Bug: Clusters Generator isn't accessing metadata values from cluster secret

[magic-madrigal]

Checklist:

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug

Currently trying to create an ApplicationSet with nested Matrix Generators, but the final Cluster generator can't access the metadata.labels from the Cluster Secret. The system continues to complain that the map has no entry for the key metadata.

Seeing that I've followed the documentation correctly, I assume this may be a bug in using the functionality within a nested matrix.

To Reproduce

Here's a copy of the ApplicationSet and Cluster Secret for reference. (not some details have been redacted)

ApplicationSet

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: sanai-tenant-onboarding-appset
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  goTemplate: true
  goTemplateOptions: ["missingkey=error"]
  generators:
    - matrix:
        generators:
          - git: # Gets a list of all the namespaces in their respective clusters
              repoURL: [email protected]:Sanai-Solultions/Achilles.git
              revision: HEAD
              pathParamPrefix: tenant
              files:
              - path: argocd/apps/sanai/tenants/*/*/*.json
              values:
                cluster: '{{index .tenant.path.segments 4}}'
                namespace: '{{index .tenant.path.segments 5}}'
          - matrix:
              generators:
                - git:
                    repoURL: [email protected]:Sanai-Solultions/sanai-app.git
                    revision: v0.7.7.1
                    pathParamPrefix: chart
                    directories:
                    - path: infra/helm-charts/iam
                    - path: infra/helm-charts/onboarding
                    values:
                      gitTag: 'v0.7.7.1'
                - clusters:
                    selector:
                      matchLabels:
                        argocd.argoproj.io/secret-type: cluster
                        sanai/cluster-name: prod-1
                    values:
                      env: '{{index .metadata.labels "sanai/env"}}'
                      oidc: '{{index .metadata.labels "sanai/oidc"}}'
  template:
    metadata:
      name: '{{.values.cluster}}-{{.values.namespace}}-{{.tenantName}}-{{.chart.path.basename}}-app'
    spec:
      project: default
      source:
        repoURL: [email protected]:repo-name.git
        path: '{{.chart.path.path}}'
        targetRevision: '{{.values.gitTag}}'
        helm:
          releaseName: '{{.chart.path.path}}-{{.tenantName}}'
          valueFiles:
            - '/infra/helm/{{.chart.path.basename}}/{{.values.env}}-values.yaml'
      destination:
        server: '{{.server}}'
        namespace: '{{.values.namespace}}'
      syncPolicy:
        automated:
          prune: true
        syncOptions:
          - Validate=true
          - CreateNamespace=true 
          - PruneLast=false 
          - RespectIgnoreDifferences=true 
          - ApplyOutOfSyncOnly=true
          - ServerSideApply=true

Cluster Secret

apiVersion: v1
kind: Secret
metadata:
  name: prod-1
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: cluster
    argocd.argoproj.io/auto-label-cluster-info: "true"
    sanai/cluster-name: prod-1
    sanai/env: prod
    sanai/oidc: <value>
    ops-crossplane: "true"
    ops-crossplane-aws-s3: "true"
    ops-crossplane-aws-acm: "true"
    ops-crossplane-aws-iam: "true"
    ops-crossplane-aws-route53: "true"
    ops-crossplane-aws-sns: "true"
    ops-crossplane-aws-sqs: "true"
    tool-pgadmin4: "true"
  annotations:
    argocd.argoproj.io/sync-wave: "0"
type: Opaque
stringData:
  name: prod-1
  server: <redacted>
  config: <redacted>

Expected behavior

I would have expected that the Cluster Generator would have pulled the metadata from the cluster secret to use within the ApplicationSet Template.

Screenshots

N/A

Version

{
    "Version": "v2.13.2+dc43124",
    "BuildDate": "2024-12-11T18:37:15Z",
    "GitCommit": "dc43124058130db9a747d141d86d7c2f4aac7bf9",
    "GitTreeState": "clean",
    "GoVersion": "go1.23.1",
    "Compiler": "gc",
    "Platform": "linux/arm64",
    "KustomizeVersion": "v5.4.3 2024-07-19T16:40:33Z",
    "HelmVersion": "v3.15.4+gfa9efb0",
    "KubectlVersion": "v0.31.0",
    "JsonnetVersion": "v0.20.0"
}

Logs

        failed to get params for second generator in the matrix generator: child
        generator returned an error on parameter generation: failed to replace
        parameters in generator: failed to execute go template {{index
        .metadata.labels "sanai/env"}}: template: :1:17: executing "" at
        <.metadata.labels>: map has no entry for key "metadata"

[andrii-korotkov-verkada]

From what I've heard, matrix of matrix isn't fully supported. Are there other ways to restructure this to avoid having nested matrix? Is there something that can be added to ArgoCD to allow for that to happen?