Prevent ArgoCD from pruning resources created by OKD

[yohancourbe]

I'm using ArgoCD to configure OKD OAuth. This is done by creating a resource config.openshift.io/v1/oauth inside the namespace openshift-config which seems to be picked up by some operator that will eventually create a secret named v4-0-config-user-idp-0-client-secret inside the openshift-authentication namespace. The problem is that this secret (that is not part of my manifest) shows up in my ArgoCD app as OutOfSync (requires pruning).

The only workaround I found was to declare an empty secret named v4-0-config-user-idp-0-client-secret in my manifest and set an ignoreDifferences in the app config (otherwise Argo will try to push the empty secret data), but it feels a bit dirty. Is there a better way to handle this ?

[jannfis]

Your best bet is to switch to another resource tracking method - with the annotation or annotation+label method, Argo CD will have some more metadata available to decide whether a resource is managed by it, or if the tracking annotation is a copycat of another resource.

[yohancourbe]

Thanks for pointing me to this direction, interesting read. I indeed can see that the secret created by the operator has the label app.kubernetes.io/instance which explains why Argo tracks it.

[bigstinky86]

It doesn't help. The operator copy all the metadata from original config maps it creates from. Annotations also copied and resource still tracked by argocd.