Detect drift when using kubectl edit and autosync is disabled

[akessner-github]

I work with people who are stuck in their ways. They refuse to stop using kubectl edit or lens to make changes. We also don't want resources to be autosynced. Instead they want to see the drift and if the drift is good, update git to match the change, or if they don't like the change, then sync with the current git data.

What are the combination of settings that we need so that we can ensure that argoCD uses the current state of the resources in the cluster when polling every 2-3 minutes to look for changes, and not just relying on the last modified timestamp?

We are using ArgoCD version 3.0.x

[MentalOfCrow]

You do not need auto-sync to detect this kind of drift. In Argo CD, comparison and synchronization are separate: with auto-sync disabled, a live edit should make the Application OutOfSync, but Argo CD should not revert it.

The minimal Application policy is therefore simply to leave automated sync disabled, for example:

spec:
  syncPolicy:
    automated:
      enabled: false

Do not enable selfHeal, since that is specifically the option that makes automated sync react to live-cluster drift. The official auto-sync documentation confirms that Applications without auto-sync are still compared and marked OutOfSync; the default reconciliation interval is 120s plus up to 60s jitter in current releases:

https://argo-cd.readthedocs.io/en/stable/user-guide/auto_sync/

A practical workflow is:

# Force a status comparison and show the result
argocd app get my-app --refresh
argocd app diff my-app

# If the live edit is rejected, restore Git's desired state manually
argocd app sync my-app

If the live edit is accepted, Argo CD does not provide a safe general-purpose "reverse sync to Git" operation. Export/diff the intended fields, update the manifest or Helm/Kustomize input in Git, and let the next comparison return to Synced. Avoid committing generated fields such as status, resourceVersion, uid, and managedFields from a raw kubectl get -o yaml.

If a kubectl edit is not producing OutOfSync, check these before changing polling settings:

1. argocd app diff my-app — does Argo see the changed field?
2. spec.ignoreDifferences, system-level resource customizations, and RespectIgnoreDifferences; an ignored field is intentionally omitted from the comparison.
3. Whether the edited object is actually tracked by this Application (argocd app resources my-app).
4. Application-controller logs/RBAC if Kubernetes watch events are not reaching the controller.
5. timeout.reconciliation in argocd-cm; setting it to 0 disables periodic reconciliation. The FAQ documents that behavior: https://argo-cd.readthedocs.io/en/stable/faq/

The important point is that a Kubernetes object's last-modified timestamp is not the desired-state source of truth. Argo compares the rendered Git manifests with the cached live Kubernetes resource. A normal field change should therefore be visible even when the Git revision did not change.

If this solves the issue, please mark it as the accepted answer so future readers can find the workflow easily.