Sync issue with argo-cd helm chart 7.4.x

[jascsch]

Checklist:

• [ x ] I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• [ x ] I've included steps to reproduce the bug.
• [ x ] I've pasted the output of argocd version.

Describe the bug

There is a sync issue with argocd version v2.12.1 so that apps are stuck in "OutOfSync" status.

To Reproduce

use the following manifest and try to sync the dapr app.

project: default
destination:
  server: 'https://kubernetes.default.svc'
  namespace: dapr
syncPolicy:
  syncOptions:
    - CreateNamespace=true
    - RespectIgnoreDifferences=true
ignoreDifferences:
  - kind: Secret
    name: dapr-trust-bundle
    namespace: dapr
    jsonPointers:
      - /data
sources:
  - repoURL: 'https://dapr.github.io/helm-charts/'
    targetRevision: 1.11.1
    helm:
      valueFiles:
        - $values/tools/dapr/values.yaml
      releaseName: dapr
      skipCrds: true
    chart: dapr
  - repoURL: 'https://git.xxx.com/org/gitops-cluster-dev.git'
    targetRevision: HEAD
    ref: values

Expected behavior

The sync status should be "Synced" instead of "OutOfSync"
The sync works perfectly fine with helm chart version 7.3.x

Screenshots

Version

argocd v2.12.1
helm chart argo-cd-7.4.4

Logs

no relevant application logs available.

[moksongmin]

I have a similar issue:

I use Crossplane to provision an AWS RDS Instance. I've added an 'identifier' parameter to two of my instances, and it can't be synced in ArgoCD (v7.4.1).

*Note: I haven't tested with previous 7.3.X version.

[grv180290]

Try using Ignore difference to get rid of this OutofSync status
https://argo-cd.readthedocs.io/en/stable/user-guide/diffing/#application-level-configuration

[jascsch]

I am already using Ignore difference like this:

ignoreDifferences:
  - kind: Secret
    name: dapr-trust-bundle
    namespace: dapr
    jsonPointers:
      - /data

What else do we have to do to get rid of this issue?

[moksongmin]

ignoreDifferences worked for me, as well.

[jascsch]

Hi @moksongmin can you please paste an example of your manifest with ignoreDifferences which worked in your case?

[moksongmin]

Hi @jascsch, sure, here it is:

[mkilchhofer]

As already analyzed in argo-helm (argoproj/argo-helm#2883), I think this is completely normal since your (EOL) Dapr helm chart is using the non-idempotent sprig function genSignedCert to generate the webhook TLS secrets:

• https://github.com/dapr/dapr/blob/v1.11.6/charts/dapr/charts/dapr_sidecar_injector/templates/dapr_sidecar_injector_webhook_config.yaml#L9

It seems that Dapr 1.12 does no longer use this (the webhook deployment iself now takes care of this - although I assume that you also need an Argo CD "ignoreDifferences" for this):

• [5756 Identity Management Overhaul] Injector & daprd  dapr/dapr#6761