Sync policies & self-heal

Auto-sync, prune, self-heal.

Advanced14 min · lesson 5 of 12

By default an OutOfSync app waits for a manual sync. A syncPolicy with automated turns on continuous delivery: Argo CD syncs automatically whenever Git changes. Two options refine it. prune deletes resources that were removed from Git (without it, deleting a manifest leaves the object orphaned in the cluster). selfHeal reverts live drift back to Git. Together, automated + prune + selfHeal make the cluster strictly track Git — the fullest GitOps posture.

application.yaml (syncPolicy)

spec:
  syncPolicy:
    automated:
      prune: true       # delete resources removed from Git
      selfHeal: true    # revert out-of-band drift back to Git
    syncOptions:
      - CreateNamespace=true
      - ApplyOutOfSyncOnly=true
    retry:
      limit: 5
      backoff: { duration: 5s, factor: 2, maxDuration: 3m }

Choosing a posture per environment

The right policy varies by environment. Dev often runs fully automated with prune and self-heal for immediate, hands-off updates. Production frequently uses manual (or automated without self-heal) so a human confirms the sync, plus required PR approvals upstream — because auto-syncing prod means a merge deploys instantly with no second gate. The safety of GitOps comes from the Git review; auto-sync removes the deploy-time gate, so lean on branch protection and approvals to compensate.

prune deletes; auto-sync removes the deploy gate

prune is powerful and blunt: remove a manifest from Git and Argo CD deletes the live resource — including, if you are not careful, stateful ones. And automated sync means a merge to the tracked branch deploys to prod with no further approval, so your only gate is the Git review. Enable prune knowingly (watch what it would delete in the diff), and pair auto-sync with strict branch protection so the PR is a real gate.

The reconcile loop & driftSync waves & hooks