argocd sync app --dry-run should affect status and metrics of the apps?

[jsolana]

Hello! I’d like to hear your thoughts.

Currently, executing the command argocd app sync --dry-run affects both the application’s state and the internal metrics exposed by ArgoCD (eg: argocd_app_info).

The main issue is that if there are alerts based on these metrics, and the dry-run execution identifies an error (e.g., a change that violates a Kyverno policy or an invalid CRD schema), the application state changes to SyncErr. This also updates the metrics, which can potentially trigger alerts based on these metrics.

For example:

# alert manager alert definition
- alert: ArgoCDApplicationUnknown
  expr: sum by (cluster) (argocd_app_info{sync_status="Unknown"}) > 0
  for: 15m
...

Since the definition of a dry-run is to execute requests without persistence, I wonder if it makes sense to handle it in a way that ensures no changes are made.

Alternatively, adding a dry_run label to differentiate operational requests from dry-run requests could also be an option (a similar change has been proposed for kyverno link).

What do you think? Thanks!

[leoluz]

From what you described, it seems that we can consider this as a bug. In my view, a dry-run sync shouldn't impact the app state.

[jsolana]

Totally agree. Should I create a bug issue? Thanks

[leoluz]

sure. Please go ahead. Just to make sure, the bug is related to how the prometheus metrics being incremented when sync is executed with dryrun. We should list all the impacted metrics and once we have a clear picture of what we are dealing with, we should decide if we just avoid those increments or if we introduce a new dryrun label in the metrics. Initially I am inclined in just avoiding incrementing the counts.

[jsolana]

Nice, let me create it. Thanks!

[jsolana]

Closed in favor of #21899