
+  succeeded: 0
diff --git a/resource_customizations/apps.kruise.io/CloneSet/health.lua b/resource_customizations/apps.kruise.io/CloneSet/health.lua
new file mode 100644
index 0000000000000..197ab7573dfe8
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/CloneSet/health.lua
@@ -0,0 +1,33 @@
+hs={ status = "Progressing", message = "Waiting for initialization" }
+
+if obj.status ~= nil then
+        
+    if obj.metadata.generation == obj.status.observedGeneration then
+
+        if obj.spec.updateStrategy.paused == true or not obj.status.updatedAvailableReplicas then
+            hs.status = "Suspended"
+            hs.message = "Cloneset is paused"
+            return hs
+        elseif obj.spec.updateStrategy.partition ~= 0 and obj.metadata.generation > 1 then
+            if obj.status.updatedReplicas >= obj.status.expectedUpdatedReplicas then
+                hs.status = "Suspended"
+                hs.message = "Cloneset needs manual intervention"
+                return hs
+            end
+
+        elseif obj.status.updatedAvailableReplicas == obj.status.replicas then
+            hs.status = "Healthy"
+            hs.message = "All Cloneset workloads are ready and updated"    
+            return hs
+        
+        else
+            if obj.status.updatedAvailableReplicas ~= obj.status.replicas then
+                hs.status = "Degraded"
+                hs.message = "Some replicas are not ready or available"
+                return hs
+            end
+        end
+    end
+end
+
+return hs
diff --git a/resource_customizations/apps.kruise.io/CloneSet/health_test.yaml b/resource_customizations/apps.kruise.io/CloneSet/health_test.yaml
new file mode 100644
index 0000000000000..e740eca850778
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/CloneSet/health_test.yaml
@@ -0,0 +1,21 @@
+tests:
+  - healthStatus:
+      status: Healthy
+      message: "All Cloneset workloads are ready and updated"
+    inputPath: testdata/healthy.yaml
+  - healthStatus:
+      status: Degraded
+      message: "Some replicas are not ready or available"
+    inputPath: testdata/degraded.yaml
+  - healthStatus:
+      status: Progressing
+      message: "Waiting for initialization"
+    inputPath: testdata/unknown.yaml
+  - healthStatus: 
+      status: Suspended
+      message: "Cloneset is paused"
+    inputpath: testdata/suspended.yaml
+  - healthStatus: 
+      status: Suspended
+      message: "Cloneset needs manual intervention"
+    inputpath: testdata/partition_suspended.yaml
diff --git a/resource_customizations/apps.kruise.io/CloneSet/testdata/degraded.yaml b/resource_customizations/apps.kruise.io/CloneSet/testdata/degraded.yaml
new file mode 100644
index 0000000000000..36e9a0d537c85
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/CloneSet/testdata/degraded.yaml
@@ -0,0 +1,35 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: CloneSet
+metadata:
+  name: cloneset-test
+  namespace: kruise
+  generation: 1
+  labels:
+    app: sample
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: sample
+  template:
+    metadata:
+      labels:
+        app: sample
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:alpine
+  updateStrategy: 
+    paused: false
+
+status:
+  observedGeneration: 1
+  replicas: 2
+  updatedReadyReplicas: 1
+  updatedAvailableReplicas: 1
+  conditions:
+  - lastTransitionTime: "2021-09-21T22:35:31Z"
+    message: Deployment has minimum availability.
+    reason: MinimumReplicasAvailable
+    status: 'True'
+    type: FailedScale
diff --git a/resource_customizations/apps.kruise.io/CloneSet/testdata/healthy.yaml b/resource_customizations/apps.kruise.io/CloneSet/testdata/healthy.yaml
new file mode 100644
index 0000000000000..8a1935381e04e
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/CloneSet/testdata/healthy.yaml
@@ -0,0 +1,36 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: CloneSet
+metadata:
+  name: cloneset-test
+  namespace: kruise
+  generation: 1
+  labels:
+    app: sample
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sample
+  template:
+    metadata:
+      labels:
+        app: sample
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:alpine
+  updateStrategy: 
+    paused: false
+
+        
+status:
+  observedGeneration: 1
+  replicas: 2
+  updatedReadyReplicas: 2
+  updatedAvailableReplicas: 2
+  conditions:
+  - lastTransitionTime: "2021-09-21T22:35:31Z"
+    message: Deployment has minimum availability.
+    reason: MinimumReplicasAvailable
+    status: 'True'
+    type: FailedScale
diff --git a/resource_customizations/apps.kruise.io/CloneSet/testdata/partition_suspended.yaml b/resource_customizations/apps.kruise.io/CloneSet/testdata/partition_suspended.yaml
new file mode 100644
index 0000000000000..674c5226b3072
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/CloneSet/testdata/partition_suspended.yaml
@@ -0,0 +1,31 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: CloneSet
+metadata:
+  name: cloneset-test
+  namespace: kruise
+  generation: 2
+  labels:
+    app: sample
+spec:
+  replicas: 5
+  selector:
+    matchLabels:
+      app: sample
+  template:
+    metadata:
+      labels:
+        app: sample
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:alpine
+  updateStrategy:
+    partition: 3
+
+status:
+  observedGeneration: 2
+  replicas: 5
+  expectedUpdatedReplicas: 2
+  updatedReadyReplicas: 1
+  updatedAvailableReplicas: 1
+  updatedReplicas: 3
diff --git a/resource_customizations/apps.kruise.io/CloneSet/testdata/suspended.yaml b/resource_customizations/apps.kruise.io/CloneSet/testdata/suspended.yaml
new file mode 100644
index 0000000000000..9edfaca6a5149
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/CloneSet/testdata/suspended.yaml
@@ -0,0 +1,35 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: CloneSet
+metadata:
+  name: cloneset-test
+  namespace: kruise
+  generation: 2
+  labels:
+    app: sample
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sample
+  template:
+    metadata:
+      labels:
+        app: sample
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:alpine
+  updateStrategy:
+    paused: true
+
+status:
+  observedGeneration: 2
+  replicas: 2
+  updatedReadyReplicas: 2
+  updatedAvailableReplicas: 2
+  conditions:
+  - lastTransitionTime: "2021-09-21T22:35:31Z"
+    message: Deployment has minimum availability.
+    reason: MinimumReplicasAvailable
+    status: 'True'
+    type: FailedScale
diff --git a/resource_customizations/apps.kruise.io/CloneSet/testdata/unknown.yaml b/resource_customizations/apps.kruise.io/CloneSet/testdata/unknown.yaml
new file mode 100644
index 0000000000000..c1ccdb22fc76e
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/CloneSet/testdata/unknown.yaml
@@ -0,0 +1,5 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: CloneSet
+metadata:
+  name: cloneset-test
+  namespace: kruise
diff --git a/resource_customizations/apps.kruise.io/DaemonSet/health.lua b/resource_customizations/apps.kruise.io/DaemonSet/health.lua
new file mode 100644
index 0000000000000..7705bcc3325e5
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/DaemonSet/health.lua
@@ -0,0 +1,35 @@
+hs={ status = "Progressing", message = "Waiting for initialization" }
+
+if obj.status ~= nil then
+
+    if obj.metadata.generation == obj.status.observedGeneration then
+
+        if obj.spec.updateStrategy.rollingUpdate.paused == true or not obj.status.updatedNumberScheduled then
+            hs.status = "Suspended"
+            hs.message = "Daemonset is paused"
+            return hs
+        elseif obj.spec.updateStrategy.rollingUpdate.partition ~= 0 and obj.metadata.generation > 1 then
+            if obj.status.updatedNumberScheduled > (obj.status.desiredNumberScheduled - obj.spec.updateStrategy.rollingUpdate.partition) then
+                hs.status = "Suspended"
+                hs.message = "Daemonset needs manual intervention"
+                return hs
+            end
+
+        elseif (obj.status.updatedNumberScheduled == obj.status.desiredNumberScheduled) and (obj.status.numberAvailable == obj.status.desiredNumberScheduled) then
+            hs.status = "Healthy"
+            hs.message = "All Daemonset workloads are ready and updated"    
+            return hs
+        
+        else
+            if (obj.status.updatedNumberScheduled == obj.status.desiredNumberScheduled) and (obj.status.numberUnavailable == obj.status.desiredNumberScheduled) then
+                hs.status = "Degraded"
+                hs.message = "Some pods are not ready or available"
+                return hs
+            end
+        end
+
+    end
+
+end
+
+return hs
diff --git a/resource_customizations/apps.kruise.io/DaemonSet/health_test.yaml b/resource_customizations/apps.kruise.io/DaemonSet/health_test.yaml
new file mode 100644
index 0000000000000..0a8c8292672f3
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/DaemonSet/health_test.yaml
@@ -0,0 +1,21 @@
+tests:
+  - healthStatus:
+      status: Healthy
+      message: "All Daemonset workloads are ready and updated"
+    inputPath: testdata/healthy.yaml
+  - healthStatus:
+      status: Degraded
+      message: "Some pods are not ready or available"
+    inputPath: testdata/degraded.yaml
+  - healthStatus:
+      status: Progressing
+      message: "Waiting for initialization"
+    inputPath: testdata/unknown.yaml
+  - healthStatus:
+      status: Suspended
+      message: "Daemonset is paused"
+    inputPath: testdata/suspended.yaml
+  - healthStatus:
+      status: Suspended
+      message: "Daemonset needs manual intervention"
+    inputPath: testdata/partition_suspended.yaml
diff --git a/resource_customizations/apps.kruise.io/DaemonSet/testdata/degraded.yaml b/resource_customizations/apps.kruise.io/DaemonSet/testdata/degraded.yaml
new file mode 100644
index 0000000000000..ed8cbc0b4699e
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/DaemonSet/testdata/degraded.yaml
@@ -0,0 +1,34 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: DaemonSet
+metadata:
+  name: daemonset-test
+  namespace: kruise
+  generation: 1
+  labels:
+    app: sample
+spec:
+  selector:
+    matchLabels:
+      app: sample
+  template:
+    metadata:
+      labels:
+        app: sample
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:alpine
+  updateStrategy:
+    rollingUpdate:
+      partition: 0
+      paused: false
+        
+status:
+  currentNumberScheduled: 1
+  daemonSetHash: 5dffcdfcd7
+  desiredNumberScheduled: 1
+  numberUnavailable: 1
+  numberMisscheduled: 0
+  numberReady: 0
+  observedGeneration: 1
+  updatedNumberScheduled: 1
diff --git a/resource_customizations/apps.kruise.io/DaemonSet/testdata/healthy.yaml b/resource_customizations/apps.kruise.io/DaemonSet/testdata/healthy.yaml
new file mode 100644
index 0000000000000..6224ebf35e164
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/DaemonSet/testdata/healthy.yaml
@@ -0,0 +1,34 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: DaemonSet
+metadata:
+  name: daemonset-test
+  namespace: kruise
+  generation: 1
+  labels:
+    app: sample
+spec:
+  selector:
+    matchLabels:
+      app: sample
+  template:
+    metadata:
+      labels:
+        app: sample
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:alpine
+  updateStrategy:
+    rollingUpdate:
+      partition: 0
+      paused: false
+        
+status:
+  currentNumberScheduled: 1
+  daemonSetHash: 5dffcdfcd7
+  desiredNumberScheduled: 1
+  numberAvailable: 1
+  numberMisscheduled: 0
+  numberReady: 1
+  observedGeneration: 1
+  updatedNumberScheduled: 1
diff --git a/resource_customizations/apps.kruise.io/DaemonSet/testdata/partition_suspended.yaml b/resource_customizations/apps.kruise.io/DaemonSet/testdata/partition_suspended.yaml
new file mode 100644
index 0000000000000..4c0819cdc8703
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/DaemonSet/testdata/partition_suspended.yaml
@@ -0,0 +1,33 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: DaemonSet
+metadata:
+  name: daemonset-test
+  namespace: kruise
+  generation: 6
+  labels:
+    app: sample
+spec:
+  selector:
+    matchLabels:
+      app: sample
+  template:
+    metadata:
+      labels:
+        app: sample
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:alpine
+  updateStrategy:
+    rollingUpdate:
+      partition: 4
+
+status:
+  currentNumberScheduled: 1
+  daemonSetHash: 5f8cdcdc65
+  desiredNumberScheduled: 10
+  numberAvailable: 10
+  numberMisscheduled: 0
+  numberReady: 10
+  observedGeneration: 6
+  updatedNumberScheduled: 7
diff --git a/resource_customizations/apps.kruise.io/DaemonSet/testdata/suspended.yaml b/resource_customizations/apps.kruise.io/DaemonSet/testdata/suspended.yaml
new file mode 100644
index 0000000000000..fb705f5578176
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/DaemonSet/testdata/suspended.yaml
@@ -0,0 +1,33 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: DaemonSet
+metadata:
+  name: daemonset-test
+  namespace: kruise
+  generation: 1
+  labels:
+    app: sample
+spec:
+  selector:
+    matchLabels:
+      app: sample
+  template:
+    metadata:
+      labels:
+        app: sample
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:alpine
+  updateStrategy:
+    rollingUpdate:
+      paused: true
+        
+status:
+  currentNumberScheduled: 1
+  daemonSetHash: 5dffcdfcd7
+  desiredNumberScheduled: 1
+  numberAvailable: 1
+  numberMisscheduled: 0
+  numberReady: 1
+  observedGeneration: 1
+  updatedNumberScheduled: 1
diff --git a/resource_customizations/apps.kruise.io/DaemonSet/testdata/unknown.yaml b/resource_customizations/apps.kruise.io/DaemonSet/testdata/unknown.yaml
new file mode 100644
index 0000000000000..aa5791c52bc6c
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/DaemonSet/testdata/unknown.yaml
@@ -0,0 +1,5 @@
+apiVersion: apps.kruise.io/v1alpha1
+kind: DaemonSet
+metadata:
+  name: daemonset-test
+  namespace: kruise
diff --git a/resource_customizations/apps.kruise.io/StatefulSet/health.lua b/resource_customizations/apps.kruise.io/StatefulSet/health.lua
new file mode 100644
index 0000000000000..47340452db2dc
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/StatefulSet/health.lua
@@ -0,0 +1,35 @@
+hs={ status = "Progressing", message = "Waiting for initialization" }
+
+if obj.status ~= nil then
+
+    if obj.metadata.generation == obj.status.observedGeneration then
+
+        if obj.spec.updateStrategy.rollingUpdate.paused == true or not obj.status.updatedAvailableReplicas then
+            hs.status = "Suspended"
+            hs.message = "Statefulset is paused"
+            return hs
+        elseif obj.spec.updateStrategy.rollingUpdate.partition ~= 0 and obj.metadata.generation > 1 then
+            if obj.status.updatedReplicas > (obj.status.replicas - obj.spec.updateStrategy.rollingUpdate.partition) then
+                hs.status = "Suspended"
+                hs.message = "Statefulset needs manual intervention"
+                return hs
+            end
+
+        elseif obj.status.updatedAvailableReplicas == obj.status.replicas then
+            hs.status = "Healthy"
+            hs.message = "All Statefulset workloads are ready and updated"    
+            return hs
+        
+        else
+            if obj.status.updatedAvailableReplicas ~= obj.status.replicas then
+                hs.status = "Degraded"
+                hs.message = "Some replicas are not ready or available"
+                return hs
+            end
+        end
+
+    end
+
+end
+
+return hs
diff --git a/resource_customizations/apps.kruise.io/StatefulSet/health_test.yaml b/resource_customizations/apps.kruise.io/StatefulSet/health_test.yaml
new file mode 100644
index 0000000000000..6672b9f46d4f4
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/StatefulSet/health_test.yaml
@@ -0,0 +1,21 @@
+tests:
+  - healthStatus:
+      status: Healthy
+      message: "All Statefulset workloads are ready and updated"
+    inputPath: testdata/healthy.yaml
+  - healthStatus:
+      status: Degraded
+      message: "Some replicas are not ready or available"
+    inputPath: testdata/degraded.yaml
+  - healthStatus:
+      status: Progressing
+      message: "Waiting for initialization"
+    inputPath: testdata/unknown.yaml
+  - healthStatus:
+      status: Suspended
+      message: "Statefulset is paused"
+    inputPath: testdata/suspended.yaml
+  - healthStatus:
+      status: Suspended
+      message: "Statefulset needs manual intervention"
+    inputPath: testdata/partition_suspended.yaml
diff --git a/resource_customizations/apps.kruise.io/StatefulSet/testdata/degraded.yaml b/resource_customizations/apps.kruise.io/StatefulSet/testdata/degraded.yaml
new file mode 100644
index 0000000000000..88e58914940fc
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/StatefulSet/testdata/degraded.yaml
@@ -0,0 +1,42 @@
+apiVersion: apps.kruise.io/v1beta1
+kind: StatefulSet
+metadata:
+  name: statefulset-test
+  namespace: kruise
+  generation: 5
+  labels:
+    app: sample
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: sample
+  template:
+    metadata:
+      labels:
+        app: sample
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:alpine
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: 1
+      minReadySeconds: 0
+      paused: false
+      partition: 0
+      podUpdatePolicy: ReCreate
+    type: RollingUpdate
+
+status:
+  observedGeneration: 5
+  replicas: 2
+  updatedAvailableReplicas: 1
+  updatedReadyReplicas: 1
+  conditions:
+  - lastTransitionTime: "2021-09-21T22:35:31Z"
+    message: Deployment has minimum availability.
+    reason: MinimumReplicasAvailable
+    status: 'True'
+    type: FailedCreatePod
+
diff --git a/resource_customizations/apps.kruise.io/StatefulSet/testdata/healthy.yaml b/resource_customizations/apps.kruise.io/StatefulSet/testdata/healthy.yaml
new file mode 100644
index 0000000000000..793de25d3da1c
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/StatefulSet/testdata/healthy.yaml
@@ -0,0 +1,41 @@
+apiVersion: apps.kruise.io/v1beta1
+kind: StatefulSet
+metadata:
+  name: statefulset-test
+  namespace: kruise
+  generation: 2
+  labels:
+    app: sample
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: sample
+  template:
+    metadata:
+      labels:
+        app: sample
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:alpine
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: 1
+      minReadySeconds: 0
+      paused: false
+      partition: 0
+      podUpdatePolicy: ReCreate
+    type: RollingUpdate
+        
+status:
+  observedGeneration: 2
+  replicas: 2
+  updatedAvailableReplicas: 2
+  updatedReadyReplicas: 2
+  conditions:
+  - lastTransitionTime: "2021-09-21T22:35:31Z"
+    message: Deployment has minimum availability.
+    reason: MinimumReplicasAvailable
+    status: 'False'
+    type: FailedCreatePod
diff --git a/resource_customizations/apps.kruise.io/StatefulSet/testdata/partition_suspended.yaml b/resource_customizations/apps.kruise.io/StatefulSet/testdata/partition_suspended.yaml
new file mode 100644
index 0000000000000..b09a7726bf5d7
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/StatefulSet/testdata/partition_suspended.yaml
@@ -0,0 +1,36 @@
+apiVersion: apps.kruise.io/v1beta1
+kind: StatefulSet
+metadata:
+  name: statefulset-test
+  namespace: kruise
+  generation: 3
+  labels:
+    app: sample
+spec:
+  replicas: 10
+  selector:
+    matchLabels:
+      app: sample
+  template:
+    metadata:
+      labels:
+        app: sample
+    spec:
+      containers:
+        - image: nginx:mainline
+  updateStrategy:
+    rollingUpdate:
+      partition: 4
+
+status:
+  availableReplicas: 10
+  currentReplicas: 4
+  currentRevision: statefulset-test-d4d4fb5bd
+  labelSelector: app=sample
+  observedGeneration: 3
+  readyReplicas: 10
+  replicas: 10
+  updateRevision: statefulset-test-56dfb978d4
+  updatedAvailableReplicas: 7
+  updatedReadyReplicas: 7
+  updatedReplicas: 7
diff --git a/resource_customizations/apps.kruise.io/StatefulSet/testdata/suspended.yaml b/resource_customizations/apps.kruise.io/StatefulSet/testdata/suspended.yaml
new file mode 100644
index 0000000000000..42dae9cf5e322
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/StatefulSet/testdata/suspended.yaml
@@ -0,0 +1,36 @@
+apiVersion: apps.kruise.io/v1beta1
+kind: StatefulSet
+metadata:
+  name: statefulset-test
+  namespace: kruise
+  generation: 2
+  labels:
+    app: sample
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: sample
+  template:
+    metadata:
+      labels:
+        app: sample
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:alpine
+  updateStrategy:
+    rollingUpdate:
+      paused: true
+        
+status:
+  observedGeneration: 2
+  replicas: 2
+  updatedAvailableReplicas: 2
+  updatedReadyReplicas: 2
+  conditions:
+  - lastTransitionTime: "2021-09-21T22:35:31Z"
+    message: Deployment has minimum availability.
+    reason: MinimumReplicasAvailable
+    status: 'False'
+    type: FailedCreatePod
diff --git a/resource_customizations/apps.kruise.io/StatefulSet/testdata/unknown.yaml b/resource_customizations/apps.kruise.io/StatefulSet/testdata/unknown.yaml
new file mode 100644
index 0000000000000..67d28de6dae64
--- /dev/null
+++ b/resource_customizations/apps.kruise.io/StatefulSet/testdata/unknown.yaml
@@ -0,0 +1,5 @@
+apiVersion: apps.kruise.io/v1beta1
+kind: StatefulSet
+metadata:
+  name: statefulset-test
+  namespace: kruise
diff --git a/resource_customizations/rollouts.kruise.io/Rollout/health.lua b/resource_customizations/rollouts.kruise.io/Rollout/health.lua
new file mode 100644
index 0000000000000..5fd4ddb2a5486
--- /dev/null
+++ b/resource_customizations/rollouts.kruise.io/Rollout/health.lua
@@ -0,0 +1,31 @@
+hs={ status = "Progressing", message = "Rollout is still progressing" }
+
+if obj.metadata.generation == obj.status.observedGeneration then
+
+    if obj.status.canaryStatus.currentStepState == "StepUpgrade" and obj.status.phase == "Progressing" then
+        hs.status = "Progressing"
+        hs.message = "Rollout is still progressing"
+        return hs
+    end
+
+    if obj.status.canaryStatus.currentStepState == "StepPaused" and obj.status.phase == "Progressing" then
+        hs.status = "Suspended"
+        hs.message = "Rollout is Paused need manual intervention"
+        return hs
+    end
+
+    if obj.status.canaryStatus.currentStepState == "Completed" and obj.status.phase == "Healthy" then
+        hs.status = "Healthy"
+        hs.message = "Rollout is Completed"
+        return hs
+    end
+
+    if obj.status.canaryStatus.currentStepState == "StepPaused" and (obj.status.phase == "Terminating" or obj.status.phase == "Disabled") then
+        hs.status = "Degraded"
+        hs.message = "Rollout is Disabled or Terminating"
+        return hs
+    end
+
+end
+
+return hs
diff --git a/resource_customizations/rollouts.kruise.io/Rollout/health_test.yaml b/resource_customizations/rollouts.kruise.io/Rollout/health_test.yaml
new file mode 100644
index 0000000000000..c89ea3409ec77
--- /dev/null
+++ b/resource_customizations/rollouts.kruise.io/Rollout/health_test.yaml
@@ -0,0 +1,17 @@
+tests:
+  - healthStatus:
+      status: Healthy
+      message: "Rollout is Completed"
+    inputPath: testdata/healthy.yaml
+  - healthStatus:
+      status: Degraded
+      message: "Rollout is Disabled or Terminating"
+    inputPath: testdata/degraded.yaml
+  - healthStatus:
+      status: Progressing
+      message: "Rollout is still progressing"
+    inputPath: testdata/progressing.yaml
+  - healthStatus:
+      status: Suspended
+      message: "Rollout is Paused need manual intervention"
+    inputPath: testdata/suspended.yaml
diff --git a/resource_customizations/rollouts.kruise.io/Rollout/testdata/degraded.yaml b/resource_customizations/rollouts.kruise.io/Rollout/testdata/degraded.yaml
new file mode 100644
index 0000000000000..97c40f10a0c96
--- /dev/null
+++ b/resource_customizations/rollouts.kruise.io/Rollout/testdata/degraded.yaml
@@ -0,0 +1,50 @@
+apiVersion: rollouts.kruise.io/v1alpha1
+kind: Rollout
+metadata:
+  name: rollouts-demo
+  namespace: default
+  annotations:
+    rollouts.kruise.io/rolling-style: partition
+  generation: 5
+spec:
+  objectRef:
+    workloadRef:
+      apiVersion: apps/v1
+      kind: Deployment
+      name: workload-demo
+  strategy:
+    canary:
+      steps:
+      - replicas: 1
+        pause:
+          duration: 0
+      - replicas: 50%
+        pause:
+          duration: 0
+      - replicas: 100%
+
+status:
+  canaryStatus:
+    canaryReadyReplicas: 1
+    canaryReplicas: 1
+    canaryRevision: 76fd76f75b
+    currentStepIndex: 1
+    currentStepState: StepPaused
+    lastUpdateTime: '2023-09-23T11:44:39Z'
+    message: BatchRelease is at state Ready, rollout-id , step 1
+    observedWorkloadGeneration: 7
+    podTemplateHash: 76fd76f75b
+    rolloutHash: 77cxd69w47b7bwddwv2w7vxvb4xxdbwcx9x289vw69w788w4w6z4x8dd4vbz2zbw
+    stableRevision: 6bfdfb5bfb
+  conditions:
+    - lastTransitionTime: '2023-09-23T11:44:09Z'
+      lastUpdateTime: '2023-09-23T11:44:09Z'
+      message: Rollout is in Progressing
+      reason: InRolling
+      status: 'True'
+      type: Progressing
+  message: >-
+    Rollout is in step(1/3), and you need manually confirm to enter the next
+    step
+  observedGeneration: 5
+  phase: Disabled
diff --git a/resource_customizations/rollouts.kruise.io/Rollout/testdata/healthy.yaml b/resource_customizations/rollouts.kruise.io/Rollout/testdata/healthy.yaml
new file mode 100644
index 0000000000000..77743b50007ad
--- /dev/null
+++ b/resource_customizations/rollouts.kruise.io/Rollout/testdata/healthy.yaml
@@ -0,0 +1,56 @@
+apiVersion: rollouts.kruise.io/v1alpha1
+kind: Rollout
+metadata:
+  name: rollouts-demo
+  namespace: default
+  annotations:
+    rollouts.kruise.io/rolling-style: partition
+  generation: 7
+spec:
+  objectRef:
+    workloadRef:
+      apiVersion: apps/v1
+      kind: Deployment
+      name: workload-demo
+  strategy:
+    canary:
+      steps:
+      - replicas: 1
+        pause:
+          duration: 0
+      - replicas: 50%
+        pause:
+          duration: 0
+      - replicas: 100%
+
+status:
+  canaryStatus:
+    canaryReadyReplicas: 10
+    canaryReplicas: 10
+    canaryRevision: 76fd76f75b
+    currentStepIndex: 3
+    currentStepState: Completed
+    lastUpdateTime: '2023-09-23T11:48:58Z'
+    message: BatchRelease is at state Ready, rollout-id , step 3
+    observedWorkloadGeneration: 22
+    podTemplateHash: 76fd76f75b
+    rolloutHash: 77cxd69w47b7bwddwv2w7vxvb4xxdbwcx9x289vw69w788w4w6z4x8dd4vbz2zbw
+    stableRevision: 6bfdfb5bfb
+  conditions:
+    - lastTransitionTime: '2023-09-23T11:44:09Z'
+      lastUpdateTime: '2023-09-23T11:44:09Z'
+      message: Rollout progressing has been completed
+      reason: Completed
+      status: 'False'
+      type: Progressing
+    - lastTransitionTime: '2023-09-23T11:49:01Z'
+      lastUpdateTime: '2023-09-23T11:49:01Z'
+      message: ''
+      reason: ''
+      status: 'True'
+      type: Succeeded
+  message: Rollout progressing has been completed
+  observedGeneration: 7
+  phase: Healthy
+
+
diff --git a/resource_customizations/rollouts.kruise.io/Rollout/testdata/progressing.yaml b/resource_customizations/rollouts.kruise.io/Rollout/testdata/progressing.yaml
new file mode 100644
index 0000000000000..f84d395867530
--- /dev/null
+++ b/resource_customizations/rollouts.kruise.io/Rollout/testdata/progressing.yaml
@@ -0,0 +1,48 @@
+apiVersion: rollouts.kruise.io/v1alpha1
+kind: Rollout
+metadata:
+  name: rollouts-demo
+  namespace: default
+  annotations:
+    rollouts.kruise.io/rolling-style: partition
+  generation: 5
+spec:
+  objectRef:
+    workloadRef:
+      apiVersion: apps/v1
+      kind: Deployment
+      name: workload-demo
+  strategy:
+    canary:
+      steps:
+      - replicas: 1
+        pause:
+          duration: 0
+      - replicas: 50%
+        pause:
+          duration: 0
+      - replicas: 100%
+
+status:
+  canaryStatus:
+    canaryReadyReplicas: 0
+    canaryReplicas: 1
+    canaryRevision: 76fd76f75b
+    currentStepIndex: 1
+    currentStepState: StepUpgrade
+    lastUpdateTime: '2023-09-23T11:44:12Z'
+    message: BatchRelease is at state Verifying, rollout-id , step 1
+    observedWorkloadGeneration: 6
+    podTemplateHash: 76fd76f75b
+    rolloutHash: 77cxd69w47b7bwddwv2w7vxvb4xxdbwcx9x289vw69w788w4w6z4x8dd4vbz2zbw
+    stableRevision: 6bfdfb5bfb
+  conditions:
+    - lastTransitionTime: '2023-09-23T11:44:09Z'
+      lastUpdateTime: '2023-09-23T11:44:09Z'
+      message: Rollout is in Progressing
+      reason: InRolling
+      status: 'True'
+      type: Progressing
+  message: Rollout is in step(1/3), and upgrade workload to new version
+  observedGeneration: 5
+  phase: Progressing
diff --git a/resource_customizations/rollouts.kruise.io/Rollout/testdata/suspended.yaml b/resource_customizations/rollouts.kruise.io/Rollout/testdata/suspended.yaml
new file mode 100644
index 0000000000000..77a67129a248e
--- /dev/null
+++ b/resource_customizations/rollouts.kruise.io/Rollout/testdata/suspended.yaml
@@ -0,0 +1,50 @@
+apiVersion: rollouts.kruise.io/v1alpha1
+kind: Rollout
+metadata:
+  name: rollouts-demo
+  namespace: default
+  annotations:
+    rollouts.kruise.io/rolling-style: partition
+  generation: 5
+spec:
+  objectRef:
+    workloadRef:
+      apiVersion: apps/v1
+      kind: Deployment
+      name: workload-demo
+  strategy:
+    canary:
+      steps:
+      - replicas: 1
+        pause:
+          duration: 0
+      - replicas: 50%
+        pause:
+          duration: 0
+      - replicas: 100%
+
+status:
+  canaryStatus:
+    canaryReadyReplicas: 1
+    canaryReplicas: 1
+    canaryRevision: 76fd76f75b
+    currentStepIndex: 1
+    currentStepState: StepPaused
+    lastUpdateTime: '2023-09-23T11:44:39Z'
+    message: BatchRelease is at state Ready, rollout-id , step 1
+    observedWorkloadGeneration: 7
+    podTemplateHash: 76fd76f75b
+    rolloutHash: 77cxd69w47b7bwddwv2w7vxvb4xxdbwcx9x289vw69w788w4w6z4x8dd4vbz2zbw
+    stableRevision: 6bfdfb5bfb
+  conditions:
+    - lastTransitionTime: '2023-09-23T11:44:09Z'
+      lastUpdateTime: '2023-09-23T11:44:09Z'
+      message: Rollout is in Progressing
+      reason: InRolling
+      status: 'True'
+      type: Progressing
+  message: >-
+    Rollout is in step(1/3), and you need manually confirm to enter the next
+    step
+  observedGeneration: 5
+  phase: Progressing

