Feat/default automated sync

README.md

@@ -77,6 +77,11 @@ flowchart LR
 To change the upstream Git revision, edit `targetRevision` in
 `overrides/values-rhoso-gitops.yaml`.
 
+> **Note:** Child applications use automated sync by default. Pin
+> `targetRevision` to a tag or commit hash in
+> `overrides/values-rhoso-gitops.yaml` — see
+> [chart README](charts/all/rhoso-gitops/README.md#automated-sync-and-revision-stability).
+
 ## Chart layout
 
 - `charts/all/rhoso-gitops/` -- pattern meta-chart (see

charts/all/rhoso-gitops/README.md

@@ -107,30 +107,58 @@ render that `Application`; `enabled: false` skips it.
 | `path` | string | Directory in the repository (empty → `"."`). |
 | `targetRevision` | string | Branch, tag, or commit (empty → `"HEAD"`). |
 | `syncWave` | string | `argocd.argoproj.io/sync-wave` annotation. |
-| `syncOptions` | list | Used when `syncPolicy` is empty; default includes `Prune=true`. |
+| `syncPolicy` | map | Full `spec.syncPolicy`. Defaults to automated sync with retry and `Prune=true`; set explicitly to override (e.g. remove `automated` for manual sync). Put `syncOptions` inside this map. |
 | `kustomize` | map | `spec.source.kustomize` ([Argo CD Kustomize][argo-kustomize]). |
 | `finalizers` | list | `metadata.finalizers` (`background` or `foreground`). |
 | `project` | string | Argo CD AppProject (default `default`). |
-| `syncPolicy` | map | Full `spec.syncPolicy`; when set, top-level `syncOptions` are ignored. |
 
 Schema validation: `values.schema.json` (used by `helm lint` in CI).
 
+### Automated sync and revision stability
+
+> **Warning:** With automated sync enabled (the default), Argo CD reconciles
+> child applications whenever the upstream Git repository changes. If
+> `targetRevision` is set to a branch name like `main` or `HEAD`, any push
+> to that branch triggers an automatic deployment. This can cause unexpected
+> changes in production.
+>
+> **Always pin `targetRevision` to a tag or commit hash** for stability:
+>
+> ```yaml
+> applications:
+>   openstack-operator:
+>     targetRevision: "v0.3.4"          # tag — recommended
+>   openstack-controlplane:
+>     targetRevision: "abc123def456"    # commit hash — also safe
+> ```
+>
+> To disable automated sync for a specific application, override its
+> `syncPolicy` without the `automated` key:
+>
+> ```yaml
+> applications:
+>   openstack-dataplane:
+>     syncPolicy:
+>       syncOptions:
+>         - Prune=true
+> ```
+
 ## Default applications
 
 Enabled by default in chart `values.yaml` except `openstack-secrets`
 (`enabled: false` until you configure a real Git path). Pattern overrides in
 `overrides/values-rhoso-gitops.yaml` pin paths to the upstream
 `example/*` directories at tag `v0.1.0`.
 
-| Application | Purpose (summary) | Default `syncWave` |
-| --- | --- | --- |
-| `operator-dependencies` | Infra + optional VSO/ESO via `kustomize.components` | `-20` |
-| `openstack-operator` | OpenStack operator | `-20` |
-| `openstack-operator-cr` | Main `OpenStack` CR | `-15` |
-| `openstack-secrets` | Secure-backend sync (disabled until configured) | `-10` |
-| `openstack-networks` | Networks | `0` |
-| `openstack-controlplane` | `OpenStackControlPlane` | `10` |
-| `openstack-dataplane` | Data plane | `20` |
+| Application | Purpose (summary) | Default `syncWave` | Sync |
+| --- | --- | --- | --- |
+| `operator-dependencies` | Infra + optional VSO/ESO via `kustomize.components` | `-20` | automated |
+| `openstack-operator` | OpenStack operator | `-20` | automated |
+| `openstack-operator-cr` | Main `OpenStack` CR | `-15` | automated |
+| `openstack-secrets` | Secure-backend sync (disabled until configured) | `-10` | automated |
+| `openstack-networks` | Networks | `0` | automated |
+| `openstack-controlplane` | `OpenStackControlPlane` | `10` | automated |
+| `openstack-dataplane` | Data plane | `20` | automated |
 
