Allow any application modifications only during the sync window

[EugeneLugovtsov]

Summary

We use a deny sync window to be able to deploy applications to the prod environment only during the maintenance window. Everything works well, however, we found that the deny sync window does not block the delete operation. It turns out that it is possible to remove all apps from the prod environment accidentally. (we have already had a bug on the gitlab side + applicationset controller that removes everything from the prod env.)

Motivation

We can update/delete applications by mistake during deny sync window. That is why, I want to be sure that all application operations (sync, create, update, delete) will be performed only during allow sync window aka the maintenance window.

Proposal

Add the ability to set what application operations will be blocked during deny sync window. or just allow any application modifications only during allow sync window.

[crenshaw-dev]

I would add that override and maybe actions/* should be disable-able too.

How would you feel about a new field in the sync window description to list which actions should be blocked?

[crenshaw-dev]

Adding this as a potential Grace Hopper Celebration Open Source Day issue - but I'll note that this is a relatively challenging one. :-)