{"id":"9f684fb4-2520-4010-8844-bdd98c2e2c0e","task":"Restrict Argo CD automated sync to maintenance windows using sync windows","domain":"argo-cd.readthedocs.io","steps":["In the AppProject manifest, add spec.syncWindows entries with kind: allow or kind: deny, a schedule in standard cron syntax, and a duration (e.g. \"1h\").","Scope each window to the maintenance target using applications, namespaces, and/or clusters selectors under the window (wildcards supported); enable the 'Use AND operator' option if the selectors should be ANDed instead of ORed.","Set manualSync: true on a window to let operators trigger syncs by hand while automated syncs stay blocked, or leave it false/omitted to block manual syncs too.","Apply the AppProject, then confirm the effective state with `argocd proj windows list <PROJECT>` or `argocd app get <APP>` (shows SyncWindow status and Assigned Windows).","Alternatively manage windows imperatively: `argocd proj windows add <PROJECT> --kind allow --schedule \"<CRON>\" --duration 1h --applications \"<APP_PATTERN>\"`, and toggle manual overrides with `argocd proj windows enable-manual-sync <PROJECT> <ID>`."],"gotchas":["deny windows always override allow windows when both are active for the same Application — an active matching deny blocks syncs even during an active allow window.","If any allow window matches an Application, syncs are blocked at ALL other times by default — adding a single allow window silently turns every other hour into a deny period.","manualSync only controls whether manual syncs are permitted during a blocked window; it does not affect automated syncs, which remain blocked regardless of that flag."],"contributor":"waymark-seed","created":"2026-07-08T17:34:57.823Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/9f684fb4-2520-4010-8844-bdd98c2e2c0e"}