From 3f350daa254e3110846e97d1b68da2a4e9e2fafc Mon Sep 17 00:00:00 2001
From: sfasching <spence@thefaschings.org>
Date: Sun, 14 Jun 2026 21:41:16 -0500
Subject: [PATCH] feat: add opt-in gitops mode for deterministic rendering
 (plane-enterprise + plane-ce)

Adds a gitops.enabled flag (default false) to both charts. When false they render
byte-for-byte as today. When true, the per-render timestamp pod annotation is
omitted and migration Job names are keyed to planeVersion (instead of a wall-clock
timestamp in plane-enterprise / .Release.Revision in plane-ce), so Argo CD/Flux get
a deterministic render: no perpetual drift and no immutable-Job patch errors.

Relates to #158, #206, #207.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 charts/plane-ce/templates/workloads/admin.deployment.yaml | 2 ++
 charts/plane-ce/templates/workloads/api.deployment.yaml   | 2 ++
 .../templates/workloads/beat-worker.deployment.yaml       | 2 ++
 charts/plane-ce/templates/workloads/live.deployment.yaml  | 2 ++
 charts/plane-ce/templates/workloads/migrator.job.yaml     | 4 +++-
 charts/plane-ce/templates/workloads/minio.stateful.yaml   | 2 +-
 charts/plane-ce/templates/workloads/space.deployment.yaml | 2 ++
 charts/plane-ce/templates/workloads/web.deployment.yaml   | 2 ++
 .../plane-ce/templates/workloads/worker.deployment.yaml   | 2 ++
 charts/plane-ce/values.yaml                               | 8 ++++++++
 .../templates/workloads/admin.deployment.yaml             | 2 ++
 .../templates/workloads/api.deployment.yaml               | 2 ++
 .../workloads/automation-consumer.deployment.yaml         | 2 ++
 .../templates/workloads/beat-worker.deployment.yaml       | 2 ++
 .../templates/workloads/email.deployment.yaml             | 2 ++
 .../templates/workloads/iframely.deployment.yaml          | 2 ++
 .../templates/workloads/live.deployment.yaml              | 2 ++
 .../templates/workloads/migrator.job.yaml                 | 4 +++-
 .../templates/workloads/minio.stateful.yaml               | 2 +-
 .../templates/workloads/monitor.stateful.yaml             | 2 ++
 .../templates/workloads/outbox-poller.deployment.yaml     | 2 ++
 .../templates/workloads/pi-api.deployment.yaml            | 2 ++
 .../templates/workloads/pi-beat.deployment.yaml           | 2 ++
 .../templates/workloads/pi-migrator.job.yaml              | 4 +++-
 .../templates/workloads/pi-worker.deployment.yaml         | 2 ++
 .../templates/workloads/runner.deployment.yaml            | 2 ++
 .../templates/workloads/silo.deployment.yaml              | 2 ++
 .../templates/workloads/space.deployment.yaml             | 2 ++
 .../templates/workloads/web.deployment.yaml               | 2 ++
 .../templates/workloads/worker.deployment.yaml            | 2 ++
 charts/plane-enterprise/values.yaml                       | 8 ++++++++
 31 files changed, 75 insertions(+), 5 deletions(-)

diff --git a/charts/plane-ce/templates/workloads/admin.deployment.yaml b/charts/plane-ce/templates/workloads/admin.deployment.yaml
index 93711c9a..fe575be0 100644
--- a/charts/plane-ce/templates/workloads/admin.deployment.yaml
+++ b/charts/plane-ce/templates/workloads/admin.deployment.yaml
@@ -39,7 +39,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-admin
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       containers:
       - name: {{ .Release.Name }}-admin
diff --git a/charts/plane-ce/templates/workloads/api.deployment.yaml b/charts/plane-ce/templates/workloads/api.deployment.yaml
index 0daf2279..c6b4218b 100644
--- a/charts/plane-ce/templates/workloads/api.deployment.yaml
+++ b/charts/plane-ce/templates/workloads/api.deployment.yaml
@@ -39,7 +39,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-api
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       containers:
       - name: {{ .Release.Name }}-api
diff --git a/charts/plane-ce/templates/workloads/beat-worker.deployment.yaml b/charts/plane-ce/templates/workloads/beat-worker.deployment.yaml
index 637bd667..fa45b899 100644
--- a/charts/plane-ce/templates/workloads/beat-worker.deployment.yaml
+++ b/charts/plane-ce/templates/workloads/beat-worker.deployment.yaml
@@ -16,7 +16,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-beat-worker
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       containers:
       - name: {{ .Release.Name }}-beat-worker
diff --git a/charts/plane-ce/templates/workloads/live.deployment.yaml b/charts/plane-ce/templates/workloads/live.deployment.yaml
index f6045e5e..4e640ab6 100644
--- a/charts/plane-ce/templates/workloads/live.deployment.yaml
+++ b/charts/plane-ce/templates/workloads/live.deployment.yaml
@@ -39,7 +39,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-live
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       containers:
       - name: {{ .Release.Name }}-live
diff --git a/charts/plane-ce/templates/workloads/migrator.job.yaml b/charts/plane-ce/templates/workloads/migrator.job.yaml
index c84530ab..dbdca55f 100644
--- a/charts/plane-ce/templates/workloads/migrator.job.yaml
+++ b/charts/plane-ce/templates/workloads/migrator.job.yaml
@@ -3,7 +3,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   namespace: {{ .Release.Namespace }}
-  name: {{ .Release.Name }}-api-migrate-{{ .Release.Revision }}
+  name: {{ .Release.Name }}-api-migrate-{{ if $.Values.gitops.enabled }}{{ .Values.planeVersion | replace "." "-" | replace "+" "-" | lower }}{{ else }}{{ .Release.Revision }}{{ end }}
   {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.api) }}
 spec:
   backoffLimit: 3
@@ -13,7 +13,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-api-migrate
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       containers:
       - name: {{ .Release.Name }}-api-migrate
diff --git a/charts/plane-ce/templates/workloads/minio.stateful.yaml b/charts/plane-ce/templates/workloads/minio.stateful.yaml
index ddf5e329..1d45b47a 100644
--- a/charts/plane-ce/templates/workloads/minio.stateful.yaml
+++ b/charts/plane-ce/templates/workloads/minio.stateful.yaml
@@ -87,7 +87,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   namespace: {{ .Release.Namespace }}
-  name: {{ .Release.Name }}-minio-bucket-{{ .Release.Revision }}
+  name: {{ .Release.Name }}-minio-bucket-{{ if $.Values.gitops.enabled }}{{ .Values.planeVersion | replace "." "-" | replace "+" "-" | lower }}{{ else }}{{ .Release.Revision }}{{ end }}
   {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.minio) }}
 spec:
   backoffLimit: 6
diff --git a/charts/plane-ce/templates/workloads/space.deployment.yaml b/charts/plane-ce/templates/workloads/space.deployment.yaml
index d2517322..40970564 100644
--- a/charts/plane-ce/templates/workloads/space.deployment.yaml
+++ b/charts/plane-ce/templates/workloads/space.deployment.yaml
@@ -39,7 +39,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-space
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       containers:
       - name: {{ .Release.Name }}-space
diff --git a/charts/plane-ce/templates/workloads/web.deployment.yaml b/charts/plane-ce/templates/workloads/web.deployment.yaml
index 5ebc2f31..cc30b36f 100644
--- a/charts/plane-ce/templates/workloads/web.deployment.yaml
+++ b/charts/plane-ce/templates/workloads/web.deployment.yaml
@@ -39,7 +39,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-web
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       containers:
       - name: {{ .Release.Name }}-web
diff --git a/charts/plane-ce/templates/workloads/worker.deployment.yaml b/charts/plane-ce/templates/workloads/worker.deployment.yaml
index e6a080d2..17f269f3 100644
--- a/charts/plane-ce/templates/workloads/worker.deployment.yaml
+++ b/charts/plane-ce/templates/workloads/worker.deployment.yaml
@@ -16,7 +16,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-worker
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       containers:
       - name: {{ .Release.Name }}-worker
diff --git a/charts/plane-ce/values.yaml b/charts/plane-ce/values.yaml
index e145f15e..5aaf950d 100644
--- a/charts/plane-ce/values.yaml
+++ b/charts/plane-ce/values.yaml
@@ -1,5 +1,13 @@
 planeVersion: v1.2.0
 
+# GitOps mode: render deterministically for declarative tools (Argo CD / Flux). When true,
+# the per-render `timestamp` rollout annotation is omitted and migration Job names are keyed
+# to `planeVersion` instead of `.Release.Revision`, so repeated renders of an unchanged
+# release are byte-identical (no perpetual drift, no immutable-Job patch errors). Default
+# false preserves the existing imperative `helm upgrade` behavior exactly.
