@opensoha/contracts 0.1.17 → 0.1.19

package/resource/runtime/argocd_observation.go

@@ -0,0 +1,143 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"time"
+
+	contractresource "github.com/opensoha/soha-contracts/resource"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/client-go/dynamic"
+)
+
+// ArgoObservation retains live child inventory while the operation progresses.
+// Cached controller health cannot override missing, unowned or drifted children.
+type ArgoObservation struct {
+	OperationID string
+	Phase       string
+	Revision    string
+	Health      string
+	Drifted     bool
+	Resources   []*unstructured.Unstructured
+}
+
+func ObserveArgoApplication(ctx context.Context, client dynamic.Interface, desired, object *unstructured.Unstructured, children []*unstructured.Unstructured, owner string) (ArgoObservation, error) {
+	observation := ArgoObservation{Health: "unknown"}
+	if err := ValidateArgoResources(desired, children); err != nil {
+		return observation, err
+	}
+	if err := validateArgoOwner(object, owner); err != nil {
+		return observation, err
+	}
+	observation.Health = "progressing"
+	observation.OperationID = object.GetAnnotations()[ArgoOperationAnnotation]
+	observation.Phase = argoString(object, "status", "operationState", "phase")
+	observation.Revision = argoString(object, "status", "sync", "revision")
+	observation.Drifted = !argoMatchesDesired(desired.Object, object.Object)
+	expected := map[string]bool{}
+	for _, child := range children {
+		expected[argoResourceKey(child)] = true
+	}
+	reported, _, err := unstructured.NestedSlice(object.Object, "status", "resources")
+	if err != nil || len(reported) > 49 {
+		return observation, fmt.Errorf("invalid GitOps resource observations")
+	}
+	seen := map[string]bool{}
+	for _, raw := range reported {
+		item, ok := raw.(map[string]any)
+		if !ok {
+			return observation, fmt.Errorf("invalid GitOps resource observation")
+		}
+		group, _ := item["group"].(string)
+		kind, _ := item["kind"].(string)
+		name, _ := item["name"].(string)
+		key := group + "/" + kind + "/" + name
+		if !expected[key] || seen[key] || item["namespace"] != desired.GetNamespace() {
+			return observation, fmt.Errorf("GitOps observed a resource outside its frozen inventory")
+		}
+		seen[key] = true
+	}
+	queryCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
+	defer cancel()
+	healthy, degraded := len(seen) == len(expected), false
+	for _, child := range children {
+		gvk := child.GroupVersionKind()
+		live, err := client.Resource(argoResourceTypes[gvk.Group+"/"+gvk.Kind]).Namespace(child.GetNamespace()).Get(queryCtx, child.GetName(), metav1.GetOptions{})
+		if apierrors.IsNotFound(err) {
+			healthy = false
+			continue
+		}
+		if err != nil {
+			return observation, err
+		}
+		if live.GetUID() == "" || !argoTracksResource(desired, live) {
+			return observation, fmt.Errorf("GitOps child ownership does not match its Application")
+		}
+		observation.Resources = append(observation.Resources, live)
+		health := contractresource.ManifestHealth(live.Object)
+		healthy = healthy && health == "healthy"
+		degraded = degraded || health == "degraded"
+		observation.Drifted = observation.Drifted || !argoMatchesDesired(child.Object, live.Object)
+		for _, field := range []string{"containers", "initContainers"} {
+			wanted, _, _ := unstructured.NestedSlice(child.Object, "spec", "template", "spec", field)
+			actual, _, _ := unstructured.NestedSlice(live.Object, "spec", "template", "spec", field)
+			observation.Drifted = observation.Drifted || len(wanted) != len(actual)
+		}
+	}
+	current := observation.OperationID != "" && argoOperationID(object, "status", "operationState", "operation") == observation.OperationID
+	if observation.Drifted || degraded || current && (observation.Phase == "Failed" || observation.Phase == "Error") {
+		observation.Health = "degraded"
+		return observation, nil
+	}
+	source, _, _ := unstructured.NestedMap(desired.Object, "spec", "source")
+	compared, _, _ := unstructured.NestedMap(object.Object, "status", "sync", "comparedTo", "source")
+	if healthy && current && observation.Phase == "Succeeded" && argoString(object, "status", "operationState", "finishedAt") != "" && object.Object["operation"] == nil && reflect.DeepEqual(source, compared) && observation.Revision == argoString(desired, "spec", "source", "targetRevision") && argoString(object, "status", "operationState", "syncResult", "revision") == observation.Revision && argoString(object, "status", "sync", "status") == "Synced" && argoString(object, "status", "health", "status") == "Healthy" {
+		observation.Health = "healthy"
+	}
+	return observation, nil
+}
+
+func argoResourceKey(object *unstructured.Unstructured) string {
+	gvk := object.GroupVersionKind()
+	return gvk.Group + "/" + gvk.Kind + "/" + object.GetName()
+}
+
+// API defaults may add object fields, but lists must retain their frozen shape.