From 54f1572d46d8d611018f4854cf2f24a24a3ac088 Mon Sep 17 00:00:00 2001
From: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>
Date: Tue, 9 Jan 2024 21:09:34 -0500
Subject: [PATCH 11/13] fix: allow to run codegen outside GOPATH (#16511)

* fix: allow to run codegen outside GOPATH

Signed-off-by: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>

* clientgen

Signed-off-by: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>

* openapigen

Signed-off-by: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>

* remove ensure-gopath

Signed-off-by: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>

---------

Signed-off-by: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>
---
 Makefile               | 29 ++++++++++++-----------------
 hack/generate-proto.sh | 41 +++++++++++++++++++++++++++--------------
 hack/update-codegen.sh | 18 ++++++++++++++----
 hack/update-openapi.sh | 20 +++++++++++++++-----
 4 files changed, 68 insertions(+), 40 deletions(-)

diff --git a/Makefile b/Makefile
index 880622e7279a9..8bd9a49b6bb02 100644
--- a/Makefile
+++ b/Makefile
@@ -175,29 +175,21 @@ endif
 .PHONY: all
 all: cli image
 
-# We have some legacy requirements for being checked out within $GOPATH.
-# The ensure-gopath target can be used as dependency to ensure we are running
-# within these boundaries.
-.PHONY: ensure-gopath
-ensure-gopath:
-ifneq ("$(PWD)","$(LEGACY_PATH)")
-	@echo "Due to legacy requirements for codegen, repository needs to be checked out within \$$GOPATH"
-	@echo "Location of this repo should be '$(LEGACY_PATH)' but is '$(PWD)'"
-	@exit 1
-endif
-
 .PHONY: gogen
-gogen: ensure-gopath
+gogen:
 	export GO111MODULE=off
 	go generate ./util/argo/...
 
