An Argo CD Application is permanently OutOfSync on a Deployment that nobody has edited, and the diff shows a field written by another controller. How do you diagnose that, and what does spec.ignoreDifferences do about it?

## Why this happens at all Argo CD's sync status is a diff between the manifests it renders from the source and the objects that are live in the cluster. Kubernetes, however, is full of things that legitimately write to objects after you create them: mutating admission webhooks (service meshes injecting sidecars, policy engines adding annotations), the API server's own defaulting, and controllers such as the HorizontalPodAutoscaler that own a single field. Every one of those produces a live object that differs from what you committed, and Argo CD dutifully reports it. The symptom is characteristic: an app that is `OutOfSync` but perfectly `Healthy`, that goes `Synced` for a moment right after a sync and drifts straight back, and that nobody can point to a human cause for. ## Diagnose before you silence 1. `argocd app diff <app>` prints the field-level difference. In the UI, the same view is available per resource — be sure you are comparing against the **live** manifest, since the desired-manifest view will not show the mutation. 2. Identify the writer. `kubectl get <kind>/<name> -o yaml --show-managed-fields` shows `metadata.managedFields`, which names the field manager that owns each field — `kube-controller-manager`, an autoscaler, a webhook's manager name. This is the single most useful command here, because it turns "something changes it" into a name. 3. Decide whether the field belongs in your manifest at all. If an HPA owns `replicas`, the honest fix is to delete `replicas` from Git rather than to ignore it. Ignoring should be for fields you genuinely cannot own — an injected sidecar, a webhook-added CA bundle, a defaulted value you have no opinion about. ## Declaring the exception ```yaml spec: ignoreDifferences: - group: apps kind: Deployment name: checkout jsonPointers: - /spec/replicas - group: admissionregistration.k8s.io kind: ValidatingWebhookConfiguration jqPathExpressions: - .webhooks[]?.clientConfig.caBundle - group: apps kind: Deployment managedFieldsManagers: - kube-controller-manager ``` - **`jsonPointers`** — RFC 6901 pointers to exact paths. Simple and precise, but awkward for list elements whose index is not stable. - **`jqPathExpressions`** — jq-style expressions, which handle lists and conditionals; the right tool for "every webhook's caBundle". - **`managedFieldsManagers`** — ignore whatever the named server-side-apply field manager owns, without you enumerating the paths. Powerful when a webhook's exact mutations vary, and the closest thing to expressing intent ("that component owns whatever it owns"). The same exceptions can be declared cluster-wide in the `argocd-cm` ConfigMap under `resource.customizations.ignoreDifferences.<group_kind>`, which is how you handle a mutation that affects every app rather than one. ## The trap: ignoring is not yielding By default `ignoreDifferences` affects only the **diff**. The field stops making the app `OutOfSync`, but when a sync does run — for any reason — Argo CD still applies your manifest, including the value you said you were ignoring. With `selfHeal: true` and an HPA in the picture, that means the app stops *reporting* the fight while still *having* it: replicas get stomped on every sync. The fix is the sync option: ```yaml spec: syncPolicy: syncOptions: - RespectIgnoreDifferences=true ``` which makes the sync itself leave the ignored fields alone. Candidates who know only half of this pair usually learned it the hard way. ## Alternatives worth naming - **Remove the field from Git.** Always the first choice when another component is the rightful owner. - **`ServerSideApply=true`** as a sync option makes Argo CD apply with server-side apply and its own field manager, which cooperates with other field owners rather than overwriting the whole object, and also helps with large CRDs that blow the client-side-apply annotation size limit. - **A per-resource `argocd.argoproj.io/compare-options: IgnoreExtraneous`** annotation for objects that a controller generates and that should never count as drift. ## What a strong answer sounds like A weak candidate says "add ignoreDifferences". A strong one says: find who owns the field, prefer to stop owning it yourself, use `managedFieldsManagers` when the writer is a component rather than a path, and remember that ignoring the diff does not stop the sync from writing unless you add `RespectIgnoreDifferences=true`.