Theory

Theory: Sync Policy is When the Loop May Write

Manual sync is a human-gated apply. Auto-sync is the loop applying whenever Git moves. Self-heal reapplies when the cluster drifts. Prune deletes objects gone from Git.

Invariants

1. Every field on spec.syncPolicy is a permission the controller has.
2. Server-side apply vs client-side merge is a conflict-management choice.
3. History limits bound how much old sync state you keep.

Git move → (auto-sync?) → apply → (prune?) → health

What can break

• Auto-prune on a shared namespace you do not fully own.

How to read this chapter

First app, policy, prune, retries/options, namespace/labels, recap.