 .PHONY: protogen
-protogen: ensure-gopath mod-vendor-local
+protogen: mod-vendor-local protogen-fast
+
+.PHONY: protogen-fast
+protogen-fast:
 	export GO111MODULE=off
 	./hack/generate-proto.sh
 
 .PHONY: openapigen
-openapigen: ensure-gopath
+openapigen:
 	export GO111MODULE=off
 	./hack/update-openapi.sh
 
@@ -212,19 +204,22 @@ notification-docs:
 
 
 .PHONY: clientgen
-clientgen: ensure-gopath
+clientgen:
 	export GO111MODULE=off
 	./hack/update-codegen.sh
 
 .PHONY: clidocsgen
-clidocsgen: ensure-gopath
+clidocsgen:
 	go run tools/cmd-docs/main.go
 
 
 .PHONY: codegen-local
-codegen-local: ensure-gopath mod-vendor-local gogen protogen clientgen openapigen clidocsgen manifests-local notification-docs notification-catalog
+codegen-local: mod-vendor-local gogen protogen clientgen openapigen clidocsgen manifests-local notification-docs notification-catalog
 	rm -rf vendor/
 
+.PHONY: codegen-local-fast
+codegen-local-fast: gogen protogen-fast clientgen openapigen clidocsgen manifests-local notification-docs notification-catalog
+
 .PHONY: codegen
 codegen: test-tools-image
 	$(call run-in-test-client,make codegen-local)
diff --git a/hack/generate-proto.sh b/hack/generate-proto.sh
index 8466993ebc544..fa5d7322c7f81 100755
--- a/hack/generate-proto.sh
+++ b/hack/generate-proto.sh
@@ -10,9 +10,13 @@ set -o nounset
 set -o pipefail
 
 # shellcheck disable=SC2128
-PROJECT_ROOT=$(cd "$(dirname "${BASH_SOURCE}")"/..; pwd)
+PROJECT_ROOT=$(
+    cd "$(dirname "${BASH_SOURCE}")"/..
+    pwd
+)
 PATH="${PROJECT_ROOT}/dist:${PATH}"
 GOPATH=$(go env GOPATH)
+GOPATH_PROJECT_ROOT="${GOPATH}/src/github.com/argoproj/argo-cd"
 
 # output tool versions
 go version
@@ -41,6 +45,7 @@ APIMACHINERY_PKGS=(
 
 export GO111MODULE=on
 [ -e ./v2 ] || ln -s . v2
+[ -e "${GOPATH_PROJECT_ROOT}" ] || (mkdir -p "$(dirname "${GOPATH_PROJECT_ROOT}")" && ln -s "${PROJECT_ROOT}" "${GOPATH_PROJECT_ROOT}")
 
 # protoc_include is the include directory containing the .proto files distributed with protoc binary
 if [ -d /dist/protoc-include ]; then
@@ -53,10 +58,17 @@ fi
 
 go-to-protobuf \
     --go-header-file="${PROJECT_ROOT}"/hack/custom-boilerplate.go.txt \
-    --packages="$(IFS=, ; echo "${PACKAGES[*]}")" \
-    --apimachinery-packages="$(IFS=, ; echo "${APIMACHINERY_PKGS[*]}")" \
-    --proto-import=./vendor \
-    --proto-import="${protoc_include}"
+    --packages="$(
+        IFS=,
+        echo "${PACKAGES[*]}"
+    )" \
+    --apimachinery-packages="$(
+        IFS=,
+        echo "${APIMACHINERY_PKGS[*]}"
+    )" \
+    --proto-import="${PROJECT_ROOT}"/vendor \
+    --proto-import="${protoc_include}" \
+    --output-base="${GOPATH}/src/"
 
 # Either protoc-gen-go, protoc-gen-gofast, or protoc-gen-gogofast can be used to build
 # server/*/<service>.pb.go from .proto files. golang/protobuf and gogo/protobuf can be used
@@ -86,9 +98,11 @@ for i in ${PROTO_FILES}; do
         --${GOPROTOBINARY}_out=plugins=grpc:"$GOPATH"/src \
         --grpc-gateway_out=logtostderr=true:"$GOPATH"/src \
         --swagger_out=logtostderr=true:. \
-        $i
+        "$i"
 done
-[ -e ./v2 ] && rm -rf v2
+
+[ -L "${GOPATH_PROJECT_ROOT}" ] && rm -rf "${GOPATH_PROJECT_ROOT}"
+[ -L ./v2 ] && rm -rf v2
 
 # collect_swagger gathers swagger files into a subdirectory
 collect_swagger() {
@@ -97,7 +111,7 @@ collect_swagger() {
     PRIMARY_SWAGGER=$(mktemp)
     COMBINED_SWAGGER=$(mktemp)
 
-    cat <<EOF > "${PRIMARY_SWAGGER}"
+    cat <<EOF >"${PRIMARY_SWAGGER}"
 {
   "swagger": "2.0",
   "info": {
@@ -111,7 +125,7 @@ EOF
 
     rm -f "${SWAGGER_OUT}"
 
-    find "${SWAGGER_ROOT}" -name '*.swagger.json' -exec swagger mixin --ignore-conflicts "${PRIMARY_SWAGGER}" '{}' \+ > "${COMBINED_SWAGGER}"
+    find "${SWAGGER_ROOT}" -name '*.swagger.json' -exec swagger mixin --ignore-conflicts "${PRIMARY_SWAGGER}" '{}' \+ >"${COMBINED_SWAGGER}"
     jq -r 'del(.definitions[].properties[]? | select(."$ref"!=null and .description!=null).description) | del(.definitions[].properties[]? | select(."$ref"!=null and .title!=null).title) |
       # The "array" and "map" fields have custom unmarshaling. Modify the swagger to reflect this.
       .definitions.v1alpha1ApplicationSourcePluginParameter.properties.array = {"description":"Array is the value of an array type parameter.","type":"array","items":{"type":"string"}} |
@@ -120,10 +134,10 @@ EOF
       del(.definitions.v1alpha1OptionalMap) |
       # Output for int64 is incorrect, because it is based on proto definitions, where int64 is a string. In our JSON API, we expect int64 to be an integer. https://github.com/grpc-ecosystem/grpc-gateway/issues/219
       (.definitions[]?.properties[]? | select(.type == "string" and .format == "int64")) |= (.type = "integer")
-    ' "${COMBINED_SWAGGER}" | \
-    jq '.definitions.v1Time.type = "string" | .definitions.v1Time.format = "date-time" | del(.definitions.v1Time.properties)' | \
-    jq '.definitions.v1alpha1ResourceNode.allOf = [{"$ref": "#/definitions/v1alpha1ResourceRef"}] | del(.definitions.v1alpha1ResourceNode.properties.resourceRef) ' \
-    > "${SWAGGER_OUT}"
+    ' "${COMBINED_SWAGGER}" |
+        jq '.definitions.v1Time.type = "string" | .definitions.v1Time.format = "date-time" | del(.definitions.v1Time.properties)' |
+        jq '.definitions.v1alpha1ResourceNode.allOf = [{"$ref": "#/definitions/v1alpha1ResourceRef"}] | del(.definitions.v1alpha1ResourceNode.properties.resourceRef) ' \
+            >"${SWAGGER_OUT}"
 
     /bin/rm "${PRIMARY_SWAGGER}" "${COMBINED_SWAGGER}"
 }
@@ -139,4 +153,3 @@ clean_swagger server
 clean_swagger reposerver
 clean_swagger controller
 clean_swagger cmpserver
-
diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index abee0493ead86..9f6d15524d04d 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -19,21 +19,31 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-PROJECT_ROOT=$(cd $(dirname ${BASH_SOURCE})/..; pwd)
+PROJECT_ROOT=$(
+  cd $(dirname ${BASH_SOURCE})/..
+  pwd
+)
 PATH="${PROJECT_ROOT}/dist:${PATH}"
+GOPATH=$(go env GOPATH)
+GOPATH_PROJECT_ROOT="${GOPATH}/src/github.com/argoproj/argo-cd"
 
 TARGET_SCRIPT=/tmp/generate-groups.sh
 
 # codegen utilities are installed outside of generate-groups.sh so remove the `go install` step in the script.
-sed -e '/go install/d' ${PROJECT_ROOT}/vendor/k8s.io/code-generator/generate-groups.sh > ${TARGET_SCRIPT}
+sed -e '/go install/d' ${PROJECT_ROOT}/vendor/k8s.io/code-generator/generate-groups.sh >${TARGET_SCRIPT}
 
 # generate-groups.sh assumes codegen utilities are installed to GOBIN, but we just ensure the CLIs
 # are in the path and invoke them without assumption of their location
 sed -i.bak -e 's#${gobin}/##g' ${TARGET_SCRIPT}
 
 [ -e ./v2 ] || ln -s . v2
+[ -e "${GOPATH_PROJECT_ROOT}" ] || (mkdir -p "$(dirname "${GOPATH_PROJECT_ROOT}")" && ln -s "${PROJECT_ROOT}" "${GOPATH_PROJECT_ROOT}")
+
 bash -x ${TARGET_SCRIPT} "deepcopy,client,informer,lister" \
   github.com/argoproj/argo-cd/v2/pkg/client github.com/argoproj/argo-cd/v2/pkg/apis \
   "application:v1alpha1" \
-  --go-header-file ${PROJECT_ROOT}/hack/custom-boilerplate.go.txt
-[ -e ./v2 ] && rm -rf v2
\ No newline at end of file
+  --go-header-file "${PROJECT_ROOT}/hack/custom-boilerplate.go.txt" \
+  --output-base "${GOPATH}/src"
+
+[ -L "${GOPATH_PROJECT_ROOT}" ] && rm -rf "${GOPATH_PROJECT_ROOT}"
+[ -L ./v2 ] && rm -rf v2
diff --git a/hack/update-openapi.sh b/hack/update-openapi.sh
index 2db84ed5f6242..0250ed45b93ac 100755
--- a/hack/update-openapi.sh
+++ b/hack/update-openapi.sh
@@ -5,20 +5,30 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-PROJECT_ROOT=$(cd $(dirname "$0")/.. ; pwd)
+PROJECT_ROOT=$(
+  cd $(dirname "$0")/..
+  pwd
+)
 PATH="${PROJECT_ROOT}/dist:${PATH}"
+GOPATH=$(go env GOPATH)
+GOPATH_PROJECT_ROOT="${GOPATH}/src/github.com/argoproj/argo-cd"
+
 VERSION="v1alpha1"
- 
+
 [ -e ./v2 ] || ln -s . v2
+[ -e "${GOPATH_PROJECT_ROOT}" ] || (mkdir -p "$(dirname "${GOPATH_PROJECT_ROOT}")" && ln -s "${PROJECT_ROOT}" "${GOPATH_PROJECT_ROOT}")
+
 openapi-gen \
   --go-header-file ${PROJECT_ROOT}/hack/custom-boilerplate.go.txt \
   --input-dirs github.com/argoproj/argo-cd/v2/pkg/apis/application/${VERSION} \
   --output-package github.com/argoproj/argo-cd/v2/pkg/apis/application/${VERSION} \
   --report-filename pkg/apis/api-rules/violation_exceptions.list \
+  --output-base "${GOPATH}/src" \
   $@
-[ -e ./v2 ] && rm -rf v2
+
+[ -L "${GOPATH_PROJECT_ROOT}" ] && rm -rf "${GOPATH_PROJECT_ROOT}"
+[ -L ./v2 ] && rm -rf v2
 
 export GO111MODULE=on
-go build -o ./dist/gen-crd-spec ${PROJECT_ROOT}/hack/gen-crd-spec
+go build -o ./dist/gen-crd-spec "${PROJECT_ROOT}/hack/gen-crd-spec"
 ./dist/gen-crd-spec
-

From cd4fc97c9dee7b69721bbb577a4f50ba897399c5 Mon Sep 17 00:00:00 2001
From: Akram Ben Aissi <akram.benaissi@gmail.com>
Date: Thu, 11 Jan 2024 07:32:11 +0100
Subject: [PATCH 12/13] fix: Use the cache for sharding (#15237)

* feat(sharding): use a cache

Signed-off-by: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>

* cluster cmd

Signed-off-by: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>

* - Assign shard 0 to in-cluster cluster and nil check updates
- Caching clusters while sharding: Fixing unit tests
- Update generated docs
- Debug e2e tests
- Default the shardNumber to the number of replicas if it is calculated to a higher value
- defered Unlock only when a lock is set
- Disabling temporarly other versions of k3s to check if e2e passes
- Do not fail if hostname format is not abc-n
- Fix unit test and skip some e2e
- Skip TestGitSubmoduleHTTPSSupport test
- Remove breaking defer c.lock.Unlock()
- Reverting testing all k3s version
- Default sharding fix
Signed-off-by: Akram Ben Aissi <akram.benaissi@gmail.com>

Signed-off-by: Akram Ben Aissi <akram.benaissi@gmail.com>

* fixes related to code review: renaming structure param, moving db initialisation

Signed-off-by: Akram Ben Aissi <akram.benaissi@gmail.com>

* Code review

Signed-off-by: Akram Ben Aissi <akram.benaissi@gmail.com>

* Set default shard to 0

Signed-off-by: Akram Ben Aissi <akram.benaissi@gmail.com>

* Set different default value for Sts and Deployment mode

Signed-off-by: Akram Ben Aissi <akram.benaissi@gmail.com>

* Expose ClusterShardingCache

Signed-off-by: Akram Ben Aissi <akram.benaissi@gmail.com>

* Removing use of argoDB.db for DistributionFunction

Signed-off-by: Akram Ben Aissi <akram.benaissi@gmail.com>

* Update generated documentation

Signed-off-by: Akram Ben Aissi <akram.benaissi@gmail.com>

* Fix comment about NoShardingDistributionFunction and NoShardingAlgorithm

Signed-off-by: Akram Ben Aissi <akram.benaissi@gmail.com>

---------

Signed-off-by: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>
Signed-off-by: Akram Ben Aissi <akram.benaissi@gmail.com>
Co-authored-by: Alexandre Gaudreault <alexandre.gaudreault@logmein.com>
---
 Makefile                                      |   2 +-
 Procfile                                      |   2 +-
 .../commands/argocd_application_controller.go |  42 ++-
 cmd/argocd/commands/admin/cluster.go          |  30 +-
 common/common.go                              |   2 +-
 controller/appcontroller.go                   |  29 +-
 controller/appcontroller_test.go              |   9 +-
 controller/cache/cache.go                     |  21 +-
 controller/cache/cache_test.go                |  50 ++--
 controller/sharding/cache.go                  | 163 +++++++++++
 controller/sharding/sharding.go               |  64 ++--
 controller/sharding/sharding_test.go          | 275 +++++++++---------
 controller/sharding/shuffle_test.go           |  12 +-
 .../commands/argocd_admin_cluster.md          |   2 +-
 .../commands/argocd_admin_cluster_shards.md   |   3 +-
 .../commands/argocd_admin_cluster_stats.md    |   1 +
 test/e2e/cluster_test.go                      |   2 +-
 17 files changed, 468 insertions(+), 241 deletions(-)
 create mode 100644 controller/sharding/cache.go

diff --git a/Makefile b/Makefile
index 8bd9a49b6bb02..a4d6bd5264624 100644
--- a/Makefile
+++ b/Makefile
@@ -49,7 +49,7 @@ ARGOCD_E2E_DEX_PORT?=5556
 ARGOCD_E2E_YARN_HOST?=localhost
 ARGOCD_E2E_DISABLE_AUTH?=
 