+func argoMatchesDesired(desired, observed any) bool {
+	switch value := desired.(type) {
+	case map[string]any:
+		live, ok := observed.(map[string]any)
+		if !ok {
+			return false
+		}
+		for key, child := range value {
+			if !argoMatchesDesired(child, live[key]) {
+				return false
+			}
+		}
+		return true
+	case []any:
+		// Kubernetes omits empty optional lists such as container env/args.
+		if len(value) == 0 && observed == nil {
+			return true
+		}
+		live, ok := observed.([]any)
+		if !ok || len(value) != len(live) {
+			return false
+		}
+		for i, child := range value {
+			if !argoMatchesDesired(child, live[i]) {
+				return false
+			}
+		}
+		return true
+	default:
+		wanted, _ := json.Marshal(desired)
+		actual, _ := json.Marshal(observed)
+		return string(wanted) == string(actual)
+	}
+}

package/resource/runtime/argocd_operation.go

@@ -0,0 +1,253 @@
+package runtime
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"reflect"
+	"slices"
+	"strings"
+	"time"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/util/retry"
+)
+
+var ErrArgoStopUnconfirmed = errors.New("argo CD operation stop is not confirmed")
+
+// ApplyArgoApplication writes only the Application root. A persisted operation
+// key makes an ambiguous response or worker restart resume the same sync.
+func ApplyArgoApplication(ctx context.Context, client dynamic.Interface, desired *unstructured.Unstructured, children []*unstructured.Unstructured, options metav1.PatchOptions, operationID string) (*unstructured.Unstructured, error) {
+	if err := ValidateArgoResources(desired, children); err != nil {
+		return nil, err
+	}
+	if operationID == "" || options.FieldManager == "" || options.Force != nil && *options.Force {
+		return nil, fmt.Errorf("GitOps requires a stable operation key and a non-forced owner")
+	}
+	if desired.Object["operation"] != nil {
+		return nil, fmt.Errorf("GitOps operation must be generated by the executor")
+	}
+	if err := validateArgoProject(ctx, client, desired); err != nil {
+		return nil, err
+	}
+	resources := client.Resource(argoApplications).Namespace(desired.GetNamespace())
+	var applied, attempted *unstructured.Unstructured
+	err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		if err := CheckArgoResourceOwners(ctx, client, desired, children); err != nil {
+			return err
+		}
+		live, err := resources.Get(ctx, desired.GetName(), metav1.GetOptions{})
+		if apierrors.IsNotFound(err) {
+			write := desired.DeepCopy()
+			setArgoOperation(write, options.FieldManager, operationID)
+			attempted = write.DeepCopy()
+			applied, err = resources.Create(ctx, write, metav1.CreateOptions{FieldManager: options.FieldManager, DryRun: options.DryRun})
+			return err
+		}
+		if err != nil {
+			return err
+		}
+		if err := validateArgoOwner(live, options.FieldManager); err != nil {
+			return err
+		}
+		if live.GetAnnotations()[ArgoOperationAnnotation] == operationID {
+			if !reflect.DeepEqual(live.Object["spec"], desired.Object["spec"]) {
+				return fmt.Errorf("GitOps operation key refers to different desired inputs")
+			}
+			applied = live
+			return nil
+		}
+		if argoOperationActive(live) {
+			return fmt.Errorf("GitOps Application has an unfinished operation")
+		}
+		write := live.DeepCopy()
+		write.Object["spec"] = desired.DeepCopy().Object["spec"]
+		write.SetLabels(desired.GetLabels())
+		write.SetAnnotations(desired.GetAnnotations())
+		setArgoOperation(write, options.FieldManager, operationID)
+		attempted = write.DeepCopy()
