feat: add support for Prune/Delete=false sync option

For consistency with Prune/Delete=confirm that are now present as
application level sync option add Prune/Delete=false as sync option too.

Signed-off-by: Arthur Outhenin-Chalandre <[email protected]>

Author: MrFreezeex

controller/appcontroller.go

@@ -1166,6 +1166,7 @@ func (ctrl *ApplicationController) removeProjectFinalizer(proj *appv1.AppProject
 func (ctrl *ApplicationController) shouldBeDeleted(app *appv1.Application, obj *unstructured.Unstructured) bool {
 	return !kube.IsCRD(obj) && !isSelfReferencedApp(app, kube.GetObjectRef(obj)) &&
 		!resourceutil.HasAnnotationOption(obj, synccommon.AnnotationSyncOptions, synccommon.SyncOptionDisableDeletion) &&
+		(app.Spec.SyncPolicy == nil || !app.Spec.SyncPolicy.SyncOptions.HasOption(synccommon.SyncOptionDisableDeletion)) &&
 		!resourceutil.HasAnnotationOption(obj, helm.ResourcePolicyAnnotation, helm.ResourcePolicyKeep)
 }
 

controller/appcontroller_test.go

@@ -2565,6 +2565,16 @@ func Test_syncDeleteOption(t *testing.T) {
 	})
 }
 
+func Test_syncDeleteOptionGlobal(t *testing.T) {
+	app := newFakeApp()
+	app.Spec.SyncPolicy.SyncOptions = []string{"Delete=false"}
+	ctrl := newFakeController(&fakeData{apps: []runtime.Object{app}}, nil)
+
+	cm := newFakeCM()
+	cmObj := kube.MustToUnstructured(&cm)
+	assert.False(t, ctrl.shouldBeDeleted(app, cmObj))
+}
+
 func TestAddControllerNamespace(t *testing.T) {
 	t.Run("set controllerNamespace when the app is in the controller namespace", func(t *testing.T) {
 		app := newFakeApp()

controller/sync.go

@@ -348,6 +348,7 @@ func (m *appStateManager) SyncAppState(app *v1alpha1.Application, project *v1alp
 		),
 		sync.WithPruneConfirmed(app.IsDeletionConfirmed(state.StartedAt.Time)),
 		sync.WithRequiresPruneConfirmation(syncOp.SyncOptions.HasOption(common.SyncOptionPruneRequireConfirm)),
+		sync.WithPruneDisabled(syncOp.SyncOptions.HasOption(common.SyncOptionDisablePrune)),
 		sync.WithSkipDryRunOnMissingResource(syncOp.SyncOptions.HasOption(common.SyncOptionSkipDryRunOnMissingResource)),
 	}
 

docs/user-guide/sync-options.md

@@ -14,6 +14,21 @@ metadata:
     argocd.argoproj.io/sync-options: Prune=false
 ```
 
+If you want to prevent any object from being pruned in the Application,
+it also can be enabled at the application level like in the example below:
+
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+spec:
+  syncPolicy:
+    syncOptions:
+    - Prune=false
+```
+
+Note that setting a Prune sync option on the application level will not override
+the same sync option set on a specific resource, both will still be applied.
+
 The sync-status panel shows that pruning was skipped, and why:
 
 ![sync option no prune](../assets/sync-option-no-prune-sync-status.png)
@@ -101,6 +116,21 @@ metadata:
     argocd.argoproj.io/sync-options: Delete=false
 ```
 
+If you want to prevent any object from being deleted in the Application,
+it also can be enabled at the application level like in the example below:
+
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+spec:
+  syncPolicy:
+    syncOptions:
+    - Delete=false
+```
+
+Note that setting a Delete sync option on the application level will not override
+the same sync option set on a specific resource, both will still be applied.
+
 ## Resource Deletion With Confirmation
 
 Resources such as Namespaces are critical and should not be deleted without confirmation. You can set the `Delete=confirm`

gitops-engine/pkg/sync/sync_context.go

@@ -129,6 +129,13 @@ func WithPruneConfirmed(confirmed bool) SyncOpt {
 	}
 }
 
+// WithPruneDisabled specifies if prune is globally disabled for this application
+func WithPruneDisabled(disabled bool) SyncOpt {
+	return func(ctx *syncContext) {
+		ctx.pruneDisabled = disabled
+	}
+}
+
 // WithOperationSettings allows to set sync operation settings
 func WithOperationSettings(dryRun bool, prune bool, force bool, skipHooks bool) SyncOpt {
 	return func(ctx *syncContext) {
@@ -375,6 +382,7 @@ type syncContext struct {
 	prunePropagationPolicy          *metav1.DeletionPropagation
 	pruneConfirmed                  bool
 	requiresPruneConfirmation       bool
+	pruneDisabled                   bool
 	clientSideApplyMigrationManager string
 	enableClientSideApplyMigration  bool
 