-ARGOCD_E2E_TEST_TIMEOUT?=60m
+ARGOCD_E2E_TEST_TIMEOUT?=90m
 
 ARGOCD_IN_CI?=false
 ARGOCD_TEST_E2E?=true
diff --git a/Procfile b/Procfile
index 3bc2de5eca5e0..4862b0230062f 100644
--- a/Procfile
+++ b/Procfile
@@ -1,4 +1,4 @@
-controller: [ "$BIN_MODE" = 'true' ] && COMMAND=./dist/argocd || COMMAND='go run ./cmd/main.go' && sh -c "FORCE_LOG_COLORS=1 ARGOCD_FAKE_IN_CLUSTER=true ARGOCD_TLS_DATA_PATH=${ARGOCD_TLS_DATA_PATH:-/tmp/argocd-local/tls} ARGOCD_SSH_DATA_PATH=${ARGOCD_SSH_DATA_PATH:-/tmp/argocd-local/ssh} ARGOCD_BINARY_NAME=argocd-application-controller $COMMAND --loglevel debug --redis localhost:${ARGOCD_E2E_REDIS_PORT:-6379} --repo-server localhost:${ARGOCD_E2E_REPOSERVER_PORT:-8081} --otlp-address=${ARGOCD_OTLP_ADDRESS} --application-namespaces=${ARGOCD_APPLICATION_NAMESPACES:-''} --server-side-diff-enabled=${ARGOCD_APPLICATION_CONTROLLER_SERVER_SIDE_DIFF:-'false'}"
+controller: [ "$BIN_MODE" = 'true' ] && COMMAND=./dist/argocd || COMMAND='go run ./cmd/main.go' && sh -c "HOSTNAME=testappcontroller-1  FORCE_LOG_COLORS=1 ARGOCD_FAKE_IN_CLUSTER=true ARGOCD_TLS_DATA_PATH=${ARGOCD_TLS_DATA_PATH:-/tmp/argocd-local/tls} ARGOCD_SSH_DATA_PATH=${ARGOCD_SSH_DATA_PATH:-/tmp/argocd-local/ssh} ARGOCD_BINARY_NAME=argocd-application-controller $COMMAND --loglevel debug --redis localhost:${ARGOCD_E2E_REDIS_PORT:-6379} --repo-server localhost:${ARGOCD_E2E_REPOSERVER_PORT:-8081} --otlp-address=${ARGOCD_OTLP_ADDRESS} --application-namespaces=${ARGOCD_APPLICATION_NAMESPACES:-''} --server-side-diff-enabled=${ARGOCD_APPLICATION_CONTROLLER_SERVER_SIDE_DIFF:-'false'}"
 api-server: [ "$BIN_MODE" = 'true' ] && COMMAND=./dist/argocd || COMMAND='go run ./cmd/main.go' && sh -c "FORCE_LOG_COLORS=1 ARGOCD_FAKE_IN_CLUSTER=true ARGOCD_TLS_DATA_PATH=${ARGOCD_TLS_DATA_PATH:-/tmp/argocd-local/tls} ARGOCD_SSH_DATA_PATH=${ARGOCD_SSH_DATA_PATH:-/tmp/argocd-local/ssh} ARGOCD_BINARY_NAME=argocd-server $COMMAND --loglevel debug --redis localhost:${ARGOCD_E2E_REDIS_PORT:-6379} --disable-auth=${ARGOCD_E2E_DISABLE_AUTH:-'true'} --insecure --dex-server http://localhost:${ARGOCD_E2E_DEX_PORT:-5556} --repo-server localhost:${ARGOCD_E2E_REPOSERVER_PORT:-8081} --port ${ARGOCD_E2E_APISERVER_PORT:-8080} --otlp-address=${ARGOCD_OTLP_ADDRESS} --application-namespaces=${ARGOCD_APPLICATION_NAMESPACES:-''}"
 dex: sh -c "ARGOCD_BINARY_NAME=argocd-dex go run github.com/argoproj/argo-cd/v2/cmd gendexcfg -o `pwd`/dist/dex.yaml && (test -f dist/dex.yaml || { echo 'Failed to generate dex configuration'; exit 1; }) && docker run --rm -p ${ARGOCD_E2E_DEX_PORT:-5556}:${ARGOCD_E2E_DEX_PORT:-5556} -v `pwd`/dist/dex.yaml:/dex.yaml ghcr.io/dexidp/dex:$(grep "image: ghcr.io/dexidp/dex" manifests/base/dex/argocd-dex-server-deployment.yaml | cut -d':' -f3) dex serve /dex.yaml"
 redis: bash -c "if [ \"$ARGOCD_REDIS_LOCAL\" = 'true' ]; then redis-server --save '' --appendonly no --port ${ARGOCD_E2E_REDIS_PORT:-6379}; else docker run --rm --name argocd-redis -i -p ${ARGOCD_E2E_REDIS_PORT:-6379}:${ARGOCD_E2E_REDIS_PORT:-6379} docker.io/library/redis:$(grep "image: redis" manifests/base/redis/argocd-redis-deployment.yaml | cut -d':' -f3) --save '' --appendonly no --port ${ARGOCD_E2E_REDIS_PORT:-6379}; fi"
diff --git a/cmd/argocd-application-controller/commands/argocd_application_controller.go b/cmd/argocd-application-controller/commands/argocd_application_controller.go
index d5ef88a1702b6..135bcab3a7298 100644
--- a/cmd/argocd-application-controller/commands/argocd_application_controller.go
+++ b/cmd/argocd-application-controller/commands/argocd_application_controller.go
@@ -146,7 +146,7 @@ func NewCommand() *cobra.Command {
 				appController.InvalidateProjectsCache()
 			}))
 			kubectl := kubeutil.NewKubectl()
-			clusterFilter := getClusterFilter(kubeClient, settingsMgr, shardingAlgorithm, enableDynamicClusterDistribution)
+			clusterSharding := getClusterSharding(kubeClient, settingsMgr, shardingAlgorithm, enableDynamicClusterDistribution)
 			appController, err = controller.NewApplicationController(
 				namespace,
 				settingsMgr,
@@ -164,7 +164,7 @@ func NewCommand() *cobra.Command {
 				metricsAplicationLabels,
 				kubectlParallelismLimit,
 				persistResourceHealth,
-				clusterFilter,
+				clusterSharding,
 				applicationNamespaces,
 				&workqueueRateLimit,
 				serverSideDiff,
@@ -235,11 +235,10 @@ func NewCommand() *cobra.Command {
 	return &command
 }
 
-func getClusterFilter(kubeClient *kubernetes.Clientset, settingsMgr *settings.SettingsManager, shardingAlgorithm string, enableDynamicClusterDistribution bool) sharding.ClusterFilterFunction {
-
-	var replicas int
-	shard := env.ParseNumFromEnv(common.EnvControllerShard, -1, -math.MaxInt32, math.MaxInt32)
-
+func getClusterSharding(kubeClient *kubernetes.Clientset, settingsMgr *settings.SettingsManager, shardingAlgorithm string, enableDynamicClusterDistribution bool) sharding.ClusterShardingCache {
+	var replicasCount int
+	// StatefulSet mode and Deployment mode uses different default values for shard number.
+	defaultShardNumberValue := 0
 	applicationControllerName := env.StringFromEnv(common.EnvAppControllerName, common.DefaultApplicationControllerName)
 	appControllerDeployment, err := kubeClient.AppsV1().Deployments(settingsMgr.GetNamespace()).Get(context.Background(), applicationControllerName, metav1.GetOptions{})
 
@@ -249,22 +248,21 @@ func getClusterFilter(kubeClient *kubernetes.Clientset, settingsMgr *settings.Se
 	}
 
 	if enableDynamicClusterDistribution && appControllerDeployment != nil && appControllerDeployment.Spec.Replicas != nil {
-		replicas = int(*appControllerDeployment.Spec.Replicas)
+		replicasCount = int(*appControllerDeployment.Spec.Replicas)
+		defaultShardNumberValue = -1
 	} else {
-		replicas = env.ParseNumFromEnv(common.EnvControllerReplicas, 0, 0, math.MaxInt32)
+		replicasCount = env.ParseNumFromEnv(common.EnvControllerReplicas, 0, 0, math.MaxInt32)
 	}
-
-	var clusterFilter func(cluster *v1alpha1.Cluster) bool
-	if replicas > 1 {
+	shardNumber := env.ParseNumFromEnv(common.EnvControllerShard, defaultShardNumberValue, -math.MaxInt32, math.MaxInt32)
+	if replicasCount > 1 {
 		// check for shard mapping using configmap if application-controller is a deployment
 		// else use existing logic to infer shard from pod name if application-controller is a statefulset
 		if enableDynamicClusterDistribution && appControllerDeployment != nil {
-
 			var err error
 			// retry 3 times if we find a conflict while updating shard mapping configMap.
 			// If we still see conflicts after the retries, wait for next iteration of heartbeat process.
 			for i := 0; i <= common.AppControllerHeartbeatUpdateRetryCount; i++ {
-				shard, err = sharding.GetOrUpdateShardFromConfigMap(kubeClient, settingsMgr, replicas, shard)
+				shardNumber, err = sharding.GetOrUpdateShardFromConfigMap(kubeClient, settingsMgr, replicasCount, shardNumber)
 				if !kubeerrors.IsConflict(err) {
 					err = fmt.Errorf("unable to get shard due to error updating the sharding config map: %s", err)
 					break
@@ -273,19 +271,19 @@ func getClusterFilter(kubeClient *kubernetes.Clientset, settingsMgr *settings.Se
 			}
 			errors.CheckError(err)
 		} else {
-			if shard < 0 {
+			if shardNumber < 0 {
 				var err error
-				shard, err = sharding.InferShard()
+				shardNumber, err = sharding.InferShard()
 				errors.CheckError(err)
 			}
+			if shardNumber > replicasCount {
+				log.Warnf("Calculated shard number %d is greated than the number of replicas count. Defaulting to 0", shardNumber)
+				shardNumber = 0
+			}
 		}
-		log.Infof("Processing clusters from shard %d", shard)
-		db := db.NewDB(settingsMgr.GetNamespace(), settingsMgr, kubeClient)
-		log.Infof("Using filter function:  %s", shardingAlgorithm)
-		distributionFunction := sharding.GetDistributionFunction(db, shardingAlgorithm)
-		clusterFilter = sharding.GetClusterFilter(db, distributionFunction, shard)
 	} else {
 		log.Info("Processing all cluster shards")
 	}
-	return clusterFilter
+	db := db.NewDB(settingsMgr.GetNamespace(), settingsMgr, kubeClient)
+	return sharding.NewClusterSharding(db, shardNumber, replicasCount, shardingAlgorithm)
 }
diff --git a/cmd/argocd/commands/admin/cluster.go b/cmd/argocd/commands/admin/cluster.go
index 5d14717a15e7d..6f626dd8d0534 100644
--- a/cmd/argocd/commands/admin/cluster.go
+++ b/cmd/argocd/commands/admin/cluster.go
@@ -25,6 +25,7 @@ import (
 	"github.com/argoproj/argo-cd/v2/common"
 	"github.com/argoproj/argo-cd/v2/controller/sharding"
 	argocdclient "github.com/argoproj/argo-cd/v2/pkg/apiclient"
+	"github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 	argoappv1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 	"github.com/argoproj/argo-cd/v2/pkg/client/clientset/versioned"
 	"github.com/argoproj/argo-cd/v2/util/argo"
@@ -78,7 +79,7 @@ type ClusterWithInfo struct {
 	Namespaces []string
 }
 
-func loadClusters(ctx context.Context, kubeClient *kubernetes.Clientset, appClient *versioned.Clientset, replicas int, namespace string, portForwardRedis bool, cacheSrc func() (*appstatecache.Cache, error), shard int, redisName string, redisHaProxyName string, redisCompressionStr string) ([]ClusterWithInfo, error) {
+func loadClusters(ctx context.Context, kubeClient *kubernetes.Clientset, appClient *versioned.Clientset, replicas int, shardingAlgorithm string, namespace string, portForwardRedis bool, cacheSrc func() (*appstatecache.Cache, error), shard int, redisName string, redisHaProxyName string, redisCompressionStr string) ([]ClusterWithInfo, error) {
 	settingsMgr := settings.NewSettingsManager(ctx, kubeClient, namespace)
 
 	argoDB := db.NewDB(namespace, settingsMgr, kubeClient)
@@ -86,6 +87,10 @@ func loadClusters(ctx context.Context, kubeClient *kubernetes.Clientset, appClie
 	if err != nil {
 		return nil, err
 	}
+	clusterShardingCache := sharding.NewClusterSharding(argoDB, shard, replicas, shardingAlgorithm)
+	clusterShardingCache.Init(clustersList)
+	clusterShards := clusterShardingCache.GetDistribution()
+
 	var cache *appstatecache.Cache
 	if portForwardRedis {
 		overrides := clientcmd.ConfigOverrides{}
@@ -122,8 +127,15 @@ func loadClusters(ctx context.Context, kubeClient *kubernetes.Clientset, appClie
 		apps[i] = app
 	}
 	clusters := make([]ClusterWithInfo, len(clustersList.Items))
+
 	batchSize := 10
 	batchesCount := int(math.Ceil(float64(len(clusters)) / float64(batchSize)))
+	clusterSharding := &sharding.ClusterSharding{
+		Shard:    shard,
+		Replicas: replicas,
+		Shards:   make(map[string]int),
+		Clusters: make(map[string]*v1alpha1.Cluster),
+	}
 	for batchNum := 0; batchNum < batchesCount; batchNum++ {
 		batchStart := batchSize * batchNum
 		batchEnd := batchSize * (batchNum + 1)
@@ -135,12 +147,12 @@ func loadClusters(ctx context.Context, kubeClient *kubernetes.Clientset, appClie
 			clusterShard := 0
 			cluster := batch[i]
 			if replicas > 0 {
-				distributionFunction := sharding.GetDistributionFunction(argoDB, common.DefaultShardingAlgorithm)
+				distributionFunction := sharding.GetDistributionFunction(clusterSharding.GetClusterAccessor(), common.DefaultShardingAlgorithm, replicas)
 				distributionFunction(&cluster)
+				clusterShard := clusterShards[cluster.Server]
 				cluster.Shard = pointer.Int64(int64(clusterShard))
 				log.Infof("Cluster with uid: %s will be processed by shard %d", cluster.ID, clusterShard)
 			}
-
 			if shard != -1 && clusterShard != shard {
 				return nil
 			}
@@ -176,6 +188,7 @@ func NewClusterShardsCommand(clientOpts *argocdclient.ClientOptions) *cobra.Comm
 	var (
 		shard               int
 		replicas            int
+		shardingAlgorithm   string
 		clientConfig        clientcmd.ClientConfig
 		cacheSrc            func() (*appstatecache.Cache, error)
 		portForwardRedis    bool
@@ -183,7 +196,7 @@ func NewClusterShardsCommand(clientOpts *argocdclient.ClientOptions) *cobra.Comm
 	)
 	var command = cobra.Command{
 		Use:   "shards",
-		Short: "Print information about each controller shard and portion of Kubernetes resources it is responsible for.",
+		Short: "Print information about each controller shard and the estimated portion of Kubernetes resources it is responsible for.",
 		Run: func(cmd *cobra.Command, args []string) {
 			ctx := cmd.Context()
 
@@ -203,8 +216,7 @@ func NewClusterShardsCommand(clientOpts *argocdclient.ClientOptions) *cobra.Comm
 			if replicas == 0 {
 				return
 			}
-
-			clusters, err := loadClusters(ctx, kubeClient, appClient, replicas, namespace, portForwardRedis, cacheSrc, shard, clientOpts.RedisName, clientOpts.RedisHaProxyName, redisCompressionStr)
+			clusters, err := loadClusters(ctx, kubeClient, appClient, replicas, shardingAlgorithm, namespace, portForwardRedis, cacheSrc, shard, clientOpts.RedisName, clientOpts.RedisHaProxyName, redisCompressionStr)
 			errors.CheckError(err)
 			if len(clusters) == 0 {
 				return
@@ -216,7 +228,9 @@ func NewClusterShardsCommand(clientOpts *argocdclient.ClientOptions) *cobra.Comm
 	clientConfig = cli.AddKubectlFlagsToCmd(&command)
 	command.Flags().IntVar(&shard, "shard", -1, "Cluster shard filter")
 	command.Flags().IntVar(&replicas, "replicas", 0, "Application controller replicas count. Inferred from number of running controller pods if not specified")
+	command.Flags().StringVar(&shardingAlgorithm, "sharding-method", common.DefaultShardingAlgorithm, "Sharding method. Defaults: legacy. Supported sharding methods are : [legacy, round-robin] ")
 	command.Flags().BoolVar(&portForwardRedis, "port-forward-redis", true, "Automatically port-forward ha proxy redis from current namespace?")
+
 	cacheSrc = appstatecache.AddCacheFlagsToCmd(&command)
 
 	// parse all added flags so far to get the redis-compression flag that was added by AddCacheFlagsToCmd() above
@@ -461,6 +475,7 @@ func NewClusterStatsCommand(clientOpts *argocdclient.ClientOptions) *cobra.Comma
 	var (
 		shard               int
 		replicas            int
+		shardingAlgorithm   string
 		clientConfig        clientcmd.ClientConfig
 		cacheSrc            func() (*appstatecache.Cache, error)
 		portForwardRedis    bool
@@ -494,7 +509,7 @@ argocd admin cluster stats target-cluster`,
 				replicas, err = getControllerReplicas(ctx, kubeClient, namespace, clientOpts.AppControllerName)
 				errors.CheckError(err)
 			}
-			clusters, err := loadClusters(ctx, kubeClient, appClient, replicas, namespace, portForwardRedis, cacheSrc, shard, clientOpts.RedisName, clientOpts.RedisHaProxyName, redisCompressionStr)
+			clusters, err := loadClusters(ctx, kubeClient, appClient, replicas, shardingAlgorithm, namespace, portForwardRedis, cacheSrc, shard, clientOpts.RedisName, clientOpts.RedisHaProxyName, redisCompressionStr)
 			errors.CheckError(err)
 
 			w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
@@ -508,6 +523,7 @@ argocd admin cluster stats target-cluster`,
 	clientConfig = cli.AddKubectlFlagsToCmd(&command)
 	command.Flags().IntVar(&shard, "shard", -1, "Cluster shard filter")
 	command.Flags().IntVar(&replicas, "replicas", 0, "Application controller replicas count. Inferred from number of running controller pods if not specified")
+	command.Flags().StringVar(&shardingAlgorithm, "sharding-method", common.DefaultShardingAlgorithm, "Sharding method. Defaults: legacy. Supported sharding methods are : [legacy, round-robin] ")
 	command.Flags().BoolVar(&portForwardRedis, "port-forward-redis", true, "Automatically port-forward ha proxy redis from current namespace?")
 	cacheSrc = appstatecache.AddCacheFlagsToCmd(&command)
 
diff --git a/common/common.go b/common/common.go
index c5b9362f7f943..2f053d7a28198 100644
--- a/common/common.go
+++ b/common/common.go
@@ -115,9 +115,9 @@ const (
 	LegacyShardingAlgorithm = "legacy"
 	// RoundRobinShardingAlgorithm is a flag value that can be opted for Sharding Algorithm it uses an equal distribution accross all shards
 	RoundRobinShardingAlgorithm = "round-robin"
-	DefaultShardingAlgorithm    = LegacyShardingAlgorithm
 	// AppControllerHeartbeatUpdateRetryCount is the retry count for updating the Shard Mapping to the Shard Mapping ConfigMap used by Application Controller
 	AppControllerHeartbeatUpdateRetryCount = 3
+	DefaultShardingAlgorithm               = LegacyShardingAlgorithm
 )
 