 ### Sync wave ordering
 

charts/all/rhoso-gitops/templates/_helpers.tpl

@@ -66,23 +66,17 @@ Pass dict with key "app" (per-application values map). Omitted if unset, non-map
 
 {{/*
 Build spec.syncPolicy; emit block or nothing.
-If syncPolicy is a non-empty map, it is the sole source (top-level syncOptions is ignored).
-If syncPolicy is absent or empty, top-level syncOptions is merged in as spec.syncPolicy.syncOptions.
 Pass dict with key "app" (per-application values map).
 */}}
 {{- define "rhoso-gitops.syncPolicySpec" -}}
 {{- $app := .app -}}
-{{- $merged := $app.syncPolicy | default dict }}
-{{- if not (kindIs "map" $merged) }}
-{{- $merged = dict }}
+{{- $sp := $app.syncPolicy | default dict }}
+{{- if not (kindIs "map" $sp) }}
+{{- $sp = dict }}
 {{- end }}
-{{- if not (empty $merged) }}
+{{- if not (empty $sp) }}
   syncPolicy:
-{{ toYaml $merged | indent 4 }}
-{{- else if and $app.syncOptions (not (empty $app.syncOptions)) }}
-{{- $only := dict "syncOptions" $app.syncOptions }}
-  syncPolicy:
-{{ toYaml $only | indent 4 }}
+{{ toYaml $sp | indent 4 }}
 {{- end }}
 {{- end }}
 

charts/all/rhoso-gitops/tests/application_test.yaml

@@ -48,6 +48,20 @@ tests:
       - equal:
           path: spec.syncPolicy.syncOptions[0]
           value: Prune=true
+      - exists:
+          path: spec.syncPolicy.automated
+      - equal:
+          path: spec.syncPolicy.retry.limit
+          value: 5
+      - equal:
+          path: spec.syncPolicy.retry.backoff.duration
+          value: 30s
+      - equal:
+          path: spec.syncPolicy.retry.backoff.factor
+          value: 2
+      - equal:
+          path: spec.syncPolicy.retry.backoff.maxDuration
+          value: 3m
 
   - it: renders operator-dependencies with default background finalizer
     values:
@@ -60,57 +74,28 @@ tests:
           path: metadata.finalizers[0]
           value: resources-finalizer.argocd.argoproj.io/background
 
-  - it: uses syncPolicy and ignores top-level syncOptions when both are set
+  - it: allows disabling automated sync via syncPolicy override
     set:
       applicationNamespace: openshift-gitops
       destinationServer: https://kubernetes.default.svc
       applications:
-        policy-merge-test:
+        manual-test:
           enabled: true
           repoURL: https://github.com/example/repo
           path: "."
-          targetRevision: HEAD
-          syncWave: "0"
+          targetRevision: v1.0.0
           syncPolicy:
-            automated:
-              prune: true
             syncOptions:
-              - FromNestedPolicy=true
-          syncOptions:
-            - FromTopLevel=true
-    documentSelector:
-      path: metadata.name
-      value: policy-merge-test
-    asserts:
-      - lengthEqual:
-          path: spec.syncPolicy.syncOptions
-          count: 1
-      - equal:
-          path: spec.syncPolicy.syncOptions[0]
-          value: FromNestedPolicy=true
-
-  - it: uses top-level syncOptions when syncPolicy is unset
-    set:
-      applicationNamespace: openshift-gitops
-      destinationServer: https://kubernetes.default.svc
-      applications:
-        syncopt-only:
-          enabled: true
-          repoURL: https://github.com/example/repo
-          path: "."
-          targetRevision: main
-          syncWave: "0"
-          syncOptions:
-            - OnlyFromTopLevel=true
+              - Prune=true
     documentSelector:
       path: metadata.name
-      value: syncopt-only
+      value: manual-test
     asserts:
-      - equal:
-          path: spec.syncPolicy.syncOptions[0]
-          value: OnlyFromTopLevel=true
       - notExists:
           path: spec.syncPolicy.automated
+      - equal:
+          path: spec.syncPolicy.syncOptions[0]
+          value: Prune=true
 