+		applied, err = resources.Update(ctx, write, metav1.UpdateOptions{FieldManager: options.FieldManager, DryRun: options.DryRun})
+		return err
+	})
+	if err != nil && len(options.DryRun) == 0 && attempted != nil && !apierrors.IsInvalid(err) && !apierrors.IsForbidden(err) && !apierrors.IsUnauthorized(err) && !apierrors.IsBadRequest(err) && !apierrors.IsConflict(err) && !apierrors.IsAlreadyExists(err) {
+		recoveryCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 15*time.Second)
+		live, readErr := resources.Get(recoveryCtx, desired.GetName(), metav1.GetOptions{})
+		cancel()
+		if readErr != nil || validateArgoOwner(live, options.FieldManager) != nil || live.GetAnnotations()[ArgoOperationAnnotation] != operationID || attempted.GetUID() != "" && attempted.GetUID() != live.GetUID() {
+			return live, fmt.Errorf("%w: sync write outcome could not be confirmed", ErrArgoStopUnconfirmed)
+		}
+		return stopArgoAfterError(ctx, resources, live, operationID, err)
+	}
+	if err != nil || len(options.DryRun) != 0 {
+		return applied, err
+	}
+	return waitArgoOperation(ctx, resources, applied, operationID)
+}
+
+func setArgoOperation(object *unstructured.Unstructured, owner, operationID string) {
+	annotations := object.GetAnnotations()
+	if annotations == nil {
+		annotations = map[string]string{}
+	}
+	annotations[ArgoOwnerAnnotation], annotations[ArgoOperationAnnotation] = owner, operationID
+	object.SetAnnotations(annotations)
+	object.Object["operation"] = map[string]any{
+		"initiatedBy": map[string]any{"username": "soha", "automated": false},
+		"info":        []any{map[string]any{"name": ArgoOperationAnnotation, "value": operationID}},
+		"sync":        map[string]any{"revision": argoString(object, "spec", "source", "targetRevision"), "prune": false, "syncOptions": []any{"FailOnSharedResource=true"}},
+	}
+}
+
+func validateArgoOwner(object *unstructured.Unstructured, owner string) error {
+	if err := ValidateArgoApplication(object); err != nil {
+		return err
+	}
+	if owner == "" || object.GetAnnotations()[ArgoOwnerAnnotation] != owner || object.GetUID() == "" {
+		return fmt.Errorf("GitOps Application belongs to another writer; implicit adoption is disabled")
+	}
+	if object.GetLabels()["argocd.argoproj.io/instance"] != "" || object.GetLabels()["app.kubernetes.io/managed-by"] == "Helm" {
+		return fmt.Errorf("GitOps Application is externally managed")
+	}
+	return nil
+}
+
+func argoOperationActive(object *unstructured.Unstructured) bool {
+	phase := argoString(object, "status", "operationState", "phase")
+	return object.Object["operation"] != nil || phase == "Running" || phase == "Terminating"
+}
+
+func waitArgoOperation(ctx context.Context, client dynamic.ResourceInterface, initial *unstructured.Unstructured, operationID string) (*unstructured.Unstructured, error) {
+	ticker := time.NewTicker(time.Second)
+	defer ticker.Stop()
+	for {
+		live, err := client.Get(ctx, initial.GetName(), metav1.GetOptions{})
+		if ctx.Err() != nil {
+			return stopArgoAfterError(ctx, client, initial, operationID, ctx.Err())
+		}
+		if err != nil {
+			return stopArgoAfterError(ctx, client, initial, operationID, err)
+		}
+		if live.GetUID() != initial.GetUID() || live.GetAnnotations()[ArgoOperationAnnotation] != operationID {
+			return live, fmt.Errorf("GitOps operation ownership changed while observing")
+		}
+		if !argoOperationActive(live) && argoOperationID(live, "status", "operationState", "operation") == operationID {
+			if argoString(live, "status", "operationState", "phase") == "Succeeded" {
+				return live, nil
+			}