 // Dex related constants
diff --git a/controller/appcontroller.go b/controller/appcontroller.go
index 0ded95de65d15..c3498f831566c 100644
--- a/controller/appcontroller.go
+++ b/controller/appcontroller.go
@@ -126,7 +126,7 @@ type ApplicationController struct {
 	refreshRequestedAppsMutex     *sync.Mutex
 	metricsServer                 *metrics.MetricsServer
 	kubectlSemaphore              *semaphore.Weighted
-	clusterFilter                 func(cluster *appv1.Cluster) bool
+	clusterSharding               sharding.ClusterShardingCache
 	projByNameCache               sync.Map
 	applicationNamespaces         []string
 }
@@ -149,7 +149,7 @@ func NewApplicationController(
 	metricsApplicationLabels []string,
 	kubectlParallelismLimit int64,
 	persistResourceHealth bool,
-	clusterFilter func(cluster *appv1.Cluster) bool,
+	clusterSharding sharding.ClusterShardingCache,
 	applicationNamespaces []string,
 	rateLimiterConfig *ratelimiter.AppControllerRateLimiterConfig,
 	serverSideDiff bool,
@@ -179,7 +179,7 @@ func NewApplicationController(
 		auditLogger:                   argo.NewAuditLogger(namespace, kubeClientset, common.ApplicationController),
 		settingsMgr:                   settingsMgr,
 		selfHealTimeout:               selfHealTimeout,
-		clusterFilter:                 clusterFilter,
+		clusterSharding:               clusterSharding,
 		projByNameCache:               sync.Map{},
 		applicationNamespaces:         applicationNamespaces,
 	}
@@ -260,7 +260,7 @@ func NewApplicationController(
 			return nil, err
 		}
 	}
-	stateCache := statecache.NewLiveStateCache(db, appInformer, ctrl.settingsMgr, kubectl, ctrl.metricsServer, ctrl.handleObjectUpdated, clusterFilter, argo.NewResourceTracking())
+	stateCache := statecache.NewLiveStateCache(db, appInformer, ctrl.settingsMgr, kubectl, ctrl.metricsServer, ctrl.handleObjectUpdated, clusterSharding, argo.NewResourceTracking())
 	appStateManager := NewAppStateManager(db, applicationClientset, repoClientset, namespace, kubectl, ctrl.settingsMgr, stateCache, projInformer, ctrl.metricsServer, argoCache, ctrl.statusRefreshTimeout, argo.NewResourceTracking(), persistResourceHealth, repoErrorGracePeriod, serverSideDiff)
 	ctrl.appInformer = appInformer
 	ctrl.appLister = appLister
@@ -772,6 +772,13 @@ func (ctrl *ApplicationController) Run(ctx context.Context, statusProcessors int
 	go ctrl.projInformer.Run(ctx.Done())
 	go ctrl.deploymentInformer.Informer().Run(ctx.Done())
 
+	clusters, err := ctrl.db.ListClusters(ctx)
+	if err != nil {
+		log.Warnf("Cannot init sharding. Error while querying clusters list from database: %v", err)
+	} else {
+		ctrl.clusterSharding.Init(clusters)
+	}
+
 	errors.CheckError(ctrl.stateCache.Init())
 
 	if !cache.WaitForCacheSync(ctx.Done(), ctrl.appInformer.HasSynced, ctrl.projInformer.HasSynced) {
@@ -1976,15 +1983,11 @@ func (ctrl *ApplicationController) canProcessApp(obj interface{}) bool {
 		}
 	}
 
-	if ctrl.clusterFilter != nil {
-		cluster, err := ctrl.db.GetCluster(context.Background(), app.Spec.Destination.Server)
-		if err != nil {
-			return ctrl.clusterFilter(nil)
-		}
-		return ctrl.clusterFilter(cluster)
+	cluster, err := ctrl.db.GetCluster(context.Background(), app.Spec.Destination.Server)
+	if err != nil {
+		return ctrl.clusterSharding.IsManagedCluster(nil)
 	}
-
-	return true
+	return ctrl.clusterSharding.IsManagedCluster(cluster)
 }
 
 func (ctrl *ApplicationController) newApplicationInformerAndLister() (cache.SharedIndexInformer, applisters.ApplicationLister) {
@@ -2136,7 +2139,7 @@ func (ctrl *ApplicationController) projectErrorToCondition(err error, app *appv1
 }
 
 func (ctrl *ApplicationController) RegisterClusterSecretUpdater(ctx context.Context) {
-	updater := NewClusterInfoUpdater(ctrl.stateCache, ctrl.db, ctrl.appLister.Applications(""), ctrl.cache, ctrl.clusterFilter, ctrl.getAppProj, ctrl.namespace)
+	updater := NewClusterInfoUpdater(ctrl.stateCache, ctrl.db, ctrl.appLister.Applications(""), ctrl.cache, ctrl.clusterSharding.IsManagedCluster, ctrl.getAppProj, ctrl.namespace)
 	go updater.Run(ctx)
 }
 
diff --git a/controller/appcontroller_test.go b/controller/appcontroller_test.go
index bf3d8bb3a2e4c..131c1deab99b0 100644
--- a/controller/appcontroller_test.go
+++ b/controller/appcontroller_test.go
@@ -17,7 +17,9 @@ import (
 
 	"github.com/argoproj/argo-cd/v2/common"
 	statecache "github.com/argoproj/argo-cd/v2/controller/cache"
+	"github.com/argoproj/argo-cd/v2/controller/sharding"
 
+	dbmocks "github.com/argoproj/argo-cd/v2/util/db/mocks"
 	"github.com/argoproj/gitops-engine/pkg/cache/mocks"
 	synccommon "github.com/argoproj/gitops-engine/pkg/sync/common"
 	"github.com/argoproj/gitops-engine/pkg/utils/kube"
@@ -154,6 +156,10 @@ func newFakeController(data *fakeData, repoErr error) *ApplicationController {
 		nil,
 		false,
 	)
+	db := &dbmocks.ArgoDB{}
+	db.On("GetApplicationControllerReplicas").Return(1)
+	// Setting a default sharding algorithm for the tests where we cannot set it.
+	ctrl.clusterSharding = sharding.NewClusterSharding(db, 0, 1, common.DefaultShardingAlgorithm)
 	if err != nil {
 		panic(err)
 	}
@@ -686,7 +692,6 @@ func TestFinalizeAppDeletion(t *testing.T) {
 		ctrl := newFakeController(&fakeData{apps: []runtime.Object{app, &defaultProj}, managedLiveObjs: map[kube.ResourceKey]*unstructured.Unstructured{
 			kube.GetResourceKey(appObj): appObj,
 		}}, nil)
-
 		patched := false
 		fakeAppCs := ctrl.applicationClientset.(*appclientset.Clientset)
 		defaultReactor := fakeAppCs.ReactionChain[0]
@@ -1809,13 +1814,11 @@ func Test_canProcessApp(t *testing.T) {
 	})
 	t.Run("with cluster filter, good namespace", func(t *testing.T) {
 		app.Namespace = "good"
-		ctrl.clusterFilter = func(_ *v1alpha1.Cluster) bool { return true }
 		canProcess := ctrl.canProcessApp(app)
 		assert.True(t, canProcess)
 	})
 	t.Run("with cluster filter, bad namespace", func(t *testing.T) {
 		app.Namespace = "bad"
-		ctrl.clusterFilter = func(_ *v1alpha1.Cluster) bool { return true }
 		canProcess := ctrl.canProcessApp(app)
 		assert.False(t, canProcess)
 	})
diff --git a/controller/cache/cache.go b/controller/cache/cache.go
index 9eac161714089..e3b1d7b77f19d 100644
--- a/controller/cache/cache.go
+++ b/controller/cache/cache.go
@@ -29,6 +29,7 @@ import (
 	"k8s.io/client-go/tools/cache"
 
 	"github.com/argoproj/argo-cd/v2/controller/metrics"
+	"github.com/argoproj/argo-cd/v2/controller/sharding"
 	"github.com/argoproj/argo-cd/v2/pkg/apis/application"
 	appv1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 	"github.com/argoproj/argo-cd/v2/util/argo"
@@ -168,7 +169,7 @@ func NewLiveStateCache(
 	kubectl kube.Kubectl,
 	metricsServer *metrics.MetricsServer,
 	onObjectUpdated ObjectUpdatedHandler,
-	clusterFilter func(cluster *appv1.Cluster) bool,
+	clusterSharding sharding.ClusterShardingCache,
 	resourceTracking argo.ResourceTracking) LiveStateCache {
 
 	return &liveStateCache{
@@ -179,7 +180,7 @@ func NewLiveStateCache(
 		kubectl:          kubectl,
 		settingsMgr:      settingsMgr,
 		metricsServer:    metricsServer,
-		clusterFilter:    clusterFilter,
+		clusterSharding:  clusterSharding,
 		resourceTracking: resourceTracking,
 	}
 }
@@ -202,7 +203,7 @@ type liveStateCache struct {
 	kubectl          kube.Kubectl
 	settingsMgr      *settings.SettingsManager
 	metricsServer    *metrics.MetricsServer
-	clusterFilter    func(cluster *appv1.Cluster) bool
+	clusterSharding  sharding.ClusterShardingCache
 	resourceTracking argo.ResourceTracking
 
 	clusters      map[string]clustercache.ClusterCache
@@ -722,22 +723,24 @@ func (c *liveStateCache) Run(ctx context.Context) error {
 }
 
 func (c *liveStateCache) canHandleCluster(cluster *appv1.Cluster) bool {
-	if c.clusterFilter == nil {
-		return true
-	}
-	return c.clusterFilter(cluster)
+	return c.clusterSharding.IsManagedCluster(cluster)
 }
 
 func (c *liveStateCache) handleAddEvent(cluster *appv1.Cluster) {
+	c.clusterSharding.Add(cluster)
 	if !c.canHandleCluster(cluster) {
 		log.Infof("Ignoring cluster %s", cluster.Server)
 		return
 	}
-
 	c.lock.Lock()
 	_, ok := c.clusters[cluster.Server]
 	c.lock.Unlock()
 	if !ok {
+		log.Debugf("Checking if cache %v / cluster %v has appInformer %v", c, cluster, c.appInformer)
+		if c.appInformer == nil {
+			log.Warn("Cannot get a cluster appInformer. Cache may not be started this time")
+			return
+		}
 		if c.isClusterHasApps(c.appInformer.GetStore().List(), cluster) {
 			go func() {
 				// warm up cache for cluster with apps
@@ -748,6 +751,7 @@ func (c *liveStateCache) handleAddEvent(cluster *appv1.Cluster) {
 }
 
 func (c *liveStateCache) handleModEvent(oldCluster *appv1.Cluster, newCluster *appv1.Cluster) {
+	c.clusterSharding.Update(newCluster)
 	c.lock.Lock()
 	cluster, ok := c.clusters[newCluster.Server]
 	c.lock.Unlock()
@@ -790,6 +794,7 @@ func (c *liveStateCache) handleModEvent(oldCluster *appv1.Cluster, newCluster *a
 
 func (c *liveStateCache) handleDeleteEvent(clusterServer string) {
 	c.lock.RLock()
+	c.clusterSharding.Delete(clusterServer)
 	cluster, ok := c.clusters[clusterServer]
 	c.lock.RUnlock()
 	if ok {
diff --git a/controller/cache/cache_test.go b/controller/cache/cache_test.go
index c94038a89b881..53a03ca81995e 100644
--- a/controller/cache/cache_test.go
+++ b/controller/cache/cache_test.go
@@ -21,7 +21,11 @@ import (
 	"github.com/stretchr/testify/mock"
 	"k8s.io/client-go/kubernetes/fake"
 
+	"github.com/argoproj/argo-cd/v2/common"
+	"github.com/argoproj/argo-cd/v2/controller/metrics"
+	"github.com/argoproj/argo-cd/v2/controller/sharding"
 	appv1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
+	dbmocks "github.com/argoproj/argo-cd/v2/util/db/mocks"
 	argosettings "github.com/argoproj/argo-cd/v2/util/settings"
 )
 
@@ -35,11 +39,13 @@ func TestHandleModEvent_HasChanges(t *testing.T) {
 	clusterCache := &mocks.ClusterCache{}
 	clusterCache.On("Invalidate", mock.Anything, mock.Anything).Return(nil).Once()
 	clusterCache.On("EnsureSynced").Return(nil).Once()
-
+	db := &dbmocks.ArgoDB{}
+	db.On("GetApplicationControllerReplicas").Return(1)
 	clustersCache := liveStateCache{
 		clusters: map[string]cache.ClusterCache{
 			"https://mycluster": clusterCache,
 		},
+		clusterSharding: sharding.NewClusterSharding(db, 0, 1, common.DefaultShardingAlgorithm),
 	}
 
 	clustersCache.handleModEvent(&appv1.Cluster{
@@ -56,14 +62,22 @@ func TestHandleModEvent_ClusterExcluded(t *testing.T) {
 	clusterCache := &mocks.ClusterCache{}
 	clusterCache.On("Invalidate", mock.Anything, mock.Anything).Return(nil).Once()
 	clusterCache.On("EnsureSynced").Return(nil).Once()
-
+	db := &dbmocks.ArgoDB{}
+	db.On("GetApplicationControllerReplicas").Return(1)
 	clustersCache := liveStateCache{
-		clusters: map[string]cache.ClusterCache{
-			"https://mycluster": clusterCache,
-		},
-		clusterFilter: func(cluster *appv1.Cluster) bool {
-			return false
+		db:          nil,
+		appInformer: nil,
+		onObjectUpdated: func(managedByApp map[string]bool, ref v1.ObjectReference) {
 		},
+		kubectl:       nil,
+		settingsMgr:   &argosettings.SettingsManager{},
+		metricsServer: &metrics.MetricsServer{},
+		// returns a shard that never process any cluster
+		clusterSharding:  sharding.NewClusterSharding(db, 0, 1, common.DefaultShardingAlgorithm),
+		resourceTracking: nil,
+		clusters:         map[string]cache.ClusterCache{"https://mycluster": clusterCache},
+		cacheSettings:    cacheSettings{},
+		lock:             sync.RWMutex{},
 	}
 
 	clustersCache.handleModEvent(&appv1.Cluster{
@@ -75,18 +89,20 @@ func TestHandleModEvent_ClusterExcluded(t *testing.T) {
 		Namespaces: []string{"default"},
 	})
 
-	assert.Len(t, clustersCache.clusters, 0)
+	assert.Len(t, clustersCache.clusters, 1)
 }
 
 func TestHandleModEvent_NoChanges(t *testing.T) {
 	clusterCache := &mocks.ClusterCache{}
 	clusterCache.On("Invalidate", mock.Anything).Panic("should not invalidate")
 	clusterCache.On("EnsureSynced").Return(nil).Panic("should not re-sync")
-
+	db := &dbmocks.ArgoDB{}
+	db.On("GetApplicationControllerReplicas").Return(1)
 	clustersCache := liveStateCache{
 		clusters: map[string]cache.ClusterCache{
 			"https://mycluster": clusterCache,
 		},
+		clusterSharding: sharding.NewClusterSharding(db, 0, 1, common.DefaultShardingAlgorithm),
 	}
 
 	clustersCache.handleModEvent(&appv1.Cluster{
@@ -99,11 +115,11 @@ func TestHandleModEvent_NoChanges(t *testing.T) {
 }
 