   - it: defaults syncWave to 0 when omitted
     set:
@@ -122,8 +107,9 @@ tests:
           repoURL: https://github.com/example/repo
           path: "."
           targetRevision: main
-          syncOptions:
-            - Prune=true
+          syncPolicy:
+            syncOptions:
+              - Prune=true
     documentSelector:
       path: metadata.name
       value: no-wave
@@ -153,8 +139,9 @@ tests:
           path: examples/foo
           targetRevision: main
           syncWave: "0"
-          syncOptions:
-            - Prune=true
+          syncPolicy:
+            syncOptions:
+              - Prune=true
           kustomize:
             namePrefix: dev-
             components:
@@ -180,7 +167,6 @@ tests:
           path: "."
           targetRevision: main
           syncWave: "0"
-          syncOptions: []
     asserts:
       - failedTemplate:
           errorPattern: repoURL
@@ -196,7 +182,6 @@ tests:
           path: "."
           targetRevision: main
           syncWave: "0"
-          syncOptions: []
     asserts:
       - failedTemplate:
           errorPattern: destinationServer
@@ -221,8 +206,9 @@ tests:
           repoURL: https://github.com/example/repo
           path: "."
           targetRevision: main
-          syncOptions:
-            - RespectIgnoreDifferences=true
+          syncPolicy:
+            syncOptions:
+              - RespectIgnoreDifferences=true
           ignoreDifferences:
             - group: core.openstack.org
               kind: OpenStackControlPlane
@@ -253,7 +239,6 @@ tests:
           repoURL: https://github.com/example/repo
           path: "."
           targetRevision: main
-          syncOptions: []
           ignoreDifferences:
             - group: dataplane.openstack.org
               kind: OpenStackDataPlaneNodeSet
@@ -278,7 +263,6 @@ tests:
           path: "."
           targetRevision: main
           syncWave: "0"
-          syncOptions: []
           finalizers:
             - resources-finalizer.argocd.argoproj.io/invalid
     asserts:

charts/all/rhoso-gitops/values.schema.json

@@ -1,5 +1,5 @@
 {
-	"$schema": "http://json-schema.org/draft-07/schema#",
+	"$schema": "https://json-schema.org/draft/2019-09/schema",
 	"$id": "https://github.com/validatedpatterns-sandbox/rhoso-gitops/charts/all/rhoso-gitops/values.schema.json",
 	"title": "rhoso-gitops Helm chart values",
 	"description": "Validated against templates/ and the documentation block in values.yaml.",
@@ -29,21 +29,15 @@
 				"pattern": "^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$"
 			},
 			"additionalProperties": {
-				"$ref": "#/definitions/application"
+				"$ref": "#/$defs/application"
 			}
 		}
 	},
-	"definitions": {
+	"$defs": {
 		"application": {
 			"type": "object",
 			"description": "Per-application values under applications.<name>.",
-			"required": [
-				"enabled",
-				"repoURL",
-				"path",
-				"targetRevision",
-				"syncOptions"
-			],
+			"required": ["enabled", "repoURL", "path", "targetRevision"],
 			"additionalProperties": false,
 			"properties": {
 				"enabled": {
@@ -71,11 +65,10 @@
 				},
 				"syncOptions": {
 					"type": "array",
-					"description": "Argo CD sync option strings. Used for spec.syncPolicy.syncOptions when syncPolicy is not set or is an empty object; ignored when syncPolicy is a non-empty object (use syncPolicy.syncOptions).",
-					"minItems": 0,
+					"deprecated": true,
+					"description": "Deprecated: ignored at runtime. Use syncPolicy.syncOptions instead.",
 					"items": {
-						"type": "string",
-						"minLength": 1
+						"type": "string"
 					}
 				},
 				"project": {
@@ -84,7 +77,7 @@
 				},
 				"syncPolicy": {
 					"type": "object",
-					"description": "When non-empty, the map is rendered as spec.syncPolicy in full; top-level syncOptions is not merged in. For syncOptions only, omit syncPolicy or set it to {} and set top-level syncOptions.",
+					"description": "Full spec.syncPolicy map. Defaults to automated sync with retry and Prune=true. Set explicitly to override (e.g. omit automated for manual sync). Include syncOptions inside this map.",
 					"additionalProperties": true
 				},
 				"kustomize": {