In an Argo CD Application's spec.syncPolicy.automated block, what do prune: true and selfHeal: true each change, and what happens when each of them is left off?

## The three switches ```yaml spec: syncPolicy: automated: prune: true selfHeal: true allowEmpty: false ``` Adding `automated` at all is the first decision: it tells the application controller to run a sync on its own when the desired state changes, instead of waiting for `argocd app sync` or a click in the UI. What surprises people is how narrow that promise is by default. ## prune — acting on what is missing from Git When a manifest disappears from the source (someone deleted the file, or an overlay stopped generating it), Argo CD can see that a live resource has no counterpart in the desired state. It refuses to delete it unless `prune: true`. This is a safety default: deletion is the one irreversible operation in the model, and an accidental delete of a `PersistentVolumeClaim` or a namespace is not a Git revert away. With `prune: false` the app sits `OutOfSync` with the resource marked as requiring pruning, and the UI offers a manual prune. Teams often discover this after the fact — an app that looks broken for weeks because a removed resource keeps it out of sync. How does Argo CD know a live object belongs to it at all? By a tracking marker it stamps on everything it applies — historically the `app.kubernetes.io/instance` label, and with `application.resourceTrackingMethod: annotation` the `argocd.argoproj.io/tracking-id` annotation. This matters in practice: if a resource carries a stale instance label from another app, prune can delete something you did not mean to give it. Label-based tracking is also why an object hand-labelled with an app name can be adopted (and then pruned) unexpectedly. Two related controls are worth knowing. `PruneLast=true` as a sync option defers pruning until everything else has been applied and is healthy, so you do not delete the old thing before the new thing works. `PrunePropagationPolicy=foreground|background|orphan` chooses the Kubernetes deletion propagation used when pruning. And a per-resource annotation `argocd.argoproj.io/sync-options: Prune=false` exempts one object from pruning entirely — the usual way to protect a database or a PVC that lives in the same app. ## selfHeal — acting on drift in the cluster `selfHeal: true` says: whenever live state diverges from the rendered desired state, re-apply. That is what makes Argo CD an actual guard against manual changes. Turn it on and `kubectl scale deployment/api --replicas=10` is undone within seconds; turn it off and Argo CD merely reports the drift. The subtlety is the *trigger*. Ordinary automated sync is driven by the source: a new commit produces new desired state, Argo CD syncs. Self-heal is driven by the live state, so it must react to cluster events, and it is debounced (a short timeout on the application controller, a few seconds by default, tunable) precisely so that a resource being fought over by two controllers does not produce a continuous sync loop. That fight is the classic self-heal incident: an HPA writes `spec.replicas`, Argo CD writes it back from Git, the HPA writes it again. The fix is not to disable self-heal but to stop claiming ownership of the field — remove `replicas` from the manifest, or list it under `ignoreDifferences` together with the `RespectIgnoreDifferences=true` sync option. Self-heal also has a hard limit: it repairs *modifications and deletions of tracked resources*. It does not stop the change from happening — Argo CD is not an admission controller. If you need the edit rejected rather than reverted, that is cluster policy, not GitOps. ## allowEmpty — the blast-radius guard With `prune: true`, a commit that accidentally empties the source path (a bad Kustomize edit, a chart that renders nothing) would prune every resource in the app. `automated.allowEmpty` defaults to `false`, which makes Argo CD refuse to sync to an empty desired state. Turning it on is rare and deliberate. ## Choosing the combination - **No automated policy** — Argo CD is a diff tool plus a big Sync button; suitable for environments where deploys are gated by a human. - **automated, no prune, no self-heal** — commits roll out, but nothing is ever deleted or reverted automatically. A common first step, and a common source of permanently out-of-sync apps. - **automated + prune + selfHeal** — the full statement that Git is authoritative. Sensible for stateless workloads in non-critical or well-tested environments, and increasingly for production once the team trusts its manifests. A good answer names the asymmetry: prune concerns absence, self-heal concerns divergence, and both are off by default because both can destroy something no commit can bring back.