 func TestHandleAddEvent_ClusterExcluded(t *testing.T) {
+	db := &dbmocks.ArgoDB{}
+	db.On("GetApplicationControllerReplicas").Return(1)
 	clustersCache := liveStateCache{
-		clusters: map[string]cache.ClusterCache{},
-		clusterFilter: func(cluster *appv1.Cluster) bool {
-			return false
-		},
+		clusters:        map[string]cache.ClusterCache{},
+		clusterSharding: sharding.NewClusterSharding(db, 0, 2, common.DefaultShardingAlgorithm),
 	}
 	clustersCache.handleAddEvent(&appv1.Cluster{
 		Server: "https://mycluster",
@@ -118,6 +134,8 @@ func TestHandleDeleteEvent_CacheDeadlock(t *testing.T) {
 		Server: "https://mycluster",
 		Config: appv1.ClusterConfig{Username: "bar"},
 	}
+	db := &dbmocks.ArgoDB{}
+	db.On("GetApplicationControllerReplicas").Return(1)
 	fakeClient := fake.NewSimpleClientset()
 	settingsMgr := argosettings.NewSettingsManager(context.TODO(), fakeClient, "argocd")
 	liveStateCacheLock := sync.RWMutex{}
@@ -126,10 +144,8 @@ func TestHandleDeleteEvent_CacheDeadlock(t *testing.T) {
 		clusters: map[string]cache.ClusterCache{
 			testCluster.Server: gitopsEngineClusterCache,
 		},
-		clusterFilter: func(cluster *appv1.Cluster) bool {
-			return true
-		},
-		settingsMgr: settingsMgr,
+		clusterSharding: sharding.NewClusterSharding(db, 0, 1, common.DefaultShardingAlgorithm),
+		settingsMgr:     settingsMgr,
 		// Set the lock here so we can reference it later
 		// nolint We need to overwrite here to have access to the lock
 		lock: liveStateCacheLock,
diff --git a/controller/sharding/cache.go b/controller/sharding/cache.go
new file mode 100644
index 0000000000000..d16574accdf8a
--- /dev/null
+++ b/controller/sharding/cache.go
@@ -0,0 +1,163 @@
+package sharding
+
+import (
+	"sync"
+
+	"github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
+	"github.com/argoproj/argo-cd/v2/util/db"
+	log "github.com/sirupsen/logrus"
+)
+
+type ClusterShardingCache interface {
+	Init(clusters *v1alpha1.ClusterList)
+	Add(c *v1alpha1.Cluster)
+	Delete(clusterServer string)
+	Update(c *v1alpha1.Cluster)
+	IsManagedCluster(c *v1alpha1.Cluster) bool
+	GetDistribution() map[string]int
+}
+
+type ClusterSharding struct {
+	Shard           int
+	Replicas        int
+	Shards          map[string]int
+	Clusters        map[string]*v1alpha1.Cluster
+	lock            sync.RWMutex
+	getClusterShard DistributionFunction
+}
+
+func NewClusterSharding(db db.ArgoDB, shard, replicas int, shardingAlgorithm string) ClusterShardingCache {
+	log.Debugf("Processing clusters from shard %d: Using filter function:  %s", shard, shardingAlgorithm)
+	clusterSharding := &ClusterSharding{
+		Shard:    shard,
+		Replicas: replicas,
+		Shards:   make(map[string]int),
+		Clusters: make(map[string]*v1alpha1.Cluster),
+	}
+	distributionFunction := NoShardingDistributionFunction()
+	if replicas > 1 {
+		log.Debugf("Processing clusters from shard %d: Using filter function:  %s", shard, shardingAlgorithm)
+		distributionFunction = GetDistributionFunction(clusterSharding.GetClusterAccessor(), shardingAlgorithm, replicas)
+	} else {
+		log.Info("Processing all cluster shards")
+	}
+	clusterSharding.getClusterShard = distributionFunction
+	return clusterSharding
+}
+
+// IsManagedCluster returns wheter or not the cluster should be processed by a given shard.
+func (s *ClusterSharding) IsManagedCluster(c *v1alpha1.Cluster) bool {
+	s.lock.RLock()
+	defer s.lock.RUnlock()
+	if c == nil { // nil cluster (in-cluster) is always managed by current clusterShard
+		return true
+	}
+	clusterShard := 0
+	if shard, ok := s.Shards[c.Server]; ok {
+		clusterShard = shard
+	} else {
+		log.Warnf("The cluster %s has no assigned shard.", c.Server)
+	}
+	log.Debugf("Checking if cluster %s with clusterShard %d should be processed by shard %d", c.Server, clusterShard, s.Shard)
+	return clusterShard == s.Shard
+}
+
+func (sharding *ClusterSharding) Init(clusters *v1alpha1.ClusterList) {
+	sharding.lock.Lock()
+	defer sharding.lock.Unlock()
+	newClusters := make(map[string]*v1alpha1.Cluster, len(clusters.Items))
+	for _, c := range clusters.Items {
+		newClusters[c.Server] = &c
+	}
+	sharding.Clusters = newClusters
+	sharding.updateDistribution()
+}
+
+func (sharding *ClusterSharding) Add(c *v1alpha1.Cluster) {
+	sharding.lock.Lock()
+	defer sharding.lock.Unlock()
+
+	old, ok := sharding.Clusters[c.Server]
+	sharding.Clusters[c.Server] = c
+	if !ok || hasShardingUpdates(old, c) {
+		sharding.updateDistribution()
+	} else {
+		log.Debugf("Skipping sharding distribution update. Cluster already added")
+	}
+}
+
+func (sharding *ClusterSharding) Delete(clusterServer string) {
+	sharding.lock.Lock()
+	defer sharding.lock.Unlock()
+	if _, ok := sharding.Clusters[clusterServer]; ok {
+		delete(sharding.Clusters, clusterServer)
+		delete(sharding.Shards, clusterServer)
+		sharding.updateDistribution()
+	}
+}
+
+func (sharding *ClusterSharding) Update(c *v1alpha1.Cluster) {
+	sharding.lock.Lock()
+	defer sharding.lock.Unlock()
+
+	old, ok := sharding.Clusters[c.Server]
+	sharding.Clusters[c.Server] = c
+	if !ok || hasShardingUpdates(old, c) {
+		sharding.updateDistribution()
+	} else {
+		log.Debugf("Skipping sharding distribution update. No relevant changes")
+	}
+}
+
+func (sharding *ClusterSharding) GetDistribution() map[string]int {
+	sharding.lock.RLock()
+	shards := sharding.Shards
+	sharding.lock.RUnlock()
+
+	distribution := make(map[string]int, len(shards))
+	for k, v := range shards {
+		distribution[k] = v
+	}
+	return distribution
+}
+
+func (sharding *ClusterSharding) updateDistribution() {
+	log.Info("Updating cluster shards")
+
+	for _, c := range sharding.Clusters {
+		shard := 0
+		if c.Shard != nil {
+			requestedShard := int(*c.Shard)
+			if requestedShard < sharding.Replicas {
+				shard = requestedShard
+			} else {
+				log.Warnf("Specified cluster shard (%d) for cluster: %s is greater than the number of available shard (%d). Using shard 0.", requestedShard, c.Server, sharding.Replicas)
+			}
+		} else {
+			shard = sharding.getClusterShard(c)
+		}
+		var shard64 int64 = int64(shard)
+		c.Shard = &shard64
+		sharding.Shards[c.Server] = shard
+	}
+}
+
+// hasShardingUpdates returns true if the sharding distribution has been updated.
+// nil checking is done for the corner case of the in-cluster cluster which may
+// have a nil shard assigned
+func hasShardingUpdates(old, new *v1alpha1.Cluster) bool {
+	if old == nil || new == nil || (old.Shard == nil && new.Shard == nil) {
+		return false
+	}
+	return old.Shard != new.Shard
+}
+
+func (d *ClusterSharding) GetClusterAccessor() clusterAccessor {
+	return func() []*v1alpha1.Cluster {
+		clusters := make([]*v1alpha1.Cluster, 0, len(d.Clusters))
+		for _, c := range d.Clusters {
+			clusters = append(clusters, c)
+		}
+		return clusters
+	}
+}
diff --git a/controller/sharding/sharding.go b/controller/sharding/sharding.go
index 526896531dbca..2b86ed3f82bc6 100644
--- a/controller/sharding/sharding.go
+++ b/controller/sharding/sharding.go
@@ -40,6 +40,7 @@ const ShardControllerMappingKey = "shardControllerMapping"
 
 type DistributionFunction func(c *v1alpha1.Cluster) int
 type ClusterFilterFunction func(c *v1alpha1.Cluster) bool
+type clusterAccessor func() []*v1alpha1.Cluster
 
 // shardApplicationControllerMapping stores the mapping of Shard Number to Application Controller in ConfigMap.
 // It also stores the heartbeat of last synced time of the application controller.
@@ -53,8 +54,7 @@ type shardApplicationControllerMapping struct {
 // and returns wheter or not the cluster should be processed by a given shard. It calls the distributionFunction
 // to determine which shard will process the cluster, and if the given shard is equal to the calculated shard
 // the function will return true.
-func GetClusterFilter(db db.ArgoDB, distributionFunction DistributionFunction, shard int) ClusterFilterFunction {
-	replicas := db.GetApplicationControllerReplicas()
+func GetClusterFilter(db db.ArgoDB, distributionFunction DistributionFunction, replicas, shard int) ClusterFilterFunction {
 	return func(c *v1alpha1.Cluster) bool {
 		clusterShard := 0
 		if c != nil && c.Shard != nil {
@@ -73,14 +73,14 @@ func GetClusterFilter(db db.ArgoDB, distributionFunction DistributionFunction, s
 
 // GetDistributionFunction returns which DistributionFunction should be used based on the passed algorithm and
 // the current datas.
-func GetDistributionFunction(db db.ArgoDB, shardingAlgorithm string) DistributionFunction {
-	log.Infof("Using filter function:  %s", shardingAlgorithm)
-	distributionFunction := LegacyDistributionFunction(db)
+func GetDistributionFunction(clusters clusterAccessor, shardingAlgorithm string, replicasCount int) DistributionFunction {
+	log.Debugf("Using filter function:  %s", shardingAlgorithm)
+	distributionFunction := LegacyDistributionFunction(replicasCount)
 	switch shardingAlgorithm {
 	case common.RoundRobinShardingAlgorithm:
-		distributionFunction = RoundRobinDistributionFunction(db)
+		distributionFunction = RoundRobinDistributionFunction(clusters, replicasCount)
 	case common.LegacyShardingAlgorithm:
-		distributionFunction = LegacyDistributionFunction(db)
+		distributionFunction = LegacyDistributionFunction(replicasCount)
 	default:
 		log.Warnf("distribution type %s is not supported, defaulting to %s", shardingAlgorithm, common.DefaultShardingAlgorithm)
 	}
@@ -92,15 +92,21 @@ func GetDistributionFunction(db db.ArgoDB, shardingAlgorithm string) Distributio
 // is lightweight and can be distributed easily, however, it does not ensure an homogenous distribution as
 // some shards may get assigned more clusters than others. It is the legacy function distribution that is
 // kept for compatibility reasons
-func LegacyDistributionFunction(db db.ArgoDB) DistributionFunction {
-	replicas := db.GetApplicationControllerReplicas()
+func LegacyDistributionFunction(replicas int) DistributionFunction {
 	return func(c *v1alpha1.Cluster) int {
 		if replicas == 0 {
+			log.Debugf("Replicas count is : %d, returning -1", replicas)
 			return -1
 		}
 		if c == nil {
+			log.Debug("In-cluster: returning 0")
 			return 0
 		}
+		// if Shard is manually set and the assigned value is lower than the number of replicas,
+		// then its value is returned otherwise it is the default calculated value
+		if c.Shard != nil && int(*c.Shard) < replicas {
+			return int(*c.Shard)
+		}
 		id := c.ID
 		log.Debugf("Calculating cluster shard for cluster id: %s", id)
 		if id == "" {
@@ -121,14 +127,19 @@ func LegacyDistributionFunction(db db.ArgoDB) DistributionFunction {
 // This function ensures an homogenous distribution: each shards got assigned the same number of
 // clusters +/-1 , but with the drawback of a reshuffling of clusters accross shards in case of some changes
 // in the cluster list
-func RoundRobinDistributionFunction(db db.ArgoDB) DistributionFunction {
-	replicas := db.GetApplicationControllerReplicas()
+
+func RoundRobinDistributionFunction(clusters clusterAccessor, replicas int) DistributionFunction {
 	return func(c *v1alpha1.Cluster) int {
 		if replicas > 0 {
 			if c == nil { // in-cluster does not necessarly have a secret assigned. So we are receiving a nil cluster here.
 				return 0
+			}
+			// if Shard is manually set and the assigned value is lower than the number of replicas,
+			// then its value is returned otherwise it is the default calculated value
+			if c.Shard != nil && int(*c.Shard) < replicas {
+				return int(*c.Shard)
 			} else {
-				clusterIndexdByClusterIdMap := createClusterIndexByClusterIdMap(db)
+				clusterIndexdByClusterIdMap := createClusterIndexByClusterIdMap(clusters)
 				clusterIndex, ok := clusterIndexdByClusterIdMap[c.ID]
 				if !ok {
 					log.Warnf("Cluster with id=%s not found in cluster map.", c.ID)
@@ -144,6 +155,12 @@ func RoundRobinDistributionFunction(db db.ArgoDB) DistributionFunction {
 	}
 }
 
+// NoShardingDistributionFunction returns a DistributionFunction that will process all cluster by shard 0
+// the function is created for API compatibility purposes and is not supposed to be activated.
+func NoShardingDistributionFunction() DistributionFunction {
+	return func(c *v1alpha1.Cluster) int { return 0 }
+}
+
 // InferShard extracts the shard index based on its hostname.
 func InferShard() (int, error) {
 	hostname, err := osHostnameFunction()
@@ -152,33 +169,29 @@ func InferShard() (int, error) {
 	}
 	parts := strings.Split(hostname, "-")
 	if len(parts) == 0 {
-		return 0, fmt.Errorf("hostname should ends with shard number separated by '-' but got: %s", hostname)
+		log.Warnf("hostname should end with shard number separated by '-' but got: %s", hostname)
+		return 0, nil
 	}
 	shard, err := strconv.Atoi(parts[len(parts)-1])
 	if err != nil {
-		return 0, fmt.Errorf("hostname should ends with shard number separated by '-' but got: %s", hostname)
+		log.Warnf("hostname should end with shard number separated by '-' but got: %s", hostname)
+		return 0, nil
 	}
 	return int(shard), nil
 }
 
-func getSortedClustersList(db db.ArgoDB) []v1alpha1.Cluster {
-	ctx := context.Background()
-	clustersList, dbErr := db.ListClusters(ctx)
-	if dbErr != nil {
-		log.Warnf("Error while querying clusters list from database: %v", dbErr)
-		return []v1alpha1.Cluster{}
-	}
-	clusters := clustersList.Items
+func getSortedClustersList(getCluster clusterAccessor) []*v1alpha1.Cluster {
+	clusters := getCluster()
 	sort.Slice(clusters, func(i, j int) bool {
 		return clusters[i].ID < clusters[j].ID
 	})
 	return clusters
 }
 
-func createClusterIndexByClusterIdMap(db db.ArgoDB) map[string]int {
-	clusters := getSortedClustersList(db)
+func createClusterIndexByClusterIdMap(getCluster clusterAccessor) map[string]int {
+	clusters := getSortedClustersList(getCluster)
 	log.Debugf("ClustersList has %d items", len(clusters))
-	clusterById := make(map[string]v1alpha1.Cluster)
+	clusterById := make(map[string]*v1alpha1.Cluster)
 	clusterIndexedByClusterId := make(map[string]int)
 	for i, cluster := range clusters {
 		log.Debugf("Adding cluster with id=%s and name=%s to cluster's map", cluster.ID, cluster.Name)
@@ -194,7 +207,6 @@ func createClusterIndexByClusterIdMap(db db.ArgoDB) map[string]int {
 // If the shard value passed to this function is -1, that is, the shard was not set as an environment variable,
 // we default the shard number to 0 for computing the default config map.
 func GetOrUpdateShardFromConfigMap(kubeClient *kubernetes.Clientset, settingsMgr *settings.SettingsManager, replicas, shard int) (int, error) {
-
 	hostname, err := osHostnameFunction()
 	if err != nil {
 		return -1, err
diff --git a/controller/sharding/sharding_test.go b/controller/sharding/sharding_test.go
index a8a25e11c4978..0992f7a9dfd7f 100644
--- a/controller/sharding/sharding_test.go
+++ b/controller/sharding/sharding_test.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"strconv"
 	"testing"
 	"time"
 
@@ -19,18 +20,20 @@ import (
 
 func TestGetShardByID_NotEmptyID(t *testing.T) {
 	db := &dbmocks.ArgoDB{}
-	db.On("GetApplicationControllerReplicas").Return(1)
-	assert.Equal(t, 0, LegacyDistributionFunction(db)(&v1alpha1.Cluster{ID: "1"}))
-	assert.Equal(t, 0, LegacyDistributionFunction(db)(&v1alpha1.Cluster{ID: "2"}))
-	assert.Equal(t, 0, LegacyDistributionFunction(db)(&v1alpha1.Cluster{ID: "3"}))
-	assert.Equal(t, 0, LegacyDistributionFunction(db)(&v1alpha1.Cluster{ID: "4"}))
+	replicasCount := 1
+	db.On("GetApplicationControllerReplicas").Return(replicasCount)
+	assert.Equal(t, 0, LegacyDistributionFunction(replicasCount)(&v1alpha1.Cluster{ID: "1"}))
+	assert.Equal(t, 0, LegacyDistributionFunction(replicasCount)(&v1alpha1.Cluster{ID: "2"}))
+	assert.Equal(t, 0, LegacyDistributionFunction(replicasCount)(&v1alpha1.Cluster{ID: "3"}))
+	assert.Equal(t, 0, LegacyDistributionFunction(replicasCount)(&v1alpha1.Cluster{ID: "4"}))
 }
 
 func TestGetShardByID_EmptyID(t *testing.T) {
 	db := &dbmocks.ArgoDB{}
-	db.On("GetApplicationControllerReplicas").Return(1)
+	replicasCount := 1
+	db.On("GetApplicationControllerReplicas").Return(replicasCount)
 	distributionFunction := LegacyDistributionFunction
-	shard := distributionFunction(db)(&v1alpha1.Cluster{})
+	shard := distributionFunction(replicasCount)(&v1alpha1.Cluster{})
 	assert.Equal(t, 0, shard)
 }
 
@@ -38,7 +41,7 @@ func TestGetShardByID_NoReplicas(t *testing.T) {
 	db := &dbmocks.ArgoDB{}
 	db.On("GetApplicationControllerReplicas").Return(0)
 	distributionFunction := LegacyDistributionFunction
-	shard := distributionFunction(db)(&v1alpha1.Cluster{})
+	shard := distributionFunction(0)(&v1alpha1.Cluster{})
 	assert.Equal(t, -1, shard)
 }
 
