Error configuring the applicationset controller --proxy-url

[baprx]

Checklist:

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug

The applicationset controller was working fine until I configured the proxy using the --proxy-url flag. After that one change the controller is in crashloop with the only available log level=fatal msg="invalid configuration: default cluster has no server defined".

It might be because incorrect URLs are getting proxified but there is no --no-proxy flag or similar configuration. I'll switch to using environment variables but I don't think this behavior is expected.

To Reproduce

A SCM generator appset with the following flag set:

❯ kubectl -n argocd get deployment argocd-applicationset-controller -oyaml | rg args: -A6 | sed 's/proxy\..*:/proxy.internal:/'
      - args:
        - /usr/local/bin/argocd-applicationset-controller
        - --metrics-addr=:8080
        - --probe-addr=:8081
        - --webhook-addr=:7000
        - --proxy-url=http://proxy.internal:3128
        env:

Git generator (https based) are working because they're using the proxy configuration from the repo-creds secret.

Expected behavior

Requests to be sent through the proxy.

Ideally I'd be able to configure the proxy from the argocd.argoproj.io/secret-type: scm-creds secret like it's possible for the repo-creds one, this way only the URL from that secret (not read at all at the moment) would be proxified.

Version

❯ argocd version
argocd: v3.3.8+7ae7d2c
  BuildDate: 2026-04-21T17:45:55Z
  GitCommit: 7ae7d2cc723f5408b080a31263e705198af08613
  GitTreeState: clean
  GoVersion: go1.25.5
  Compiler: gc
  Platform: darwin/arm64
argocd-server: v3.3.8

Logs

LOGLEVEL=debug

❯ kubectl -n argocd logs argocd-applicationset-controller-6879fbff8d-ttpx5
time="2026-05-07T09:36:12Z" level=fatal msg="invalid configuration: default cluster has no server defined"

[ppapapetrou76]

This is indeed a real bug.
The --proxy-url flag in the applicationset controller is not a custom ArgoCD flag — it is a kubectl kubeconfig override flag, inherited from cli.AddKubectlFlagsToCmd. When set in an in-cluster pod (no kubeconfig), it breaks the initialization of the Kubernetes REST config.

The suggestion of configuring the proxy from scm-creds just like repo-creds might sound like the best approach, but it's not an easy/straightforward implementation. It requires changes to several layers mainly because unlikely repo-creds wich is mapped to a golang struct, , theres' no scm-creds struct - basically it reads a key from whatever secrete is pointed at.

I can see two ( easier to implement ) approaches

1. Detect in-cluster mode and apply the proxy-url to rest.InClusterConfig() manually
2. Replace the flag with a "native" argocd one that applies to the right http client