From ca028013ce8ac61bc3d80488adf5f8248d81f926 Mon Sep 17 00:00:00 2001
From: duynguyen <huonghaiduynhim@gmail.com>
Date: Wed, 2 Sep 2026 16:22:15 +0700
Subject: [PATCH] chore: manual sync for leaf apps, keep root app-of-apps
 automated
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Convention: only the root app-of-apps (bootstrap) auto-syncs so it picks up
new/changed child Application definitions from Git. Every leaf service app
(metallb, metallb-config, envoy-gateway, envoy-gateway-config, nfs-provisioner)
now requires an explicit manual Sync — matches the existing argocd (self-manage)
and ignis convention.
---
 bootstrap/apps/envoy-gateway-config.yaml | 4 +---
 bootstrap/apps/envoy-gateway.yaml        | 4 +---
 bootstrap/apps/metallb-config.yaml       | 4 +---
 bootstrap/apps/metallb.yaml              | 4 +---
 bootstrap/apps/nfs-provisioner.yaml      | 4 +---
 5 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/bootstrap/apps/envoy-gateway-config.yaml b/bootstrap/apps/envoy-gateway-config.yaml
index 18c5d88..3a50b45 100644
--- a/bootstrap/apps/envoy-gateway-config.yaml
+++ b/bootstrap/apps/envoy-gateway-config.yaml
@@ -14,9 +14,7 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: envoy-gateway-system
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - SkipDryRunOnMissingResource=true
diff --git a/bootstrap/apps/envoy-gateway.yaml b/bootstrap/apps/envoy-gateway.yaml
index dc8ed67..98ad100 100644
--- a/bootstrap/apps/envoy-gateway.yaml
+++ b/bootstrap/apps/envoy-gateway.yaml
@@ -20,10 +20,8 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: envoy-gateway-system
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
diff --git a/bootstrap/apps/metallb-config.yaml b/bootstrap/apps/metallb-config.yaml
index 35446c5..c060350 100644
--- a/bootstrap/apps/metallb-config.yaml
+++ b/bootstrap/apps/metallb-config.yaml
@@ -14,10 +14,8 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: metallb-system
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - CreateNamespace=true
       - SkipDryRunOnMissingResource=true
diff --git a/bootstrap/apps/metallb.yaml b/bootstrap/apps/metallb.yaml
index 4d5c51c..e5200b8 100644
--- a/bootstrap/apps/metallb.yaml
+++ b/bootstrap/apps/metallb.yaml
@@ -20,10 +20,8 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: metallb-system
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - CreateNamespace=true
   ignoreDifferences:
diff --git a/bootstrap/apps/nfs-provisioner.yaml b/bootstrap/apps/nfs-provisioner.yaml
index ff0a6bd..958e680 100644
--- a/bootstrap/apps/nfs-provisioner.yaml
+++ b/bootstrap/apps/nfs-provisioner.yaml
@@ -20,9 +20,7 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: nfs-provisioner
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
     syncOptions:
       - CreateNamespace=true