+			return live, fmt.Errorf("argo CD sync did not succeed")
+		}
+		select {
+		case <-ctx.Done():
+		case <-ticker.C:
+		}
+	}
+}
+
+func stopArgoAfterError(ctx context.Context, client dynamic.ResourceInterface, initial *unstructured.Unstructured, operationID string, cause error) (*unstructured.Unstructured, error) {
+	stopCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 30*time.Second)
+	defer cancel()
+	stopped, err := terminateArgoOperation(stopCtx, client, initial, operationID)
+	if err != nil {
+		return stopped, fmt.Errorf("%w: %v", ErrArgoStopUnconfirmed, err)
+	}
+	if ctx.Err() != nil {
+		cause = ctx.Err()
+	}
+	return stopped, cause
+}
+
+// The native Argo CD TerminateOperation implementation updates the root status
+// phase to Terminating. UID/RV and operation identity fence every request here;
+// only a controller-written terminal observation confirms the stop.
+func terminateArgoOperation(ctx context.Context, client dynamic.ResourceInterface, initial *unstructured.Unstructured, operationID string) (*unstructured.Unstructured, error) {
+	ticker := time.NewTicker(time.Second)
+	defer ticker.Stop()
+	for {
+		live, err := client.Get(ctx, initial.GetName(), metav1.GetOptions{})
+		if err != nil {
+			return live, err
+		}
+		if live.GetUID() != initial.GetUID() || live.GetAnnotations()[ArgoOperationAnnotation] != operationID {
+			return live, fmt.Errorf("GitOps operation identity changed before stop confirmation")
+		}
+		stateID := argoOperationID(live, "status", "operationState", "operation")
+		phase := argoString(live, "status", "operationState", "phase")
+		if !argoOperationActive(live) && stateID == operationID {
+			if phase == "Succeeded" || phase == "Failed" {
+				return live, nil
+			}
+			return live, fmt.Errorf("argo CD termination reported an error")
+		}
+		if live.Object["operation"] != nil && argoOperationID(live, "operation") != operationID {
+			return live, fmt.Errorf("another GitOps operation is active")
+		}
+		if stateID == operationID && phase == "Running" {
+			_ = unstructured.SetNestedField(live.Object, "Terminating", "status", "operationState", "phase")
+			_, err = client.Update(ctx, live, metav1.UpdateOptions{})
+			if err != nil && !apierrors.IsConflict(err) {
+				return live, err
+			}
+		}
+		select {
+		case <-ctx.Done():
+			return live, ctx.Err()
+		case <-ticker.C:
+		}
+	}
+}
+
+func validateArgoProject(ctx context.Context, client dynamic.Interface, application *unstructured.Unstructured) error {
+	namespace := application.GetAnnotations()["delivery.soha.io/argocd-namespace"]
+	if namespace == "" {
+		namespace = application.GetNamespace()
+	}
+	project, err := client.Resource(schema.GroupVersionResource{Group: "argoproj.io", Version: "v1alpha1", Resource: "appprojects"}).Namespace(namespace).Get(ctx, argoString(application, "spec", "project"), metav1.GetOptions{})
+	if err != nil {
+		return fmt.Errorf("read restricted Argo CD project: %w", err)
+	}
+	destinations, _, err := unstructured.NestedSlice(project.Object, "spec", "destinations")
+	if err != nil || len(destinations) != 1 {
+		return fmt.Errorf("GitOps project must authorize only the selected namespace and cluster")
+	}
+	destination, _ := destinations[0].(map[string]any)
+	if destination["namespace"] != application.GetNamespace() || destination["server"] != "https://kubernetes.default.svc" {
+		return fmt.Errorf("GitOps project destination is outside the delivery target")
+	}
+	clusterKinds, _, err := unstructured.NestedSlice(project.Object, "spec", "clusterResourceWhitelist")
