Skip to content

Safe changes to an Applicationset

Changing an Applicationset can be dangerous because by default it can create and remove applications. So this is a workaround to avoid disgusting situations

Preparation: Disable autosync in parent Application

!!! danger "This is critical"

If the Applicationset itself is deployed using gitops, disable autosync (at least, the prune option) in the application that manages our Applicationset.

Preparation: Disable autosync in generated Applications

This is optional, depending of the changes. We can disable autoSync in the generated Applications (spec.template.spec.syncPolicy)

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: myappset
spec:
  template:
    spec:
      ...
      syncPolicy:
        # automated:
        #  selfHeal: true
      ...

Preparation: Prevent applications being deleted

If your have modified things in the the generators, this can potentially delete applications.

We can control this adding temporarily the spec.syncPolicy.applicationsSync: create-update setting to our Applicationset. This prevents our Applicationset from deleting applications.

But we have a problem here. How to identify what applications will be deleted when we remove the create-update setting from the Applicationset?. We can add a version label to the generated applications in the current (old) Applicationset.

apiVersion: argoproj.io/v1alpha1
kind: Applicationset
metadata:
  name: myappset
spec:
  syncPolicy:
    applicationsSync: create-update
  template:
    metadata:
      labels:
        app.kubernetes.io/version: v0.0.1

Commit and sync this changes to the current Applicationset

Add your changes

Next step is to add the changes:

  • The changes you really want to do to the Applicationset
  • Increase the version label to v0.0.2

Commit and push the changes. The changes to the Applicationset will not be applied because we have disable autoSync

Check name

With our Applicationset with pending changes:

  • Explore the differences between both versions
  • Check the Applicationset's name does not change and the old one will not be deleted (pruned).

!!! danger ""

The default behaviour when deleting an Applicationset is delete the Applicationset itself and all the generated applications and resources.

Sync your changes

If you are ok with the changes sync the Applicationset resource

Check if it will delete Applications

The new changes are propagated to the Applications. We must check the labels in the Applications generated by our Applicationset. The Applications with v0.0.2 are ok, but if any has v0.0.1, they will be delete when removing applicationsSync

!!! warning "" Remember to check the label only in the applications that this Applicationset generates

Remove protections

If all generated Applications are ok and with v0.0.2, we can

  • remove the applicationsSync option
  • enable autoSyn in the application that manages our Applicationset