What are ArgoCD Sync Windows and how do you configure them?

ArgoCD Sync Windows are time-based rules that allow or deny automated sync operations during specific time periods. They give platform teams the ability to prevent ArgoCD from automatically deploying changes during critical periods (e.g., business hours for production, or during a maintenance freeze) or to restrict deployments to specific allowed windows (e.g., only during off-peak hours).

Sync Windows are configured at the AppProject level and apply to all Applications in that Project. Each window has four properties:

• kind: allow or deny — whether this window permits or blocks sync.
• schedule: a cron expression (e.g., 0 22 * * * for 10 PM daily).
• duration: how long the window lasts (e.g., 2h).
• applications / namespaces / clusters: optional filters to apply the window to specific targets.

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: production
  namespace: argocd
spec:
  syncWindows:
    - kind: deny
      schedule: "* * * * 1-5"   # deny all day Mon-Fri
      duration: 24h
      applications:
        - "*"
    - kind: allow
      schedule: "0 22 * * 5"    # allow Friday at 10 PM
      duration: 4h
      applications:
        - "*"

When a deny window is active, ArgoCD marks the Application as SyncWindowDenied and automated sync is blocked. Manual sync is also blocked unless the Application has the manualSync flag enabled in the window definition, which lets operators override in emergencies.