feat: add opt-in gitops mode for deterministic rendering (plane-enterprise + plane-ce)

charts/plane-ce/templates/workloads/admin.deployment.yaml

@@ -37,7 +37,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-admin
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       containers:
       - name: {{ .Release.Name }}-admin

charts/plane-ce/templates/workloads/api.deployment.yaml

@@ -37,7 +37,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-api
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       containers:
       - name: {{ .Release.Name }}-api

charts/plane-ce/templates/workloads/beat-worker.deployment.yaml

@@ -15,7 +15,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-beat-worker
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       containers:
       - name: {{ .Release.Name }}-beat-worker

charts/plane-ce/templates/workloads/live.deployment.yaml

@@ -37,7 +37,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-live
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       containers:
       - name: {{ .Release.Name }}-live

charts/plane-ce/templates/workloads/migrator.job.yaml

@@ -3,7 +3,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   namespace: {{ .Release.Namespace }}
-  name: {{ .Release.Name }}-api-migrate-{{ .Release.Revision }}
+  name: {{ .Release.Name }}-api-migrate-{{ if $.Values.gitops.enabled }}{{ .Values.planeVersion | replace "." "-" | replace "+" "-" | lower }}{{ else }}{{ .Release.Revision }}{{ end }}
   {{- template "plane.labelsAndAnnotations" .Values.api }}
 spec:
   backoffLimit: 3
@@ -12,7 +12,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-api-migrate
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       containers:
       - name: {{ .Release.Name }}-api-migrate

charts/plane-ce/templates/workloads/minio.stateful.yaml

@@ -85,7 +85,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   namespace: {{ .Release.Namespace }}
-  name: {{ .Release.Name }}-minio-bucket-{{ .Release.Revision }}
+  name: {{ .Release.Name }}-minio-bucket-{{ if $.Values.gitops.enabled }}{{ .Values.planeVersion | replace "." "-" | replace "+" "-" | lower }}{{ else }}{{ .Release.Revision }}{{ end }}
   {{- template "plane.labelsAndAnnotations" .Values.minio }}
 spec:
   backoffLimit: 6

charts/plane-ce/templates/workloads/space.deployment.yaml

@@ -37,7 +37,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-space
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       containers:
       - name: {{ .Release.Name }}-space

charts/plane-ce/templates/workloads/web.deployment.yaml

@@ -37,7 +37,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-web
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       containers:
       - name: {{ .Release.Name }}-web

charts/plane-ce/templates/workloads/worker.deployment.yaml

@@ -15,7 +15,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-worker
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       containers:
       - name: {{ .Release.Name }}-worker

charts/plane-ce/values.yaml

@@ -1,5 +1,13 @@
 planeVersion: v1.2.0
 
+# GitOps mode: render deterministically for declarative tools (Argo CD / Flux). When true,
+# the per-render `timestamp` rollout annotation is omitted and migration Job names are keyed
+# to `planeVersion` instead of `.Release.Revision`, so repeated renders of an unchanged
+# release are byte-identical (no perpetual drift, no immutable-Job patch errors). Default
+# false preserves the existing imperative `helm upgrade` behavior exactly.
+gitops:
+  enabled: false
+
 dockerRegistry:
   enabled: false
   host: "index.docker.io/v1/"

charts/plane-enterprise/templates/workloads/admin.deployment.yaml

@@ -38,7 +38,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-admin
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.admin }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/api.deployment.yaml

@@ -38,7 +38,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-api
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.api }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/automation-consumer.deployment.yaml

@@ -16,7 +16,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-automation-consumer
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.automation_consumer }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/beat-worker.deployment.yaml

@@ -15,7 +15,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-beat-worker
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.beatworker }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/email.deployment.yaml

@@ -44,7 +44,9 @@ spec:
       labels:
        app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-email-app 
       annotations:  
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.email_service }}
       containers:

charts/plane-enterprise/templates/workloads/iframely.deployment.yaml

@@ -35,7 +35,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-iframely
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.iframely }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/live.deployment.yaml

@@ -38,7 +38,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-live
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.live }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/migrator.job.yaml

@@ -3,7 +3,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   namespace: {{ .Release.Namespace }}
-  name: {{ .Release.Name }}-api-migrate-{{ now | date "20060102-150405" }}
+  name: {{ .Release.Name }}-api-migrate-{{ if $.Values.gitops.enabled }}{{ .Values.planeVersion | replace "." "-" | replace "+" "-" | lower }}{{ else }}{{ now | date "20060102-150405" }}{{ end }}
   {{- include "plane.labelsAndAnnotations" .Values.services.api }}
 spec:
   backoffLimit: 3
@@ -12,7 +12,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-api-migrate
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.api }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/minio.stateful.yaml

@@ -85,7 +85,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   namespace: {{ .Release.Namespace }}
-  name: {{ .Release.Name }}-minio-bucket-{{ now | date "20060102-150405" }}
+  name: {{ .Release.Name }}-minio-bucket-{{ if $.Values.gitops.enabled }}{{ .Values.planeVersion | replace "." "-" | replace "+" "-" | lower }}{{ else }}{{ now | date "20060102-150405" }}{{ end }}
   {{- include "plane.labelsAndAnnotations" .Values.services.minio }}
 spec:
   backoffLimit: 6

charts/plane-enterprise/templates/workloads/monitor.stateful.yaml

@@ -35,7 +35,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-monitor
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.monitor }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/outbox-poller.deployment.yaml

@@ -16,7 +16,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-outbox-poller
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.outbox_poller }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/pi-api.deployment.yaml

@@ -39,7 +39,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-pi-api
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.pi }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/pi-beat.deployment.yaml

@@ -16,7 +16,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-pi-beat
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.pi_beat_worker }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/pi-migrator.job.yaml

@@ -4,15 +4,17 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   namespace: {{ .Release.Namespace }}
-  name: {{ .Release.Name }}-pi-api-migrate-{{ now | date "20060102-150405" }}
+  name: {{ .Release.Name }}-pi-api-migrate-{{ if $.Values.gitops.enabled }}{{ .Values.planeVersion | replace "." "-" | replace "+" "-" | lower }}{{ else }}{{ now | date "20060102-150405" }}{{ end }}
 spec:
   backoffLimit: 3
   template:
     metadata:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-pi-api-migrate
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.pi }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/pi-worker.deployment.yaml

@@ -16,7 +16,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-pi-worker
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.pi_worker }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/runner.deployment.yaml

@@ -39,7 +39,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-runner
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.runner }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/silo.deployment.yaml

@@ -39,7 +39,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-silo
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.silo }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/space.deployment.yaml

@@ -38,7 +38,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-space
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.space }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/web.deployment.yaml

@@ -38,7 +38,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-web
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.web }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/templates/workloads/worker.deployment.yaml

@@ -15,7 +15,9 @@ spec:
       labels:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-worker
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.worker }}
       {{- include "plane.podSecurityContext" . }}

charts/plane-enterprise/values.yaml

@@ -1,5 +1,13 @@
 planeVersion: v2.6.2
 
+# GitOps mode: render deterministically for declarative tools (Argo CD / Flux). When true,
+# the per-render `timestamp` rollout annotation is omitted and migration Job names are keyed
+# to `planeVersion` instead of a wall-clock timestamp, so repeated renders of an unchanged
+# release are byte-identical (no perpetual drift, no immutable-Job patch errors). Default
+# false preserves the existing imperative `helm upgrade` behavior exactly.
+gitops:
+  enabled: false
+
 dockerRegistry:
   enabled: false
   registry: 'index.docker.io/v1/'