8.2. Sync Windows

With Sync windows the user can define at which time applications can be synchronized automatically and manually by Argo CD. Allowed and forbidden time windows can be defined. Sync windows can be restricted to a subset of applications, clusters and namespaces and thus offer great flexibility.

Task 8.2.1: Create application and project

Now we want to create a new empty Argo CD project.

argocd proj create -s "*" -d "*,*" project-sync-windows-$USER
argocd app create sync-windows-$USER --repo https://github.com/acend/argocd-training-examples.git --path 'example-app' --dest-server https://kubernetes.default.svc --dest-namespace $USER --project project-sync-windows-$USER
argocd app sync sync-windows-$USER

You should see the following message after a successful sync

...
Message:            successfully synced (all tasks run)
...

Task 8.2.2: Create sync windows

Per default no sync windows are pre-configured in Argo CD. That means manual and automatic sync operations are allowed all the time. Now we want to create a sync window which denies syncs during the day between 08:00 and 20:00.

argocd proj windows add project-sync-windows-$USER \
    --kind deny \
    --schedule "0 8 * * *" \
    --duration 12h \
    --applications "*" \
    --namespaces "" \
    --clusters ""

List all registered sync windows for the project.

argocd proj windows list project-sync-windows-$USER

..prints out

ID  STATUS  KIND  SCHEDULE   DURATION  APPLICATIONS  NAMESPACES  CLUSTERS  MANUALSYNC
0   Active  deny  0 8 * * *  12h       *             *           *         Disabled

The window starts at 08:00 in the morning an lasts for 12 hours and denies all sync operation for all applications.

Now try to sync the previously created application.

argocd app sync sync-windows-$USER

This manual sync request will be blocked due to the active sync window with the following output

FATA[0000] rpc error: code = PermissionDenied desc = Cannot sync: Blocked by sync window

Task 8.2.3: Updating the sync window

Now we want to restrict the defined sync windows just for the application with name sketchy-app. We update the existing sync window with the new application name.

argocd proj windows update project-sync-windows-$USER 0 --applications "sketchy-app"

Sync the application again

argocd app sync sync-windows-$USER

It still doesn’t work, but why?

By default, the three fields namespaces, clusters and applications will be evaluated using OR, not AND. The namespace and the cluster still matches our project-sync-windows-<username> application. To change this behavior, edit the AppProject with the option --use-and-operator.

argocd proj windows update project-sync-windows-$USER 0 --use-and-operator

Try syncing again. This now works because the sync window only applies for applications with the name sketchy-app, the application project-sync-windows-<username> is not matched anymore. The three fields namespaces, clusters and applications and the functionality to toggle OR and AND evaluations give you a lot of flexibility to configure different sync windows.

Then revert the changes and use wildcard * again to match all applications

argocd proj windows update project-sync-windows-$USER 0 --applications "*"

Task 8.2.4: Enabling manual syncs

Now enable the manual sync for the window and try again to sync manually.

argocd proj windows enable-manual-sync project-sync-windows-$USER 0
argocd app sync sync-windows-$USER

Which now work flawlessly.

Automatic syncs are still forbidden and will not occur between 08:00 and 20:00.

Task 8.2.5: Enable auto-sync and prune

Enable automated sync and pruning before deletion to ensure all managed resources are cleaned up:

argocd app set sync-windows-$USER --sync-policy automated
argocd app set sync-windows-$USER --self-heal
argocd app set sync-windows-$USER --auto-prune

Task 8.2.6: Housekeeping

Clean up the resources created in this lab

argocd proj windows delete project-sync-windows-$USER 0
argocd app delete sync-windows-$USER -y
argocd proj delete project-sync-windows-$USER

Find more detailed information about Sync Windows in the docs .