github.com/argoproj/argo-cd/v3@v3.2.1/docs/user-guide/sync_windows.md (about) 1 # Sync Windows 2 3 Sync windows are configurable windows of time where syncs will either be blocked or allowed. These are defined 4 by a kind, which can be either `allow` or `deny`, a `schedule` in cron format and a duration along with one or 5 more of either `applications`, `namespaces` and `clusters`. If more than one option is specified, by default, the enabled options will 6 be OR-ed. If you want to AND the options, you can tick the `Use AND operator` option. 7 Wildcards are supported. 8 9 ## Relationship between Sync Windows and Applications 10 11 The relationship between Sync Windows and Application resources is many-to-many. This means that an Application resource 12 may be affected by multiple Sync Windows, and that a single Sync Window definition may apply to multiple Application 13 resources. 14 15 The relationship between Sync Window and Application is established as part of the definition of Sync Window. 16 Sync Window definition includes a section defining the Application resources to which it applies. There 17 are three mechanisms for selecting the Application resources to which a Sync Window applies: 18 19 - By name of Application resource 20 - By cluster into which resources are installed by Application resource. This is specified by `Application.spec.destination.name` and `.server` fields 21 - By namespace into which resources are installed by Application resource. This is specified by `Application.spec.destination.namespace` field. 22 23 All three mechanisms allow usage of wildcards. The mechanisms are not mutually exclusive, and all three of them can be used in single 24 Sync Window definition. 25 26 When multiple selection mechanisms are used, they are effectively `ORed`, meaning that if any of the selector selects the Application, 27 then the Application is affected by the Sync Window. 28 29 ## Effect of Sync Windows 30 31 These windows affect the running of both manual and automated syncs but allow an override 32 for manual syncs which is useful if you are only interested in preventing automated syncs or if you need to temporarily 33 override a window to perform a sync. 34 35 The windows work in the following way: 36 37 - If there are no windows matching an application then all syncs are allowed. 38 - If there are any `allow` windows matching an application then syncs will only be allowed when there is an active `allow` window. 39 - If there are any `deny` windows matching an application then all syncs will be denied when the `deny` windows are active. 40 - If there is an active matching `allow` and an active matching `deny` then syncs will be denied as `deny` windows override `allow` windows. 41 42 The UI and the CLI will both display the state of the sync windows. The UI has a panel which will display different colours depending 43 on the state. The colours are as follows. `Red: sync denied`, `Orange: manual allowed` and `Green: sync allowed`. 44 45 To display the sync state using the CLI: 46 47 ```bash 48 argocd app get APP 49 ``` 50 51 Which will return the sync state and any matching windows. 52 53 ``` 54 Name: guestbook 55 Project: default 56 Server: in-cluster 57 Namespace: default 58 URL: http://localhost:8080/applications/guestbook 59 Repo: https://github.com/argoproj/argocd-example-apps.git 60 Target: 61 Path: guestbook 62 SyncWindow: Sync Denied 63 Assigned Windows: deny:0 2 * * *:1h,allow:0 2 3 3 3:1h 64 Sync Policy: Automated 65 Sync Status: Synced to (5c2d89b) 66 Health Status: Healthy 67 ``` 68 69 Windows can be created using the CLI: 70 71 ```bash 72 argocd proj windows add PROJECT \ 73 --kind allow \ 74 --schedule "0 22 * * *" \ 75 --duration 1h \ 76 --applications "*" 77 ``` 78 79 Alternatively, they can be created directly in the `AppProject` manifest: 80 81 ```yaml 82 apiVersion: argoproj.io/v1alpha1 83 kind: AppProject 84 metadata: 85 name: default 86 spec: 87 syncWindows: 88 - kind: allow 89 schedule: '10 1 * * *' 90 duration: 1h 91 applications: 92 - '*-prod' 93 manualSync: true 94 - kind: deny 95 schedule: '0 22 * * *' 96 timeZone: "Europe/Amsterdam" 97 duration: 1h 98 namespaces: 99 - default 100 - kind: allow 101 schedule: '0 23 * * *' 102 duration: 1h 103 clusters: 104 - in-cluster 105 - cluster1 106 ``` 107 108 In order to perform a sync when syncs are being prevented by a window, you can configure the window to allow manual syncs 109 using the CLI, UI or directly in the `AppProject` manifest: 110 111 ```bash 112 argocd proj windows enable-manual-sync PROJECT ID 113 ``` 114 115 To disable 116 117 ```bash 118 argocd proj windows disable-manual-sync PROJECT ID 119 ``` 120 121 Windows can be listed using the CLI or viewed in the UI: 122 123 ```bash 124 argocd proj windows list PROJECT 125 ``` 126 127 ```bash 128 ID STATUS KIND SCHEDULE DURATION APPLICATIONS NAMESPACES CLUSTERS MANUALSYNC 129 0 Active allow * * * * * 1h - - prod1 Disabled 130 1 Inactive deny * * * * 1 3h - default - Disabled 131 2 Inactive allow 1 2 * * * 1h prod-* - - Enabled 132 3 Active deny * * * * * 1h - default - Disabled 133 ``` 134 135 All fields of a window can be updated using either the CLI or UI. The `applications`, `namespaces` and `clusters` fields 136 require the update to contain all of the required values. For example if updating the `namespaces` field and it already 137 contains default and kube-system then the new value would have to include those in the list. 138 139 ```bash 140 argocd proj windows update PROJECT ID --namespaces default,kube-system,prod1 141 ```