@@ -1229,7 +1237,7 @@ func (sc *syncContext) applyObject(t *syncTask, dryRun, validate bool) (common.R
 func (sc *syncContext) pruneObject(liveObj *unstructured.Unstructured, prune, dryRun bool) (common.ResultCode, string) {
 	if !prune {
 		return common.ResultCodePruneSkipped, "ignored (requires pruning)"
-	} else if resourceutil.HasAnnotationOption(liveObj, common.AnnotationSyncOptions, common.SyncOptionDisablePrune) {
+	} else if resourceutil.HasAnnotationOption(liveObj, common.AnnotationSyncOptions, common.SyncOptionDisablePrune) || sc.pruneDisabled {
 		return common.ResultCodePruneSkipped, "ignored (no prune)"
 	}
 	if dryRun {

gitops-engine/pkg/sync/sync_context_test.go

@@ -835,6 +835,23 @@ func TestDoNotPrunePruneFalse(t *testing.T) {
 
 	phase, _, _ = syncCtx.GetState()
 	assert.Equal(t, synccommon.OperationSucceeded, phase)
+
+	// test that we can still not prune if prune is disabled on the app level
+	syncCtx.pruneDisabled = true
+	pod.SetAnnotations(map[string]string{synccommon.AnnotationSyncOptions: "Prune=true"})
+	syncCtx.Sync()
+
+	phase, _, resources = syncCtx.GetState()
+
+	assert.Equal(t, synccommon.OperationSucceeded, phase)
+	assert.Len(t, resources, 1)
+	assert.Equal(t, synccommon.ResultCodePruneSkipped, resources[0].Status)
+	assert.Equal(t, "ignored (no prune)", resources[0].Message)
+
+	syncCtx.Sync()
+
+	phase, _, _ = syncCtx.GetState()
+	assert.Equal(t, synccommon.OperationSucceeded, phase)
 }
 
 // make sure that we need confirmation to prune with Prune=confirm

test/e2e/app_management_test.go

@@ -1750,6 +1750,57 @@ func TestSyncOptionPruneFalse(t *testing.T) {
 		Expect(ResourceSyncStatusIs("Pod", "pod-1", SyncStatusCodeOutOfSync))
 }
 
+// make sure that if we deleted a resource from the app, it is not pruned if the app has the sync option Prune=false
+func TestSyncOptionSyncOptionPruneFalse(t *testing.T) {
+	Given(t).
+		Path("two-nice-pods").
+		When().
+		CreateApp().
+		PatchApp(`[{
+			"op": "add",
+			"path": "/spec/syncPolicy",
+			"value": { "syncOptions": ["Prune=false"] }
+			}]`).
+		Sync().
+		Then().
+		Expect(OperationPhaseIs(OperationSucceeded)).
+		Expect(SyncStatusIs(SyncStatusCodeSynced)).
+		When().
+		DeleteFile("pod-1.yaml").
+		Refresh(RefreshTypeHard).
+		IgnoreErrors().
+		Sync().
+		Then().
+		Expect(OperationPhaseIs(OperationSucceeded)).
+		Expect(SyncStatusIs(SyncStatusCodeOutOfSync)).
+		Expect(ResourceSyncStatusIs("Pod", "pod-1", SyncStatusCodeOutOfSync))
+
+	// Also check that another setting on a ressource level doesn't override that
+	Given(t).
+		Path("two-nice-pods").
+		When().
+		CreateApp().
+		PatchApp(`[{
+			"op": "add",
+			"path": "/spec/syncPolicy",
+			"value": { "syncOptions": ["Prune=false"] }
+			}]`).
+		PatchFile("pod-1.yaml", `[{"op": "add", "path": "/metadata/annotations", "value": {"argocd.argoproj.io/sync-options": "Prune=true"}}]`).
+		Sync().
+		Then().
+		Expect(OperationPhaseIs(OperationSucceeded)).
+		Expect(SyncStatusIs(SyncStatusCodeSynced)).
+		When().
+		DeleteFile("pod-1.yaml").
+		Refresh(RefreshTypeHard).
+		IgnoreErrors().
+		Sync().
+		Then().
+		Expect(OperationPhaseIs(OperationSucceeded)).
+		Expect(SyncStatusIs(SyncStatusCodeOutOfSync)).
+		Expect(ResourceSyncStatusIs("Pod", "pod-1", SyncStatusCodeOutOfSync))
+}
+
 // make sure that if we have an invalid manifest, we can add it if we disable validation, we get a server error rather than a client error
 func TestSyncOptionValidateFalse(t *testing.T) {
 	Given(t).