Manage AppSets on Akuity Platform (AKP) for configuring finalizer

When managing ApplicationSet resources on the Akuity Platform (AKP), you might notice that setting the resources-finalizer.argocd.argoproj.io finalizer doesn't prevent deletion of generated Applications as it does in open source Argo CD (OSS).

This explains why this happens and how to fix it.

Problem Statement

You have a valid ApplicationSet like the following:

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: kube-prometheus-stack
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  syncPolicy:
    applicationsSync: create-update
  goTemplate: true
  generators:
    - list:
        elements:
          - name: foo
  template:
    metadata:
      name: '-kube-prometheus-stack'
    spec:
      project: default
      sources:
        - chart: kube-prometheus-stack
          repoURL: https://prometheus-community.github.io/helm-charts
          targetRevision: 58.4.0
          helm:
            releaseName: kube-prometheus-stack
            valuesObject: {}
      destination:
        namespace: monitoring
        name: ''
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
          - CreateNamespace=true
          - ServerSideApply=true

In OSS Argo CD, the finalizer prevents the generated Application from being deleted if the ApplicationSet is removed. But on AKP, this safeguard doesn't work by default.

Root Cause

On the Akuity Platform:

• A default syncPolicy is enforced at the platform level.

• The Allow Override flag is set to false by default.

This means that even though you've defined a finalizer in your ApplicationSet, AKP does not allow the generated Applications to inherit or respect this setting—unless explicitly permitted.

Solution

To make the resources-finalizer.argocd.argoproj.io work as expected:

1. Go to the Akuity UI.

2. Navigate to your ApplicationSet settings.

3. Enable the "Allow Override" option.

4. Save and redeploy the ApplicationSet.

This will allow the AppSet template's sync policy and metadata (including finalizers) to override the platform defaults.

This behavior is a safeguard in Akuity to enforce platform-level policies, but it can interfere with advanced use cases like custom finalizers. Enabling Allow Override on a per-ApplicationSet basis restores expected behavior from OSS Argo CD.

Note: It has been fixed in the most recent release of Akuity Platform. By default the global sync policy is empty which allows application overrides by default(1:1 w/ OSS).

Reference:

• https://docs.akuity.io/argo-cd/settings/features/declarative-management#allow-override