Argo-cd: Allow resources to be excluded from sync via annotation

[twz123]

In order to allow more fine-grained control over the synchronization behavior of individual resources, Argo CD could support a certain annotation, like e.g. argocd.argoproj.io/synchronization: Exclude that can be added to resources to exclude them from being synchronized, similar to the global resource.exclusions setting.

This might come in handy for a variety of use cases, one of them being kustomize/commonLabels (like described in https://github.com/argoproj/argo-cd/issues/1250#issuecomment-473200418). So one can propagate the app.kubernetes.io/instance label to dependent, auto-generated resources that Argo CD cannot correlate with their owning resources (like PersistentVolumeClaims generated from volumeClaimTemplates) and also add the "exclude" annotation to them.

[jessesuen]

Alternatively, we could come up with a different understanding of "ownership" other than the instance label. For example we could switch to injection of an _annotation_, instead of a label. With the new controller design, we actually no longer depend on the injected object being a label, since we no longer query by label.

[alexec]

You may be able to exclude a resource from sync using hook-type: Skip.

See https://argoproj.github.io/argo-cd/user-guide/resource_hooks/#available-hooks.

[twz123]

Oh... sneaky ;) Does this also affect the sync status calculation? In fact, I think I'm looking more like something as described in https://github.com/argoproj/argo-cd/issues/1629#issuecomment-496748738.

Maybe close this one in favor of #1629?

[alexec]

Not sure about the sync status. You'll need to experiment.

[jessesuen]

I have agreement with @alexec on syntax. Resources can be annotated like the following:

metadata:
  annotations:
    compare-options: IgnoreExtraneous
    sync-options: Prune=false

In the future, these options might be expanded:

metadata:
  annotations:
    compare-options: IgnoreExtraneous,IgnoreDifference=/spec/some/field
    sync-options: Prune=false,Validate=false,Force=true,ConfigGC=enabled