fix: Remove default BeforeHookCreation hook deletion policy

[cx-shmuel-felman]

Summary

This PR removes the default deletion policy for resources with hook annotations. Resources with hook annotations should not be automatically deleted when only the hook phase annotation is specified.

Motivation

Previously, resources with hook annotations would be automatically deleted due to two different mechanisms:

1. Resources with sync hook annotations (PreSync, PostSync, Sync, SyncFail) had an automatic BeforeHookCreation deletion policy applied in the gitops-engine
2. Resources with delete hook annotations (PreDelete, PostDelete) were automatically deleted during the cleanup phase in the controller

This was unexpected behavior because:

• The hook annotation primarily controls when resources are synced (timing/phase), not their lifecycle
• Automatic deletion should be explicit, not default
• It caused confusion and loss of state for resources with hook annotations
• Users expected these resources to persist unless explicitly configured otherwise

Changes

1. gitops-engine/pkg/sync/hook/delete_policy.go

Removed the automatic assignment of BeforeHookCreation deletion policy when no policy is specified:

Before:

if len(policies) == 0 {
    policies = append(policies, common.HookDeletePolicyBeforeHookCreation)
}

After:

// No default deletion policy - hook resources should only be deleted when explicitly configured
return policies

2. controller/hook.go

Removed the auto-deletion logic in the cleanupHooks function for resources with PreDelete/PostDelete hook annotations:

Before:

if len(deletePolicies) == 0 {
    // If no delete policy is specified, always delete hooks during cleanup phase
    shouldDelete = true
}

After:

// Only delete hook resources if they have an explicit deletion policy that matches the current state
for _, policy := range deletePolicies {
    if (policy == common.HookDeletePolicyHookFailed && aggregatedHealth == health.HealthStatusDegraded) ||
        (policy == common.HookDeletePolicyHookSucceeded && aggregatedHealth == health.HealthStatusHealthy) {
        shouldDelete = true
        break
    }
}

3. Updated Tests and Documentation

• Updated unit tests in gitops-engine/pkg/sync/hook/delete_policy_test.go
• Updated documentation in gitops-engine/pkg/sync/doc.go to clarify that resources with hook annotations are NOT deleted by default

Behavior Changes

Before this PR:

apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    argocd.argoproj.io/hook: PreSync

☠️ This Job resource would be automatically deleted and recreated on every sync

After this PR:

apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    argocd.argoproj.io/hook: PreSync

✅ This Job resource will persist across syncs

To get the old auto-delete behavior:

apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation  # Explicit deletion policy

Testing

• ✅ All unit tests in gitops-engine/pkg/sync/hook pass
• ✅ All unit tests in gitops-engine/pkg/sync pass
• ✅ All controller tests pass
• ✅ No linter errors

Migration Guide

For users who relied on the old default behavior and want resources with hook annotations to be deleted before recreation, add an explicit deletion policy:

apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation  # Add this

Available deletion policies:

• BeforeHookCreation - Delete the resource before creating it (old default behavior)
• HookSucceeded - Delete the resource after it succeeds
• HookFailed - Delete the resource after it fails

Impact

This is a behavior change that makes ArgoCD more intuitive:

• Resources with hook annotations are treated like any other resource - they persist by default
• Deletion must be explicitly configured via the hook-delete-policy annotation
• Aligns with user expectations
• Reduces surprise and confusion

Related Issues

Fixes #25956

Checklist

• Code changes made
• Tests updated
• Documentation updated
• All tests passing
• No linter errors
• Commits signed-off (DCO)

[bunnyshell]

✅ Preview Environment deployed on Bunnyshell

Component	Endpoints
argocd	https://argocd-aaehlm.bunnyenv.com/
argocd-ttyd	https://argocd-web-cli-aaehlm.bunnyenv.com/

See: Environment Details | Pipeline Logs

Available commands (reply to this comment):

• 🔴 /bns:stop to stop the environment
• 🚀 /bns:deploy to redeploy the environment
• ❌ /bns:delete to remove the environment