+	if err != nil || len(clusterKinds) != 0 {
+		return fmt.Errorf("GitOps project must deny cluster-scoped resources")
+	}
+	allowed, _, err := unstructured.NestedSlice(project.Object, "spec", "namespaceResourceWhitelist")
+	if err != nil || len(allowed) == 0 {
+		return fmt.Errorf("GitOps project requires an explicit supported resource allowlist")
+	}
+	for _, raw := range allowed {
+		item, _ := raw.(map[string]any)
+		group, _ := item["group"].(string)
+		kind, _ := item["kind"].(string)
+		if _, ok := argoResourceTypes[group+"/"+kind]; !ok {
+			return fmt.Errorf("GitOps project permits unsupported resource kinds")
+		}
+	}
+	repositories, _, err := unstructured.NestedStringSlice(project.Object, "spec", "sourceRepos")
+	if err != nil || !slices.Contains(repositories, argoString(application, "spec", "source", "repoURL")) {
+		return fmt.Errorf("GitOps repository is not explicitly authorized by its project")
+	}
+	if namespace != application.GetNamespace() {
+		sources, _, err := unstructured.NestedStringSlice(project.Object, "spec", "sourceNamespaces")
+		if err != nil || !slices.Contains(sources, application.GetNamespace()) {
+			return fmt.Errorf("GitOps project does not authorize this Application namespace")
+		}
+	}
+	// Wildcard source access is not a sufficient substitute for an explicit grant.
+	for _, repository := range repositories {
+		if strings.ContainsAny(repository, "*?") {
+			return fmt.Errorf("GitOps project repository grants must be explicit")
+		}
+	}
+	return nil
+}

package/resource/runtime/argocd_resources.go

@@ -0,0 +1,115 @@
+package runtime
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/client-go/dynamic"
+)
+
+// ValidateArgoResources bounds the controller's writes to the resources rendered
+// from the same immutable source used by the delivery plan.
+func ValidateArgoResources(application *unstructured.Unstructured, resources []*unstructured.Unstructured) error {
+	if err := ValidateArgoApplication(application); err != nil {
+		return err
+	}
+	if len(resources) == 0 || len(resources) > 49 {
+		return fmt.Errorf("GitOps requires 1 to 49 frozen child resources")
+	}
+	images, _, _ := unstructured.NestedStringSlice(application.Object, "spec", "source", "kustomize", "images")
+	expectedImages := map[string]bool{}
+	for _, image := range images {
+		_, image, _ = ParseArgoImageOverride(image)
+		expectedImages[image] = false
+	}
+	seen := map[string]bool{}
+	for _, resource := range resources {
+		if resource == nil {
+			return fmt.Errorf("GitOps child resource is missing")
+		}
+		gvk := resource.GroupVersionKind()
+		gvr, supported := argoResourceTypes[gvk.Group+"/"+gvk.Kind]
+		key := gvk.Group + "/" + gvk.Kind + "/" + resource.GetName()
+		if !supported || gvk.Version != gvr.Version || resource.GetNamespace() != application.GetNamespace() || resource.GetName() == "" || seen[key] {
+			return fmt.Errorf("GitOps child resource is unsupported, repeated or outside the target namespace")
+		}
+		seen[key] = true
+		if resource.GetUID() != "" || resource.GetResourceVersion() != "" || resource.GetGenerateName() != "" || resource.GetDeletionTimestamp() != nil || len(resource.GetOwnerReferences()) != 0 || len(resource.GetFinalizers()) != 0 || resource.Object["status"] != nil {
+			return fmt.Errorf("GitOps child resources must be independent desired objects")
+		}
+		if err := ValidateDirectManifestOwner(resource); err != nil {
+			return err
+		}
+		for key := range resource.GetAnnotations() {
+			if strings.HasPrefix(key, "argocd.argoproj.io/") && key != "argocd.argoproj.io/sync-wave" {
