Orphan resources when an app leaves the ApplicationSet

[jacksonloper]

Removing an app's config.json takes its Application out of the set. ArgoCD then runs resources-finalizer and deletes everything the app owned. For fider-db that chain reaches the database:

Application fider-db  ->  owns postgresql.cnpg.io/Cluster/fider-db
Cluster fider-db      ->  ownerReference on PVC fider-db-1 (controller: true)
PVC fider-db-1        ->  PV pvc-df9a66c8, reclaim policy Delete

Those three links are observed on the live cluster today. The cascade itself is not — nobody has deleted an Application and watched a database die, and this PR exists so nobody has to.

The consequence follows from documented behaviour rather than an experiment: ArgoCD's resources-finalizer deletes an Application's managed resources, and Kubernetes garbage-collects an object once its controller: true owner is gone. Standard semantics on both sides, so the confidence is high — but calling it "verified" would overstate it.

If you want it settled empirically before merging, the cheap version is a throwaway app owning a throwaway CNPG cluster, deleted with the finalizer in place. That is more work than this PR.

Worth being clear about one thing, because the note on prune in this file argues the other way and it is correct: prune genuinely cannot reach a PVC, since no PVC in this cluster is managed by ArgoCD. But the finalizer does not prune. It deletes the Cluster, and the garbage collector does the rest.

The Retain policy applied after the August CNPG incident protects pvc-00a3f621, which is Released. The volume bound since the 08-29 rebuild is pvc-df9a66c8, and it is Delete.

With this set, removing a config.json orphans the resources. They keep running, and cleanup becomes a deliberate separate act.

Sequencing

This is step 1 of 6 in moving fider to Flux, and the only one that has to land before anything else:

Step	Change	Where
1	this PR	—
2	Flux scaffold, suspended	#52
3	flux bootstrap	command
4	Helm-adoption stamping	commands
5	remove applications/fider{,-db}/config.json	#TBD (draft)
6	flux resume kustomization apps	command

Step 5 is held in draft until this merges. That is the whole reason this PR exists separately.

It is also worth having on its own terms. Right now anyone retiring an app — discord-bot, alaska-rcv, an experiment — destroys its data as a side effect of deleting one small JSON file. starvote/postgresql is the one that would hurt.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MeFy2jujRA8ScQqRAshc1f

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 6abbaf85-1ad0-4d2f-8b80-d17bcbb618b4

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[3uzbcqje]

Let's discuss this at the next meeting. I think the desired behavior of deleting an app should be to delete the app - we have backups of volumes, so if we need to recover we still can.