Only respect controller refs for resources

pkg/cache/references.go

@@ -10,6 +10,8 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/types"
 
+	synccommon "github.com/argoproj/gitops-engine/pkg/sync/common"
+	syncresource "github.com/argoproj/gitops-engine/pkg/sync/resource"
 	"github.com/argoproj/gitops-engine/pkg/utils/kube"
 )
 
@@ -23,6 +25,16 @@ func (c *clusterCache) resolveResourceReferences(un *unstructured.Unstructured)
 	ownerRefs := un.GetOwnerReferences()
 	gvk := un.GroupVersionKind()
 
+	if syncresource.HasAnnotationOption(un, synccommon.AnnotationSyncOptions, synccommon.SyncOptionControllerReferencesOnly) {
+		controllerOwnerRefs := []metav1.OwnerReference{}
+		for _, ownerRef := range un.GetOwnerReferences() {
+			if ownerRef.Controller != nil && *ownerRef.Controller {
+				controllerOwnerRefs = append(controllerOwnerRefs, ownerRef)
+			}
+		}
+		return controllerOwnerRefs, isInferredParentOf
+	}
+
 	switch {
 
 	// Special case for endpoint. Remove after https://github.com/kubernetes/kubernetes/issues/28483 is fixed

pkg/sync/common/types.go

@@ -31,6 +31,8 @@ const (
 	SyncOptionServerSideApply = "ServerSideApply=true"
 	// Sync option that disables resource deletion
 	SyncOptionDisableDeletion = "Delete=false"
+	// Sync option that means only controller owner references are respected
+	SyncOptionControllerReferencesOnly = "ControllerReferencesOnly=true"
 )
 
 type PermissionValidator func(un *unstructured.Unstructured, res *metav1.APIResource) error