Cheat notes · Module 03 · Foundations

Reconciliation: auto-sync, prune and self-heal

A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.

The idea

Drift is the cluster no longer matching Git. Automated sync applies new commits, prune deletes what Git removed, and self-heal undoes changes made by hand. With all three on, Git is the only way to change what runs.

Remember

Automated sync (syncPolicy.automated): new commits are applied without waiting for a person.
Prune (prune: true): objects deleted from Git are deleted from the cluster. Off by default even with auto-sync, so a bad commit cannot silently delete half an app.
Self-heal (selfHeal: true): live changes made outside Git are put back within seconds. Without it, auto-sync only reacts to new commits.
The loop: Git is re-read every timeout.reconciliation (60 s here, plus jitter). Live changes are noticed sooner, through watches. A Git webhook makes detection instant.
Sync options worth knowing: Prune=false on one resource (volumes, namespaces), PruneLast, ServerSideApply, ApplyOutOfSyncOnly, RespectIgnoreDifferences, and Replace (rare; causes downtime).
Every sync is recorded: what triggered it (automated or a person), the revision, the result per resource.

Pitfalls

"Argo CD keeps reverting my fix" is not a bug. With self-heal on, the only fix that stays is a commit; take away write access and manual fixes become impossible too.
Auto-sync without prune leaves deleted objects running, shown as OutOfSync. Pruning is a separate decision on purpose.
Data you must not lose to a deleted line needs argocd.argoproj.io/sync-options: Prune=false on the resource.

Commands

`argocd app get APP \| grep 'Sync Policy'`	Expect `Automated (Prune)`
`kubectl -n NS get deployment NAME -w`	Watch self-heal undo a hand change
`git revert --no-edit HEAD && git push`	Undo the last change the GitOps way
`argocd app get APP --show-operation`	The last sync: trigger, revision, result per resource
`argocd app sync APP --prune --dry-run`	Preview a sync, deletions included

The sync policy

syncPolicy:
  automated:
    prune: true       # delete what was deleted from Git
    selfHeal: true    # undo changes made outside Git
  syncOptions:
    - CreateNamespace=true

Test yourself

Answer in your head first, then open the answer.

Auto-sync is on, prune is off. You delete a manifest from Git. What happens?

The object stays, and the app shows OutOfSync.

What does self-heal react to?

Live changes made outside Git. Auto-sync alone only reacts to new commits.

Why set Prune=false on a single resource?

So a deleted line in Git can never delete it, for example a volume claim that holds data.

How do you make a 2 a.m. hotfix stick?

Commit it to the environment repo. Undo it the same way, with a revert, afterwards.

Where module 03 leaves you: checkout-dev syncs by itself: new commits are applied, objects deleted from Git are deleted from the cluster, and hand changes are undone within seconds. Git is now the only way to change what runs.