+gitops:
+  enabled: false
+
 dockerRegistry:
   enabled: false
   host: "index.docker.io/v1/"
diff --git a/charts/plane-enterprise/templates/workloads/admin.deployment.yaml b/charts/plane-enterprise/templates/workloads/admin.deployment.yaml
index fdc8ab40..77b8cee7 100644
--- a/charts/plane-enterprise/templates/workloads/admin.deployment.yaml
+++ b/charts/plane-enterprise/templates/workloads/admin.deployment.yaml
@@ -40,7 +40,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-admin
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.admin }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/api.deployment.yaml b/charts/plane-enterprise/templates/workloads/api.deployment.yaml
index 2e140495..a66ab4d1 100644
--- a/charts/plane-enterprise/templates/workloads/api.deployment.yaml
+++ b/charts/plane-enterprise/templates/workloads/api.deployment.yaml
@@ -40,7 +40,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-api
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.api }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/automation-consumer.deployment.yaml b/charts/plane-enterprise/templates/workloads/automation-consumer.deployment.yaml
index e7b1213b..a4c53870 100644
--- a/charts/plane-enterprise/templates/workloads/automation-consumer.deployment.yaml
+++ b/charts/plane-enterprise/templates/workloads/automation-consumer.deployment.yaml
@@ -17,7 +17,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-automation-consumer
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.automation_consumer }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/beat-worker.deployment.yaml b/charts/plane-enterprise/templates/workloads/beat-worker.deployment.yaml
index 81bc8c9b..365b5a5b 100644
--- a/charts/plane-enterprise/templates/workloads/beat-worker.deployment.yaml
+++ b/charts/plane-enterprise/templates/workloads/beat-worker.deployment.yaml
@@ -16,7 +16,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-beat-worker
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.beatworker }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/email.deployment.yaml b/charts/plane-enterprise/templates/workloads/email.deployment.yaml
index eaaab8ff..eab9cf4f 100644
--- a/charts/plane-enterprise/templates/workloads/email.deployment.yaml
+++ b/charts/plane-enterprise/templates/workloads/email.deployment.yaml
@@ -47,7 +47,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-email-app
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:  
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.email_service }}
       containers:
diff --git a/charts/plane-enterprise/templates/workloads/iframely.deployment.yaml b/charts/plane-enterprise/templates/workloads/iframely.deployment.yaml
index 190a47bc..d8f0ed68 100644
--- a/charts/plane-enterprise/templates/workloads/iframely.deployment.yaml
+++ b/charts/plane-enterprise/templates/workloads/iframely.deployment.yaml
@@ -37,7 +37,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-iframely
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.iframely }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/live.deployment.yaml b/charts/plane-enterprise/templates/workloads/live.deployment.yaml
index 573bb4d0..57025f1d 100644
--- a/charts/plane-enterprise/templates/workloads/live.deployment.yaml
+++ b/charts/plane-enterprise/templates/workloads/live.deployment.yaml
@@ -40,7 +40,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-live
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.live }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/migrator.job.yaml b/charts/plane-enterprise/templates/workloads/migrator.job.yaml
index fda7526b..3adcb9ab 100644
--- a/charts/plane-enterprise/templates/workloads/migrator.job.yaml
+++ b/charts/plane-enterprise/templates/workloads/migrator.job.yaml
@@ -3,7 +3,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   namespace: {{ .Release.Namespace }}
-  name: {{ .Release.Name }}-api-migrate-{{ now | date "20060102-150405" }}