@@ -46,16 +49,16 @@ func TestGetShardByID_NoReplicasUsingHashDistributionFunction(t *testing.T) {
 	db := &dbmocks.ArgoDB{}
 	db.On("GetApplicationControllerReplicas").Return(0)
 	distributionFunction := LegacyDistributionFunction
-	shard := distributionFunction(db)(&v1alpha1.Cluster{})
+	shard := distributionFunction(0)(&v1alpha1.Cluster{})
 	assert.Equal(t, -1, shard)
 }
 
 func TestGetShardByID_NoReplicasUsingHashDistributionFunctionWithClusters(t *testing.T) {
-	db, cluster1, cluster2, cluster3, cluster4, cluster5 := createTestClusters()
+	clusters, db, cluster1, cluster2, cluster3, cluster4, cluster5 := createTestClusters()
 	// Test with replicas set to 0
 	db.On("GetApplicationControllerReplicas").Return(0)
 	t.Setenv(common.EnvControllerShardingAlgorithm, common.RoundRobinShardingAlgorithm)
-	distributionFunction := RoundRobinDistributionFunction(db)
+	distributionFunction := RoundRobinDistributionFunction(clusters, 0)
 	assert.Equal(t, -1, distributionFunction(nil))
 	assert.Equal(t, -1, distributionFunction(&cluster1))
 	assert.Equal(t, -1, distributionFunction(&cluster2))
@@ -65,137 +68,112 @@ func TestGetShardByID_NoReplicasUsingHashDistributionFunctionWithClusters(t *tes
 }
 
 func TestGetClusterFilterDefault(t *testing.T) {
-	shardIndex := 1 // ensuring that a shard with index 1 will process all the clusters with an "even" id (2,4,6,...)
+	//shardIndex := 1 // ensuring that a shard with index 1 will process all the clusters with an "even" id (2,4,6,...)
+	clusterAccessor, _, cluster1, cluster2, cluster3, cluster4, _ := createTestClusters()
 	os.Unsetenv(common.EnvControllerShardingAlgorithm)
-	db := &dbmocks.ArgoDB{}
-	db.On("GetApplicationControllerReplicas").Return(2)
-	filter := GetClusterFilter(db, GetDistributionFunction(db, common.DefaultShardingAlgorithm), shardIndex)
-	assert.False(t, filter(&v1alpha1.Cluster{ID: "1"}))
-	assert.True(t, filter(&v1alpha1.Cluster{ID: "2"}))
-	assert.False(t, filter(&v1alpha1.Cluster{ID: "3"}))
-	assert.True(t, filter(&v1alpha1.Cluster{ID: "4"}))
+	replicasCount := 2
+	distributionFunction := RoundRobinDistributionFunction(clusterAccessor, replicasCount)
+	assert.Equal(t, 0, distributionFunction(nil))
+	assert.Equal(t, 0, distributionFunction(&cluster1))
+	assert.Equal(t, 1, distributionFunction(&cluster2))
+	assert.Equal(t, 0, distributionFunction(&cluster3))
+	assert.Equal(t, 1, distributionFunction(&cluster4))
 }
 
 func TestGetClusterFilterLegacy(t *testing.T) {
-	shardIndex := 1 // ensuring that a shard with index 1 will process all the clusters with an "even" id (2,4,6,...)
-	db := &dbmocks.ArgoDB{}
-	db.On("GetApplicationControllerReplicas").Return(2)
+	//shardIndex := 1 // ensuring that a shard with index 1 will process all the clusters with an "even" id (2,4,6,...)
+	clusterAccessor, db, cluster1, cluster2, cluster3, cluster4, _ := createTestClusters()
+	replicasCount := 2
+	db.On("GetApplicationControllerReplicas").Return(replicasCount)
 	t.Setenv(common.EnvControllerShardingAlgorithm, common.LegacyShardingAlgorithm)
-	filter := GetClusterFilter(db, GetDistributionFunction(db, common.LegacyShardingAlgorithm), shardIndex)
-	assert.False(t, filter(&v1alpha1.Cluster{ID: "1"}))
-	assert.True(t, filter(&v1alpha1.Cluster{ID: "2"}))
-	assert.False(t, filter(&v1alpha1.Cluster{ID: "3"}))
-	assert.True(t, filter(&v1alpha1.Cluster{ID: "4"}))
+	distributionFunction := RoundRobinDistributionFunction(clusterAccessor, replicasCount)
+	assert.Equal(t, 0, distributionFunction(nil))
+	assert.Equal(t, 0, distributionFunction(&cluster1))
+	assert.Equal(t, 1, distributionFunction(&cluster2))
+	assert.Equal(t, 0, distributionFunction(&cluster3))
+	assert.Equal(t, 1, distributionFunction(&cluster4))
 }
 
 func TestGetClusterFilterUnknown(t *testing.T) {
-	shardIndex := 1 // ensuring that a shard with index 1 will process all the clusters with an "even" id (2,4,6,...)
-	db := &dbmocks.ArgoDB{}
-	db.On("GetApplicationControllerReplicas").Return(2)
+	clusterAccessor, db, cluster1, cluster2, cluster3, cluster4, _ := createTestClusters()
+	// Test with replicas set to 0
+	t.Setenv(common.EnvControllerReplicas, "2")
+	os.Unsetenv(common.EnvControllerShardingAlgorithm)
 	t.Setenv(common.EnvControllerShardingAlgorithm, "unknown")
-	filter := GetClusterFilter(db, GetDistributionFunction(db, "unknown"), shardIndex)
-	assert.False(t, filter(&v1alpha1.Cluster{ID: "1"}))
-	assert.True(t, filter(&v1alpha1.Cluster{ID: "2"}))
-	assert.False(t, filter(&v1alpha1.Cluster{ID: "3"}))
-	assert.True(t, filter(&v1alpha1.Cluster{ID: "4"}))
+	replicasCount := 2
+	db.On("GetApplicationControllerReplicas").Return(replicasCount)
+	distributionFunction := GetDistributionFunction(clusterAccessor, "unknown", replicasCount)
+	assert.Equal(t, 0, distributionFunction(nil))
+	assert.Equal(t, 0, distributionFunction(&cluster1))
+	assert.Equal(t, 1, distributionFunction(&cluster2))
+	assert.Equal(t, 0, distributionFunction(&cluster3))
+	assert.Equal(t, 1, distributionFunction(&cluster4))
 }
 
 func TestLegacyGetClusterFilterWithFixedShard(t *testing.T) {
-	shardIndex := 1 // ensuring that a shard with index 1 will process all the clusters with an "even" id (2,4,6,...)
-	db := &dbmocks.ArgoDB{}
-	db.On("GetApplicationControllerReplicas").Return(2)
-	filter := GetClusterFilter(db, GetDistributionFunction(db, common.DefaultShardingAlgorithm), shardIndex)
-	assert.False(t, filter(nil))
-	assert.False(t, filter(&v1alpha1.Cluster{ID: "1"}))
-	assert.True(t, filter(&v1alpha1.Cluster{ID: "2"}))
-	assert.False(t, filter(&v1alpha1.Cluster{ID: "3"}))
-	assert.True(t, filter(&v1alpha1.Cluster{ID: "4"}))
+	//shardIndex := 1 // ensuring that a shard with index 1 will process all the clusters with an "even" id (2,4,6,...)
+	t.Setenv(common.EnvControllerReplicas, "5")
+	clusterAccessor, db, cluster1, cluster2, cluster3, cluster4, _ := createTestClusters()
+	replicasCount := 5
+	db.On("GetApplicationControllerReplicas").Return(replicasCount)
+	filter := GetDistributionFunction(clusterAccessor, common.DefaultShardingAlgorithm, replicasCount)
+	assert.Equal(t, 0, filter(nil))
+	assert.Equal(t, 4, filter(&cluster1))
+	assert.Equal(t, 1, filter(&cluster2))
+	assert.Equal(t, 2, filter(&cluster3))
+	assert.Equal(t, 2, filter(&cluster4))
 
 	var fixedShard int64 = 4
-	filter = GetClusterFilter(db, GetDistributionFunction(db, common.DefaultShardingAlgorithm), int(fixedShard))
-	assert.False(t, filter(&v1alpha1.Cluster{ID: "4", Shard: &fixedShard}))
+	cluster5 := &v1alpha1.Cluster{ID: "5", Shard: &fixedShard}
+	clusterAccessor = getClusterAccessor([]v1alpha1.Cluster{cluster1, cluster2, cluster2, cluster4, *cluster5})
+	filter = GetDistributionFunction(clusterAccessor, common.DefaultShardingAlgorithm, replicasCount)
+	assert.Equal(t, int(fixedShard), filter(cluster5))
 
 	fixedShard = 1
-	filter = GetClusterFilter(db, GetDistributionFunction(db, common.DefaultShardingAlgorithm), int(fixedShard))
-	assert.True(t, filter(&v1alpha1.Cluster{Name: "cluster4", ID: "4", Shard: &fixedShard}))
+	cluster5.Shard = &fixedShard
+	clusterAccessor = getClusterAccessor([]v1alpha1.Cluster{cluster1, cluster2, cluster2, cluster4, *cluster5})
+	filter = GetDistributionFunction(clusterAccessor, common.DefaultShardingAlgorithm, replicasCount)
+	assert.Equal(t, int(fixedShard), filter(&v1alpha1.Cluster{ID: "4", Shard: &fixedShard}))
 }
 
 func TestRoundRobinGetClusterFilterWithFixedShard(t *testing.T) {
-	shardIndex := 1 // ensuring that a shard with index 1 will process all the clusters with an "even" id (2,4,6,...)
-	db, cluster1, cluster2, cluster3, cluster4, _ := createTestClusters()
-	db.On("GetApplicationControllerReplicas").Return(2)
-	filter := GetClusterFilter(db, GetDistributionFunction(db, common.RoundRobinShardingAlgorithm), shardIndex)
-	assert.False(t, filter(nil))
-	assert.False(t, filter(&cluster1))
-	assert.True(t, filter(&cluster2))
-	assert.False(t, filter(&cluster3))
-	assert.True(t, filter(&cluster4))
+	//shardIndex := 1 // ensuring that a shard with index 1 will process all the clusters with an "even" id (2,4,6,...)
+	t.Setenv(common.EnvControllerReplicas, "4")
+	clusterAccessor, db, cluster1, cluster2, cluster3, cluster4, _ := createTestClusters()
+	replicasCount := 4
+	db.On("GetApplicationControllerReplicas").Return(replicasCount)
+
+	filter := GetDistributionFunction(clusterAccessor, common.RoundRobinShardingAlgorithm, replicasCount)
+	assert.Equal(t, filter(nil), 0)
+	assert.Equal(t, filter(&cluster1), 0)
+	assert.Equal(t, filter(&cluster2), 1)
+	assert.Equal(t, filter(&cluster3), 2)
+	assert.Equal(t, filter(&cluster4), 3)
 
 	// a cluster with a fixed shard should be processed by the specified exact
 	// same shard unless the specified shard index is greater than the number of replicas.
-	var fixedShard int64 = 4
-	filter = GetClusterFilter(db, GetDistributionFunction(db, common.RoundRobinShardingAlgorithm), int(fixedShard))
-	assert.False(t, filter(&v1alpha1.Cluster{Name: "cluster4", ID: "4", Shard: &fixedShard}))
+	var fixedShard int64 = 1
+	cluster5 := v1alpha1.Cluster{Name: "cluster5", ID: "5", Shard: &fixedShard}
+	clusters := []v1alpha1.Cluster{cluster1, cluster2, cluster3, cluster4, cluster5}
+	clusterAccessor = getClusterAccessor(clusters)
+	filter = GetDistributionFunction(clusterAccessor, common.RoundRobinShardingAlgorithm, replicasCount)
+	assert.Equal(t, int(fixedShard), filter(&cluster5))
 
 	fixedShard = 1
-	filter = GetClusterFilter(db, GetDistributionFunction(db, common.RoundRobinShardingAlgorithm), int(fixedShard))
-	assert.True(t, filter(&v1alpha1.Cluster{Name: "cluster4", ID: "4", Shard: &fixedShard}))
-}
-
-func TestGetClusterFilterLegacyHash(t *testing.T) {
-	shardIndex := 1 // ensuring that a shard with index 1 will process all the clusters with an "even" id (2,4,6,...)
-	t.Setenv(common.EnvControllerShardingAlgorithm, "hash")
-	db, cluster1, cluster2, cluster3, cluster4, _ := createTestClusters()
-	db.On("GetApplicationControllerReplicas").Return(2)
-	filter := GetClusterFilter(db, GetDistributionFunction(db, common.LegacyShardingAlgorithm), shardIndex)
-	assert.False(t, filter(&cluster1))
-	assert.True(t, filter(&cluster2))
-	assert.False(t, filter(&cluster3))
-	assert.True(t, filter(&cluster4))
-
-	// a cluster with a fixed shard should be processed by the specified exact
-	// same shard unless the specified shard index is greater than the number of replicas.
-	var fixedShard int64 = 4
-	filter = GetClusterFilter(db, GetDistributionFunction(db, common.LegacyShardingAlgorithm), int(fixedShard))
-	assert.False(t, filter(&v1alpha1.Cluster{Name: "cluster4", ID: "4", Shard: &fixedShard}))
-
-	fixedShard = 1
-	filter = GetClusterFilter(db, GetDistributionFunction(db, common.LegacyShardingAlgorithm), int(fixedShard))
-	assert.True(t, filter(&v1alpha1.Cluster{Name: "cluster4", ID: "4", Shard: &fixedShard}))
-}
-
-func TestGetClusterFilterWithEnvControllerShardingAlgorithms(t *testing.T) {
-	db, cluster1, cluster2, cluster3, cluster4, _ := createTestClusters()
-	shardIndex := 1
-	db.On("GetApplicationControllerReplicas").Return(2)
-
-	t.Run("legacy", func(t *testing.T) {
-		t.Setenv(common.EnvControllerShardingAlgorithm, common.LegacyShardingAlgorithm)
-		shardShouldProcessCluster := GetClusterFilter(db, GetDistributionFunction(db, common.LegacyShardingAlgorithm), shardIndex)
-		assert.False(t, shardShouldProcessCluster(&cluster1))
-		assert.True(t, shardShouldProcessCluster(&cluster2))
-		assert.False(t, shardShouldProcessCluster(&cluster3))
-		assert.True(t, shardShouldProcessCluster(&cluster4))
-		assert.False(t, shardShouldProcessCluster(nil))
-	})
-
-	t.Run("roundrobin", func(t *testing.T) {
-		t.Setenv(common.EnvControllerShardingAlgorithm, common.RoundRobinShardingAlgorithm)
-		shardShouldProcessCluster := GetClusterFilter(db, GetDistributionFunction(db, common.LegacyShardingAlgorithm), shardIndex)
-		assert.False(t, shardShouldProcessCluster(&cluster1))
-		assert.True(t, shardShouldProcessCluster(&cluster2))
-		assert.False(t, shardShouldProcessCluster(&cluster3))
-		assert.True(t, shardShouldProcessCluster(&cluster4))
-		assert.False(t, shardShouldProcessCluster(nil))
-	})
+	cluster5 = v1alpha1.Cluster{Name: "cluster5", ID: "5", Shard: &fixedShard}
+	clusters = []v1alpha1.Cluster{cluster1, cluster2, cluster3, cluster4, cluster5}
+	clusterAccessor = getClusterAccessor(clusters)
+	filter = GetDistributionFunction(clusterAccessor, common.RoundRobinShardingAlgorithm, replicasCount)
+	assert.Equal(t, int(fixedShard), filter(&v1alpha1.Cluster{Name: "cluster4", ID: "4", Shard: &fixedShard}))
 }
 
 func TestGetShardByIndexModuloReplicasCountDistributionFunction2(t *testing.T) {
-	db, cluster1, cluster2, cluster3, cluster4, cluster5 := createTestClusters()
+	clusters, db, cluster1, cluster2, cluster3, cluster4, cluster5 := createTestClusters()
 
 	t.Run("replicas set to 1", func(t *testing.T) {
-		db.On("GetApplicationControllerReplicas").Return(1).Once()
-		distributionFunction := RoundRobinDistributionFunction(db)
+		replicasCount := 1
+		db.On("GetApplicationControllerReplicas").Return(replicasCount).Once()
+		distributionFunction := RoundRobinDistributionFunction(clusters, replicasCount)
 		assert.Equal(t, 0, distributionFunction(nil))
 		assert.Equal(t, 0, distributionFunction(&cluster1))
 		assert.Equal(t, 0, distributionFunction(&cluster2))
@@ -205,8 +183,9 @@ func TestGetShardByIndexModuloReplicasCountDistributionFunction2(t *testing.T) {
 	})
 
 	t.Run("replicas set to 2", func(t *testing.T) {
-		db.On("GetApplicationControllerReplicas").Return(2).Once()
-		distributionFunction := RoundRobinDistributionFunction(db)
+		replicasCount := 2
+		db.On("GetApplicationControllerReplicas").Return(replicasCount).Once()
+		distributionFunction := RoundRobinDistributionFunction(clusters, replicasCount)
 		assert.Equal(t, 0, distributionFunction(nil))
 		assert.Equal(t, 0, distributionFunction(&cluster1))
 		assert.Equal(t, 1, distributionFunction(&cluster2))
@@ -216,8 +195,9 @@ func TestGetShardByIndexModuloReplicasCountDistributionFunction2(t *testing.T) {
 	})
 
 	t.Run("replicas set to 3", func(t *testing.T) {
-		db.On("GetApplicationControllerReplicas").Return(3).Once()
-		distributionFunction := RoundRobinDistributionFunction(db)
+		replicasCount := 3
+		db.On("GetApplicationControllerReplicas").Return(replicasCount).Once()
+		distributionFunction := RoundRobinDistributionFunction(clusters, replicasCount)
 		assert.Equal(t, 0, distributionFunction(nil))
 		assert.Equal(t, 0, distributionFunction(&cluster1))
 		assert.Equal(t, 1, distributionFunction(&cluster2))
@@ -233,17 +213,19 @@ func TestGetShardByIndexModuloReplicasCountDistributionFunctionWhenClusterNumber
 	// Initial tests where showing that under 1024 clusters, execution time was around 400ms
 	// and for 4096 clusters, execution time was under 9s
 	// The other implementation was giving almost linear time of 400ms up to 10'000 clusters
-	db := dbmocks.ArgoDB{}
-	clusterList := &v1alpha1.ClusterList{Items: []v1alpha1.Cluster{}}
+	clusterPointers := []*v1alpha1.Cluster{}
 	for i := 0; i < 2048; i++ {
 		cluster := createCluster(fmt.Sprintf("cluster-%d", i), fmt.Sprintf("%d", i))
-		clusterList.Items = append(clusterList.Items, cluster)
+		clusterPointers = append(clusterPointers, &cluster)
 	}
-	db.On("ListClusters", mock.Anything).Return(clusterList, nil)
-	db.On("GetApplicationControllerReplicas").Return(2)
-	distributionFunction := RoundRobinDistributionFunction(&db)
-	for i, c := range clusterList.Items {
-		assert.Equal(t, i%2, distributionFunction(&c))
+	replicasCount := 2
+	t.Setenv(common.EnvControllerReplicas, strconv.Itoa(replicasCount))
+	_, db, _, _, _, _, _ := createTestClusters()
+	clusterAccessor := func() []*v1alpha1.Cluster { return clusterPointers }
+	db.On("GetApplicationControllerReplicas").Return(replicasCount)
+	distributionFunction := RoundRobinDistributionFunction(clusterAccessor, replicasCount)
+	for i, c := range clusterPointers {
+		assert.Equal(t, i%2, distributionFunction(c))
 	}
 }
 
