Argo-cd: Implementing JsonPath for diffing customization

[SayakMukhopadhyay]

Summary

Right now Diffing Customization uses jsonPointers to indicate the patch to be ignored. This is sufficient when the tree contains non array objects. But, if an array is present, then it becomes infeasible to query the element to be ignored by array index. As such, support for jsonPath, which has the capability of making deeper queries, would go a long way.

Motivation

Cert Manager creates a validatingwebhookconfiguration which when deployed on AKS (maybe for other cloud providers too) gets modified.

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  ...
webhooks:
- admissionReviewVersions:
  - v1beta1
  clientConfig:
    ...
  failurePolicy: Fail
  matchPolicy: Exact
  name: webhook.cert-manager.io
  namespaceSelector:
    matchExpressions:
    - key: cert-manager.io/disable-validation
      operator: NotIn
      values:
      - "true"
    - key: name
      operator: NotIn
      values:
      - cert-manager
    - key: control-plane
      operator: DoesNotExist
...

In the above yaml, the array element with key: control-plane was added by AKS and as such I want ArgoCD to ignore that specific element. Having JsonPath support, I could do something like $.webhooks[?(@.name == webhook.cert-manager.io)].namespaceSelector.matchExpressions[?(@.key == control-plane)]. I believe this is not currently possible in jsonPointers.

Proposal

Implementing the jsonPath spec in addition to jsonPointer should fix this.

[jessesuen]

I think this is a good idea. There's room in the spec to allow for jsonPath as an alternative.

[chetan-rns]

Hi @jessesuen , is this applicable to system-level configuration as well? Can I pick it up? I'm happy to work on it :)

[SayakMukhopadhyay]

In my opinion, it should also apply there.

[buehlmann]

This would be a great improvement to use JSONPath! :heart_eyes: I ran into this one several times when trying to ignore differences inside an element of an array. For example containers inside Deployments or sts is quite common.. Accessing the array by index is not an option because it's non-deterministic.