+				return fmt.Errorf("GitOps child hooks and controller overrides are unsupported")
+			}
+		}
+		if resource.GetKind() == "Secret" && (resource.Object["data"] != nil || resource.Object["stringData"] != nil) {
+			return fmt.Errorf("GitOps secret values must use administrator-managed references")
+		}
+		for _, field := range []string{"containers", "initContainers"} {
+			containers, _, err := unstructured.NestedSlice(resource.Object, "spec", "template", "spec", field)
+			if err != nil {
+				return err
+			}
+			for _, raw := range containers {
+				container, _ := raw.(map[string]any)
+				image, _ := container["image"].(string)
+				if _, ok := expectedImages[image]; !ok {
+					return fmt.Errorf("GitOps workload image is outside the frozen digest set")
+				}
+				expectedImages[image] = true
+			}
+		}
+	}
+	for _, used := range expectedImages {
+		if !used {
+			return fmt.Errorf("GitOps image override is not used by a workload")
+		}
+	}
+	return nil
+}
+
+// CheckArgoResourceOwners refuses implicit adoption, including unlabelled live
+// objects. It is read-only and runs again immediately before controller sync.
+func CheckArgoResourceOwners(ctx context.Context, client dynamic.Interface, application *unstructured.Unstructured, resources []*unstructured.Unstructured) error {
+	if err := ValidateArgoResources(application, resources); err != nil {
+		return err
+	}
+	for _, resource := range resources {
+		gvk := resource.GroupVersionKind()
+		gvr := argoResourceTypes[gvk.Group+"/"+gvk.Kind]
+		live, err := client.Resource(gvr).Namespace(resource.GetNamespace()).Get(ctx, resource.GetName(), metav1.GetOptions{})
+		if apierrors.IsNotFound(err) {
+			continue
+		}
+		if err != nil {
+			return err
+		}
+		if live.GetUID() == "" || live.GetDeletionTimestamp() != nil || !argoTracksResource(application, live) || metav1.GetControllerOf(live) != nil {
+			return fmt.Errorf("GitOps child %s/%s belongs to another writer or is being deleted", resource.GetKind(), resource.GetName())
+		}
+		labels, annotations := live.GetLabels(), live.GetAnnotations()
+		if labels["app.kubernetes.io/managed-by"] == "Helm" || annotations["meta.helm.sh/release-name"] != "" || labels["kustomize.toolkit.fluxcd.io/name"] != "" || labels["helm.toolkit.fluxcd.io/name"] != "" {
+			return fmt.Errorf("GitOps child has another delivery owner")
+		}
+		for _, field := range live.GetManagedFields() {
+			if strings.HasPrefix(field.Manager, "opensoha-") || field.Manager == "helm" || field.Manager == "kustomize-controller" || field.Manager == "helm-controller" {
+				return fmt.Errorf("GitOps child has fields owned by another delivery writer")
+			}
+		}
+	}
+	return nil
+}
+
+func argoTracksResource(application, resource *unstructured.Unstructured) bool {
+	gvk := resource.GroupVersionKind()
+	suffix := ":" + gvk.Group + "/" + gvk.Kind + ":" + resource.GetNamespace() + "/" + resource.GetName()
+	tracking := resource.GetAnnotations()["argocd.argoproj.io/tracking-id"]
+	return tracking == application.GetName()+suffix || tracking == application.GetNamespace()+"_"+application.GetName()+suffix
+}

package/resource/runtime/argocd_resources_test.go

@@ -0,0 +1,107 @@
+package runtime
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/dynamic/fake"
+)
+
+func TestArgoFrozenResourcesRejectUnsafeWrites(t *testing.T) {
+	for _, mode := range []string{"valid", "outside", "duplicate", "hook", "image", "init image", "external", "status", "missing image"} {
+		t.Run(mode, func(t *testing.T) {
