feat(argocd): apply only out of sync resources

Rather than always applying all resources which causes anything that is
setup to be deleted and recreated, like the OpenStack Helm jobs for db
sync and keystone user/endpoint manipulation, from always being applied
just apply those objects that are out of sync which should make updates
a bit more smoother. At the same time document in better detail what all
the options do and why we have them set.

Author: cardoe

apps/appsets/appset-understack-global.yaml

@@ -75,9 +75,20 @@ spec:
         automated:
           selfHeal: true
         syncOptions:
+          # Create the namespace we are using if it doesn't already exist.
           - CreateNamespace=true
+          # Use the server side apply behavior of kubernetes for resources, we've got the
+          # compare option set above to support this.
           - ServerSideApply=true
+          # Resources might have mutated fields and we want to allow those to be set without
+          # ArgoCD coming back and smacking them back. The ignoreDifferences templatePatch
+          # uses this feature.
           - RespectIgnoreDifferences=true
+          # Enable selective sync so that resources that have a difference are applied
+          # instead of always applying all resources. This prevents us from always
+          # running jobs.
+          # https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#selective-sync
+          - ApplyOutOfSyncOnly=true
         managedNamespaceMetadata:
           annotations:
             # ArgoCD can create our namespace but let's not delete it

apps/appsets/appset-understack-infra.yaml

@@ -76,9 +76,20 @@ spec:
         automated:
           selfHeal: true
         syncOptions:
+          # Create the namespace we are using if it doesn't already exist.
           - CreateNamespace=true
+          # Use the server side apply behavior of kubernetes for resources, we've got the
+          # compare option set above to support this.
           - ServerSideApply=true
+          # Resources might have mutated fields and we want to allow those to be set without
+          # ArgoCD coming back and smacking them back. The ignoreDifferences templatePatch
+          # uses this feature.
           - RespectIgnoreDifferences=true
+          # Enable selective sync so that resources that have a difference are applied
+          # instead of always applying all resources. This prevents us from always
+          # running jobs.
+          # https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#selective-sync
+          - ApplyOutOfSyncOnly=true
         managedNamespaceMetadata:
           annotations:
             # ArgoCD can create our namespace but let's not delete it

apps/appsets/appset-understack-openstack.yaml

@@ -104,8 +104,18 @@ spec:
         automated:
           selfHeal: true
         syncOptions:
+          # Use the server side apply behavior of kubernetes for resources, we've got the
+          # compare option set above to support this.
           - ServerSideApply=true
+          # Resources might have mutated fields and we want to allow those to be set without
+          # ArgoCD coming back and smacking them back. The ignoreDifferences templatePatch
+          # uses this feature.
           - RespectIgnoreDifferences=true
+          # Enable selective sync so that resources that have a difference are applied
+          # instead of always applying all resources. This prevents us from always
+          # running DB migrations and messing with keystone users and endpoints.
+          # https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#selective-sync
+          - ApplyOutOfSyncOnly=true
   templatePatch: |
     spec:
       ignoreDifferences: {{ dig "ignoreDifferences" list . | toJson }}

apps/appsets/appset-understack-operators.yaml

@@ -76,9 +76,20 @@ spec:
         automated:
           selfHeal: true
         syncOptions:
+          # Create the namespace we are using if it doesn't already exist.
           - CreateNamespace=true
+          # Use the server side apply behavior of kubernetes for resources, we've got the
+          # compare option set above to support this.
           - ServerSideApply=true
+          # Resources might have mutated fields and we want to allow those to be set without
+          # ArgoCD coming back and smacking them back. The ignoreDifferences templatePatch
+          # uses this feature.
           - RespectIgnoreDifferences=true
+          # Enable selective sync so that resources that have a difference are applied
+          # instead of always applying all resources. This prevents us from always
+          # running jobs.
+          # https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#selective-sync
+          - ApplyOutOfSyncOnly=true
         managedNamespaceMetadata:
           annotations:
             # ArgoCD can create our namespace but let's not delete it

apps/appsets/appset-understack-site.yaml

@@ -75,9 +75,20 @@ spec:
         automated:
           selfHeal: true
         syncOptions:
+          # Create the namespace we are using if it doesn't already exist.
           - CreateNamespace=true
+          # Use the server side apply behavior of kubernetes for resources, we've got the
+          # compare option set above to support this.
           - ServerSideApply=true
+          # Resources might have mutated fields and we want to allow those to be set without
+          # ArgoCD coming back and smacking them back. The ignoreDifferences templatePatch
+          # uses this feature.
           - RespectIgnoreDifferences=true
+          # Enable selective sync so that resources that have a difference are applied
+          # instead of always applying all resources. This prevents us from always
+          # running jobs.
+          # https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#selective-sync
+          - ApplyOutOfSyncOnly=true
         managedNamespaceMetadata:
           annotations:
             # ArgoCD can create our namespace but let's not delete it