@@ -256,12 +238,15 @@ func TestGetShardByIndexModuloReplicasCountDistributionFunctionWhenClusterIsAdde
 	cluster5 := createCluster("cluster5", "5")
 	cluster6 := createCluster("cluster6", "6")
 
+	clusters := []v1alpha1.Cluster{cluster1, cluster2, cluster3, cluster4, cluster5}
+	clusterAccessor := getClusterAccessor(clusters)
+
 	clusterList := &v1alpha1.ClusterList{Items: []v1alpha1.Cluster{cluster1, cluster2, cluster3, cluster4, cluster5}}
 	db.On("ListClusters", mock.Anything).Return(clusterList, nil)
-
 	// Test with replicas set to 2
-	db.On("GetApplicationControllerReplicas").Return(2)
-	distributionFunction := RoundRobinDistributionFunction(&db)
+	replicasCount := 2
+	db.On("GetApplicationControllerReplicas").Return(replicasCount)
+	distributionFunction := RoundRobinDistributionFunction(clusterAccessor, replicasCount)
 	assert.Equal(t, 0, distributionFunction(nil))
 	assert.Equal(t, 0, distributionFunction(&cluster1))
 	assert.Equal(t, 1, distributionFunction(&cluster2))
@@ -272,17 +257,20 @@ func TestGetShardByIndexModuloReplicasCountDistributionFunctionWhenClusterIsAdde
 
 	// Now, the database knows cluster6. Shard should be assigned a proper shard
 	clusterList.Items = append(clusterList.Items, cluster6)
+	distributionFunction = RoundRobinDistributionFunction(getClusterAccessor(clusterList.Items), replicasCount)
 	assert.Equal(t, 1, distributionFunction(&cluster6))
 
 	// Now, we remove the last added cluster, it should be unassigned as well
 	clusterList.Items = clusterList.Items[:len(clusterList.Items)-1]
+	distributionFunction = RoundRobinDistributionFunction(getClusterAccessor(clusterList.Items), replicasCount)
 	assert.Equal(t, -1, distributionFunction(&cluster6))
 }
 
 func TestGetShardByIndexModuloReplicasCountDistributionFunction(t *testing.T) {
-	db, cluster1, cluster2, _, _, _ := createTestClusters()
-	db.On("GetApplicationControllerReplicas").Return(2)
-	distributionFunction := RoundRobinDistributionFunction(db)
+	clusters, db, cluster1, cluster2, _, _, _ := createTestClusters()
+	replicasCount := 2
+	db.On("GetApplicationControllerReplicas").Return(replicasCount)
+	distributionFunction := RoundRobinDistributionFunction(clusters, replicasCount)
 
 	// Test that the function returns the correct shard for cluster1 and cluster2
 	expectedShardForCluster1 := 0
@@ -315,14 +303,14 @@ func TestInferShard(t *testing.T) {
 
 	osHostnameFunction = func() (string, error) { return "exampleshard", nil }
 	_, err = InferShard()
-	assert.NotNil(t, err)
+	assert.Nil(t, err)
 
 	osHostnameFunction = func() (string, error) { return "example-shard", nil }
 	_, err = InferShard()
-	assert.NotNil(t, err)
+	assert.Nil(t, err)
 }
 
-func createTestClusters() (*dbmocks.ArgoDB, v1alpha1.Cluster, v1alpha1.Cluster, v1alpha1.Cluster, v1alpha1.Cluster, v1alpha1.Cluster) {
+func createTestClusters() (clusterAccessor, *dbmocks.ArgoDB, v1alpha1.Cluster, v1alpha1.Cluster, v1alpha1.Cluster, v1alpha1.Cluster, v1alpha1.Cluster) {
 	db := dbmocks.ArgoDB{}
 	cluster1 := createCluster("cluster1", "1")
 	cluster2 := createCluster("cluster2", "2")
@@ -330,10 +318,27 @@ func createTestClusters() (*dbmocks.ArgoDB, v1alpha1.Cluster, v1alpha1.Cluster,
 	cluster4 := createCluster("cluster4", "4")
 	cluster5 := createCluster("cluster5", "5")
 
+	clusters := []v1alpha1.Cluster{cluster1, cluster2, cluster3, cluster4, cluster5}
+
 	db.On("ListClusters", mock.Anything).Return(&v1alpha1.ClusterList{Items: []v1alpha1.Cluster{
 		cluster1, cluster2, cluster3, cluster4, cluster5,
 	}}, nil)
-	return &db, cluster1, cluster2, cluster3, cluster4, cluster5
+	return getClusterAccessor(clusters), &db, cluster1, cluster2, cluster3, cluster4, cluster5
+}
+
+func getClusterAccessor(clusters []v1alpha1.Cluster) clusterAccessor {
+	// Convert the array to a slice of pointers
+	clusterPointers := getClusterPointers(clusters)
+	clusterAccessor := func() []*v1alpha1.Cluster { return clusterPointers }
+	return clusterAccessor
+}
+
+func getClusterPointers(clusters []v1alpha1.Cluster) []*v1alpha1.Cluster {
+	var clusterPointers []*v1alpha1.Cluster
+	for i := range clusters {
+		clusterPointers = append(clusterPointers, &clusters[i])
+	}
+	return clusterPointers
 }
 
 func createCluster(name string, id string) v1alpha1.Cluster {
diff --git a/controller/sharding/shuffle_test.go b/controller/sharding/shuffle_test.go
index 9e089e31bad0f..1cca783a2afe9 100644
--- a/controller/sharding/shuffle_test.go
+++ b/controller/sharding/shuffle_test.go
@@ -3,6 +3,7 @@ package sharding
 import (
 	"fmt"
 	"math"
+	"strconv"
 	"testing"
 
 	"github.com/argoproj/argo-cd/v2/common"
@@ -22,9 +23,11 @@ func TestLargeShuffle(t *testing.T) {
 		clusterList.Items = append(clusterList.Items, cluster)
 	}
 	db.On("ListClusters", mock.Anything).Return(clusterList, nil)
+	clusterAccessor := getClusterAccessor(clusterList.Items)
 	// Test with replicas set to 256
-	t.Setenv(common.EnvControllerReplicas, "256")
-	distributionFunction := RoundRobinDistributionFunction(&db)
+	replicasCount := 256
+	t.Setenv(common.EnvControllerReplicas, strconv.Itoa(replicasCount))
+	distributionFunction := RoundRobinDistributionFunction(clusterAccessor, replicasCount)
 	for i, c := range clusterList.Items {
 		assert.Equal(t, i%2567, distributionFunction(&c))
 	}
@@ -44,10 +47,11 @@ func TestShuffle(t *testing.T) {
 
 	clusterList := &v1alpha1.ClusterList{Items: []v1alpha1.Cluster{cluster1, cluster2, cluster3, cluster4, cluster5, cluster6}}
 	db.On("ListClusters", mock.Anything).Return(clusterList, nil)
-
+	clusterAccessor := getClusterAccessor(clusterList.Items)
 	// Test with replicas set to 3
 	t.Setenv(common.EnvControllerReplicas, "3")
-	distributionFunction := RoundRobinDistributionFunction(&db)
+	replicasCount := 3
+	distributionFunction := RoundRobinDistributionFunction(clusterAccessor, replicasCount)
 	assert.Equal(t, 0, distributionFunction(nil))
 	assert.Equal(t, 0, distributionFunction(&cluster1))
 	assert.Equal(t, 1, distributionFunction(&cluster2))
diff --git a/docs/user-guide/commands/argocd_admin_cluster.md b/docs/user-guide/commands/argocd_admin_cluster.md
index bad60a0dd32bf..544c0de08959c 100644
--- a/docs/user-guide/commands/argocd_admin_cluster.md
+++ b/docs/user-guide/commands/argocd_admin_cluster.md
@@ -62,6 +62,6 @@ argocd admin cluster namespaces my-cluster
 * [argocd admin cluster generate-spec](argocd_admin_cluster_generate-spec.md)	 - Generate declarative config for a cluster
 * [argocd admin cluster kubeconfig](argocd_admin_cluster_kubeconfig.md)	 - Generates kubeconfig for the specified cluster
 * [argocd admin cluster namespaces](argocd_admin_cluster_namespaces.md)	 - Print information namespaces which Argo CD manages in each cluster.
-* [argocd admin cluster shards](argocd_admin_cluster_shards.md)	 - Print information about each controller shard and portion of Kubernetes resources it is responsible for.
+* [argocd admin cluster shards](argocd_admin_cluster_shards.md)	 - Print information about each controller shard and the estimated portion of Kubernetes resources it is responsible for.
 * [argocd admin cluster stats](argocd_admin_cluster_stats.md)	 - Prints information cluster statistics and inferred shard number
 
diff --git a/docs/user-guide/commands/argocd_admin_cluster_shards.md b/docs/user-guide/commands/argocd_admin_cluster_shards.md
index 6648b91b2199e..48f6138d47b4a 100644
--- a/docs/user-guide/commands/argocd_admin_cluster_shards.md
+++ b/docs/user-guide/commands/argocd_admin_cluster_shards.md
@@ -2,7 +2,7 @@
 
 ## argocd admin cluster shards
 
-Print information about each controller shard and portion of Kubernetes resources it is responsible for.
+Print information about each controller shard and the estimated portion of Kubernetes resources it is responsible for.
 
 ```
 argocd admin cluster shards [flags]
@@ -43,6 +43,7 @@ argocd admin cluster shards [flags]
       --sentinelmaster string                 Redis sentinel master group name. (default "master")
       --server string                         The address and port of the Kubernetes API server
       --shard int                             Cluster shard filter (default -1)
+      --sharding-method string                Sharding method. Defaults: legacy. Supported sharding methods are : [legacy, round-robin]  (default "legacy")
       --tls-server-name string                If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
       --token string                          Bearer token for authentication to the API server
       --user string                           The name of the kubeconfig user to use
diff --git a/docs/user-guide/commands/argocd_admin_cluster_stats.md b/docs/user-guide/commands/argocd_admin_cluster_stats.md
index 960fd12caaef1..c5297ce7e35ed 100644
--- a/docs/user-guide/commands/argocd_admin_cluster_stats.md
+++ b/docs/user-guide/commands/argocd_admin_cluster_stats.md
@@ -57,6 +57,7 @@ argocd admin cluster stats target-cluster
       --sentinelmaster string                 Redis sentinel master group name. (default "master")
       --server string                         The address and port of the Kubernetes API server
       --shard int                             Cluster shard filter (default -1)
+      --sharding-method string                Sharding method. Defaults: legacy. Supported sharding methods are : [legacy, round-robin]  (default "legacy")
       --tls-server-name string                If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
       --token string                          Bearer token for authentication to the API server
       --user string                           The name of the kubeconfig user to use
diff --git a/test/e2e/cluster_test.go b/test/e2e/cluster_test.go
index e57b2132b7472..2074a6aa1b7b1 100644
--- a/test/e2e/cluster_test.go
+++ b/test/e2e/cluster_test.go
@@ -38,7 +38,7 @@ https://kubernetes.default.svc  in-cluster  %v     Successful           `, GetVe
 		When().
 		CreateApp()
 
-	tries := 2
+	tries := 5
 	for i := 0; i <= tries; i += 1 {
 		clusterFixture.GivenWithSameState(t).
 			When().

From 54de532940d7d4a0581579c16dcec9b5ec066e91 Mon Sep 17 00:00:00 2001
From: mugi <62197019+mugioka@users.noreply.github.com>
Date: Thu, 11 Jan 2024 21:52:18 +0900
Subject: [PATCH 13/13] fix(manifests): applicationset-controller dir is not
 added to cluster-rbac/kustomization.yaml. (#16810)

* fix(manifests): applicationset-controller dir is not added to cluster-rbac/kustomization.yaml.

Related PR: https://github.com/argoproj/argo-cd/pull/16699.

I missed adding a new folder(applicationset-controller) to kustomization.yaml.

So, i addressed it.

Signed-off-by: mugioka <okamugi0722@gmail.com>

* chore: exec `make manifests`.

Signed-off-by: mugioka <okamugi0722@gmail.com>

* chore: exec `make manifests`.

Signed-off-by: mugioka <okamugi0722@gmail.com>

---------

Signed-off-by: mugioka <okamugi0722@gmail.com>
---
 manifests/cluster-rbac/kustomization.yaml |   1 +
 manifests/ha/install.yaml                 | 106 ++++++++++++++++++++++
 manifests/install.yaml                    | 106 ++++++++++++++++++++++
 3 files changed, 213 insertions(+)

diff --git a/manifests/cluster-rbac/kustomization.yaml b/manifests/cluster-rbac/kustomization.yaml
index 7f791905b661b..55e6e2d72df9e 100644
--- a/manifests/cluster-rbac/kustomization.yaml
+++ b/manifests/cluster-rbac/kustomization.yaml
@@ -3,4 +3,5 @@ kind: Kustomization
 
 resources:
 - ./application-controller
+- ./applicationset-controller
 - ./server
diff --git a/manifests/ha/install.yaml b/manifests/ha/install.yaml
index a7086ae8a6c06..2029be1e07e12 100644
--- a/manifests/ha/install.yaml
+++ b/manifests/ha/install.yaml
@@ -20868,6 +20868,95 @@ rules:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: applicationset-controller
+    app.kubernetes.io/name: argocd-applicationset-controller
+    app.kubernetes.io/part-of: argocd
+  name: argocd-applicationset-controller
+rules:
+- apiGroups:
+  - argoproj.io
+  resources:
+  - applications
+  - applicationsets
+  - applicationsets/finalizers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - argoproj.io
+  resources:
+  - applicationsets/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - argoproj.io
+  resources:
+  - appprojects
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - create
+  - update
+  - delete
+  - get
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  - extensions
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/component: server
@@ -21049,6 +21138,23 @@ subjects:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: applicationset-controller
+    app.kubernetes.io/name: argocd-applicationset-controller
+    app.kubernetes.io/part-of: argocd
+  name: argocd-applicationset-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: argocd-applicationset-controller
+subjects:
+- kind: ServiceAccount
+  name: argocd-applicationset-controller
+  namespace: argocd
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
 metadata:
   labels:
     app.kubernetes.io/component: server
diff --git a/manifests/install.yaml b/manifests/install.yaml
index 8d30e076d8bf7..83ac4f903fb7b 100644
--- a/manifests/install.yaml
+++ b/manifests/install.yaml
@@ -20827,6 +20827,95 @@ rules:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: applicationset-controller
+    app.kubernetes.io/name: argocd-applicationset-controller
+    app.kubernetes.io/part-of: argocd
+  name: argocd-applicationset-controller
+rules:
+- apiGroups:
+  - argoproj.io
+  resources:
+  - applications
+  - applicationsets
+  - applicationsets/finalizers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - argoproj.io
+  resources:
+  - applicationsets/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - argoproj.io
+  resources:
+  - appprojects
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - create
+  - update
+  - delete
+  - get
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  - extensions
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/component: server
@@ -20976,6 +21065,23 @@ subjects:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: applicationset-controller
+    app.kubernetes.io/name: argocd-applicationset-controller
+    app.kubernetes.io/part-of: argocd
+  name: argocd-applicationset-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: argocd-applicationset-controller
+subjects:
+- kind: ServiceAccount
+  name: argocd-applicationset-controller
+  namespace: argocd
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
 metadata:
   labels:
     app.kubernetes.io/component: server