+  name: {{ .Release.Name }}-api-migrate-{{ if $.Values.gitops.enabled }}{{ .Values.planeVersion | replace "." "-" | replace "+" "-" | lower }}{{ else }}{{ now | date "20060102-150405" }}{{ end }}
   {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.services.api) }}
 spec:
   backoffLimit: 3
@@ -13,7 +13,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-api-migrate
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.api }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/minio.stateful.yaml b/charts/plane-enterprise/templates/workloads/minio.stateful.yaml
index 09a8c38b..093ccf74 100644
--- a/charts/plane-enterprise/templates/workloads/minio.stateful.yaml
+++ b/charts/plane-enterprise/templates/workloads/minio.stateful.yaml
@@ -87,7 +87,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   namespace: {{ .Release.Namespace }}
-  name: {{ .Release.Name }}-minio-bucket-{{ now | date "20060102-150405" }}
+  name: {{ .Release.Name }}-minio-bucket-{{ if $.Values.gitops.enabled }}{{ .Values.planeVersion | replace "." "-" | replace "+" "-" | lower }}{{ else }}{{ now | date "20060102-150405" }}{{ end }}
   {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.services.minio) }}
 spec:
   backoffLimit: 6
diff --git a/charts/plane-enterprise/templates/workloads/monitor.stateful.yaml b/charts/plane-enterprise/templates/workloads/monitor.stateful.yaml
index 83194f91..476529b8 100644
--- a/charts/plane-enterprise/templates/workloads/monitor.stateful.yaml
+++ b/charts/plane-enterprise/templates/workloads/monitor.stateful.yaml
@@ -37,7 +37,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-monitor
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.monitor }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/outbox-poller.deployment.yaml b/charts/plane-enterprise/templates/workloads/outbox-poller.deployment.yaml
index 9993affb..9b85374b 100644
--- a/charts/plane-enterprise/templates/workloads/outbox-poller.deployment.yaml
+++ b/charts/plane-enterprise/templates/workloads/outbox-poller.deployment.yaml
@@ -17,7 +17,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-outbox-poller
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.outbox_poller }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/pi-api.deployment.yaml b/charts/plane-enterprise/templates/workloads/pi-api.deployment.yaml
index 1db32716..69b24f5d 100644
--- a/charts/plane-enterprise/templates/workloads/pi-api.deployment.yaml
+++ b/charts/plane-enterprise/templates/workloads/pi-api.deployment.yaml
@@ -41,7 +41,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-pi-api
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.pi }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/pi-beat.deployment.yaml b/charts/plane-enterprise/templates/workloads/pi-beat.deployment.yaml
index d91b6f88..ea17dd87 100644
--- a/charts/plane-enterprise/templates/workloads/pi-beat.deployment.yaml
+++ b/charts/plane-enterprise/templates/workloads/pi-beat.deployment.yaml
@@ -17,7 +17,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-pi-beat
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.pi_beat_worker }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/pi-migrator.job.yaml b/charts/plane-enterprise/templates/workloads/pi-migrator.job.yaml
index 56bb2423..74d75481 100644
--- a/charts/plane-enterprise/templates/workloads/pi-migrator.job.yaml
+++ b/charts/plane-enterprise/templates/workloads/pi-migrator.job.yaml
@@ -4,7 +4,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   namespace: {{ .Release.Namespace }}
-  name: {{ .Release.Name }}-pi-api-migrate-{{ now | date "20060102-150405" }}
+  name: {{ .Release.Name }}-pi-api-migrate-{{ if $.Values.gitops.enabled }}{{ .Values.planeVersion | replace "." "-" | replace "+" "-" | lower }}{{ else }}{{ now | date "20060102-150405" }}{{ end }}
   labels:
     {{- include "plane.commonLabels" $ | nindent 4 }}
 spec:
@@ -15,7 +15,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-pi-api-migrate
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.pi }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/pi-worker.deployment.yaml b/charts/plane-enterprise/templates/workloads/pi-worker.deployment.yaml
index abe1a6d5..cf341e39 100644
--- a/charts/plane-enterprise/templates/workloads/pi-worker.deployment.yaml
+++ b/charts/plane-enterprise/templates/workloads/pi-worker.deployment.yaml
@@ -17,7 +17,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-pi-worker
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.pi_worker }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/runner.deployment.yaml b/charts/plane-enterprise/templates/workloads/runner.deployment.yaml
index 10922285..60b9f8b5 100644
--- a/charts/plane-enterprise/templates/workloads/runner.deployment.yaml
+++ b/charts/plane-enterprise/templates/workloads/runner.deployment.yaml
@@ -41,7 +41,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-runner
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.runner }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/silo.deployment.yaml b/charts/plane-enterprise/templates/workloads/silo.deployment.yaml
index 32ec41ff..6932381d 100644
--- a/charts/plane-enterprise/templates/workloads/silo.deployment.yaml
+++ b/charts/plane-enterprise/templates/workloads/silo.deployment.yaml
@@ -41,7 +41,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-silo
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.silo }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/space.deployment.yaml b/charts/plane-enterprise/templates/workloads/space.deployment.yaml
index 91b4f217..b4a42c57 100644
--- a/charts/plane-enterprise/templates/workloads/space.deployment.yaml
+++ b/charts/plane-enterprise/templates/workloads/space.deployment.yaml
@@ -40,7 +40,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-space
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.space }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/web.deployment.yaml b/charts/plane-enterprise/templates/workloads/web.deployment.yaml
index 2160be98..bf216809 100644
--- a/charts/plane-enterprise/templates/workloads/web.deployment.yaml
+++ b/charts/plane-enterprise/templates/workloads/web.deployment.yaml
@@ -40,7 +40,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-web
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.web }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/templates/workloads/worker.deployment.yaml b/charts/plane-enterprise/templates/workloads/worker.deployment.yaml
index cff2882c..b723eec1 100644
--- a/charts/plane-enterprise/templates/workloads/worker.deployment.yaml
+++ b/charts/plane-enterprise/templates/workloads/worker.deployment.yaml
@@ -16,7 +16,9 @@ spec:
         app.name: {{ .Release.Namespace }}-{{ .Release.Name }}-worker
         {{- include "plane.commonLabels" $ | nindent 8 }}
       annotations:
+        {{- if not $.Values.gitops.enabled }}
         timestamp: {{ now | quote }}
+        {{- end }}
     spec:
       {{- include "plane.podScheduling" .Values.services.worker }}
       {{- include "plane.podSecurityContext" . }}
diff --git a/charts/plane-enterprise/values.yaml b/charts/plane-enterprise/values.yaml
index c110e41e..4d07c0ae 100644
--- a/charts/plane-enterprise/values.yaml
+++ b/charts/plane-enterprise/values.yaml
@@ -1,5 +1,13 @@
 planeVersion: v2.6.3
 
+# GitOps mode: render deterministically for declarative tools (Argo CD / Flux). When true,
+# the per-render `timestamp` rollout annotation is omitted and migration Job names are keyed
+# to `planeVersion` instead of a wall-clock timestamp, so repeated renders of an unchanged
+# release are byte-identical (no perpetual drift, no immutable-Job patch errors). Default
+# false preserves the existing imperative `helm upgrade` behavior exactly.
+gitops:
+  enabled: false
+
 dockerRegistry:
   enabled: false
   registry: 'index.docker.io/v1/'