Application dependencies

[jessesuen]

Summary

I was speaking with @JasonMorgan from Buoyant today about a missing feature in Argo CD for blocking application syncs based on required dependencies on other applications. The use case is:

1. I need to deploy apps A and B
2. B must not be deployed before A (because A has a mutating webhook which must be in place before B starts)
3. I want to sync them all at the same time and don't want to think about clicking sync in some correct order

This is especially important for the bootstrapping use case where you're recreating a cluster from git, and you need to create many apps after a bunch of system-level add-ons are fully available. e.g. linkerd must be in place before any applications come up, because linkerd's mutating webhook needs to inject sidecars into application pods starting up.

The use case is very compelling and I'm convinced we should prioritize this. I think this feature, combined with ApplicationSets will really start to complete our bootstrapping story.

Motivation

Please give examples of your use case, e.g. when would you use this.

During cluster bootstrapping, cluster addons (especially ones with mutating webhooks) need to be in place before application pods can come up.

Proposal

How do you think this should be implemented?

It turns out, @jannfis already started some work on this, and the spec changes close to what we need: #3892

Given the age of the original PR, I'm filing an issue in case we abandon #3892 for a new attempt, and targeting this for tentative next milestone in case someone wants to pick this up.

[jannfis]

I'm glad to see this gaining traction again. From previous discussions, we thought that the sync retry feature would solve this problem in a more declarative way (e.g. reconcile as long as necessary, hoping for dependencies to have finished reconciling in a certain time frame).

I think we could build up upon the existing PoC code, however I think we should consider some more things than are currently implemented in the PoC:

• Application dependency specification should allow for label selector as well as single, named Applications
• Ability to optional restrict dependencies on same destination clusters
• Force sync should override/ignore any unmet dependencies when syncing manually
• Dependencies should be visualized in the UI, similar to how we visualize ownerReferences

And probably some more things I have somewhere in the back of my mind from when I came up with the PoC.

[jessesuen]

I'm glad to see this gaining traction again. From previous discussions, we thought that the sync retry feature would solve this problem in a more declarative way (e.g. reconcile as long as necessary, hoping for dependencies to have finished reconciling in a certain time frame).

Yes, what I now realize is that retries don't help because in the problematic scenario (mutating webhooks), nothing actually "fails" per se and so there is nothing to retry. The dependent application silently succeeds even though it didn't get injected properly.

I think we could build up upon the existing PoC code, however, I think we should consider some more things than are currently implemented in the PoC:

I love your ideas on making this even more powerful with labels and force sync. But for MVP, we can keep this quite simple, not very far removed from your PoC. The way I think this feature should work is:

1. Application B depends on A. Both applications are created, but neither is deployed (have a Missing health status).
2. User clicks sync on B
3. B now has an operation in a Running state (because we don't have a Pending state), but stays inRunning indefinitely because A is not healthy (NOTE: we would also keep it in Running if A did not exist).
4. User eventually clicks on sync on A
5. As soon as A is Healthy, B would actually go through with the operation.

I took a look at your work, and I believe you implemented it just like how I described it.

Dependencies should be visualized in the UI, similar to how we visualize ownerReferences

I think this is more than we need, a simple message in the operation would be sufficient to understand what's going on.

[Lavanya-Anbalagan]

This is a blocker for us and makes us to put lot of efforts between the dependency applications. Can we get an update on this ?.

[flaviomoringa]

Have the exact same issue with installing Kyverno and then some policies.
Also referenced here:
#8358
#7978

[hhannani]

Hi team, is there a way to use dependencies between yaml files within the same Application?

[DotNetRockStar]

bump; same issues.

[rafilkmp3]

bump; same issues.

[christianh814]

Just adding my "bump" here. This is mainly because I would also like this with ApplicationSets as I stated in issue #221