+			app, live := argoFixture(t)
+			desired := live.DeepCopy()
+			desired.SetUID("")
+			desired.SetAnnotations(nil)
+			desired.SetGeneration(0)
+			delete(desired.Object, "status")
+			resources := []*unstructured.Unstructured{desired}
+			switch mode {
+			case "outside":
+				desired.SetNamespace("other")
+			case "duplicate":
+				resources = append(resources, desired.DeepCopy())
+			case "hook":
+				desired.SetAnnotations(map[string]string{"argocd.argoproj.io/hook": "PreSync"})
+			case "image":
+				_ = unstructured.SetNestedSlice(desired.Object, []any{map[string]any{"name": "app", "image": "mutable:latest"}}, "spec", "template", "spec", "containers")
+			case "init image":
+				_ = unstructured.SetNestedSlice(desired.Object, []any{map[string]any{"name": "init", "image": "mutable:latest"}}, "spec", "template", "spec", "initContainers")
+			case "external":
+				desired.SetLabels(map[string]string{"app.kubernetes.io/managed-by": "Helm"})
+			case "status":
+				desired.Object["status"] = map[string]any{"observedGeneration": int64(1)}
+			case "missing image":
+				unstructured.RemoveNestedField(desired.Object, "spec", "template", "spec", "containers")
+			}
+			if err := ValidateArgoResources(app, resources); (err == nil) != (mode == "valid") {
+				t.Fatalf("%s: %v", mode, err)
+			}
+		})
+	}
+}
+
+func TestArgoResourceOwnerCheckIsReadOnlyAndRejectsAdoption(t *testing.T) {
+	for _, mode := range []string{"owned", "absent", "unowned", "other app", "direct", "helm"} {
+		t.Run(mode, func(t *testing.T) {
+			app, live := argoFixture(t)
+			desired := live.DeepCopy()
+			desired.SetUID("")
+			desired.SetAnnotations(nil)
+			desired.SetGeneration(0)
+			delete(desired.Object, "status")
+			switch mode {
+			case "unowned":
+				live.SetAnnotations(nil)
+			case "other app":
+				live.SetAnnotations(map[string]string{"argocd.argoproj.io/tracking-id": "other:apps/Deployment:demo/web"})
+			case "direct":
+				live.SetManagedFields([]metav1.ManagedFieldsEntry{{Manager: "opensoha-manifest/other"}})
+			case "helm":
+				live.SetLabels(map[string]string{"app.kubernetes.io/managed-by": "Helm"})
+			}
+			objects := []runtime.Object{live}
+			if mode == "absent" {
+				objects = nil
+			}
+			client := fake.NewSimpleDynamicClient(runtime.NewScheme(), objects...)
+			err := CheckArgoResourceOwners(t.Context(), client, app, []*unstructured.Unstructured{desired})
+			if (err == nil) != (mode == "owned" || mode == "absent") {
+				t.Fatalf("%s: %v", mode, err)
+			}
+			for _, action := range client.Actions() {
+				if action.GetVerb() != "get" {
+					t.Fatal("ownership check mutated a resource")
+				}
+			}
+		})
+	}
+}
+
+func TestArgoApplicationRejectsDirectWriters(t *testing.T) {
+	app, _ := argoFixture(t)
+	for _, action := range []string{"apply", "update", "delete"} {
+		client := fake.NewSimpleDynamicClient(runtime.NewScheme(), app.DeepCopy())
+		resource := client.Resource(argoApplications).Namespace(app.GetNamespace())
+		var err error
+		switch action {
+		case "apply":
+			_, err = ApplyManifest(t.Context(), resource, argoDesiredFixture(app), metav1.PatchOptions{FieldManager: "direct"})
+		case "update":
+			_, err = UpdateManifest(t.Context(), resource, app.DeepCopy())
+		case "delete":
+			err = DeleteManifest(t.Context(), resource, app.GetName(), string(app.GetUID()))
+		}
+		if err == nil {
+			t.Fatalf("direct %s accepted GitOps root", action)
+		}
+		for _, call := range client.Actions() {
+			if call.GetVerb() != "get" {
+				t.Fatal("direct writer mutated GitOps root")
+			}
+		}
+	}
+}