We've explored declarative cluster targeting a bunch of times in the past.

The main alternatives are:

1. Per-resource annotations, as with Config Sync cluster selectors
2. Targeting in the sync API, as in ArgoCD Application, or other package-level specification

An orthogonal issue is how to abstract the cluster targets and credentials to access them, which we'd want to do, especially in the case of per-resource annotations, as well as for blueprints. Kubeconfig is one option, but we may need to make it pluggable.

Per-resource targeting is flexible, but error prone. My recommendation in Config Sync has been to use kustomize or kpt to add cluster selectors to groups of resources where they are needed, but to minimize their use, generally. In Config Sync, selectors are a rendering-time operation.

We also know that we'll want to support rollout across groups of clusters. That's easier to reason about if the packages themselves do not contain targeting information.

cc @justinsb