Fully manual refresh but self-healing active

[fvogl]

I'm struggling to get ArgoCD configured so it only gets the desired state from the repo when I either refresh the app using the API or manually hit the refresh button in the UI.

In earlier versions I just used set the operator controller.appSync=0s and no refresh happened.
Now with the current version (3.1.8) I patched the argocd CR with

"extraConfig": {
  "timeout.reconciliation": "0s",
  "timeout.reconciliation.jitter": "5s"
}

but when I open the app in the UI it still refreshes. Not always but when I open it post the TTL in Redis I guess.
Anyone can help me achieving the requirement?

[LysCongThanh]

Two separate things are going on here.

1. timeout.reconciliation: 0s is the right setting for turning off the periodic refresh (argocd-cm docs: "Reconciliation by timeout is disabled if timeout is set to 0"). The same docs say argocd-repo-server and argocd-application-controller must be restarted manually after changing it, so check that those pods really restarted after you patched the argocd CR.

2. Opening an app in the UI can still trigger a refresh, by design. In the API server, getCachedAppState ("loads the cached state and trigger app refresh if cache is missing", server/application/application.go) calls Get with Refresh: normal whenever the app's cached state (resource tree / managed resources) is missing from Redis. Those entries are written with an expiration of controller.app.state.cache.expiration (default 1h; there is also a server.app.state.cache.expiration). With periodic reconciliation off, nothing rewrites them on a schedule, so the first time you open an app after they expire it gets refreshed. That matches what you describe ("when I open it post the TTL in Redis").

A refresh requested that way is treated like a manual one: the controller compares against the latest revision and force-resolves it (CompareWithLatestForceResolve in appcontroller.go), so new commits are picked up. A change to a managed resource in the cluster is different: it triggers CompareWithRecent, which compares against app.Status.Sync.Revision (the revision of the last comparison) without looking at the repo. So self-heal on its own works against the last known revision, which is what you want.

What you can do:

• Raise controller.app.state.cache.expiration and server.app.state.cache.expiration in argocd-cmd-params-cm (and restart the components). The flag is capped at 10h in the code (app-state-cache-expiration), so this makes the unexpected refresh rarer but can't remove it.
• For a deterministic setup, pin targetRevision to a commit SHA. Then a refresh triggered by opening the UI resolves to the same commit, and the desired state only changes when you change targetRevision.
• If an unexpected refresh must never lead to a sync, turn off automated sync for that app and sync manually.

Checked on master and v3.1.8. Not verified: I haven't run this against a live Argo CD, and I don't know how the operator applies extraConfig in your setup.