<p>I am trying to configure <a href="https://github.com/bitnami-labs/sealed-secrets" rel="nofollow noreferrer">Bitnami SealedSecrets</a> with <a href="https://argoproj.github.io/cd/" rel="nofollow noreferrer">ArgoCD</a> and <a href="https://kubernetes.io/docs/tasks/manage-kubernetes-objects/kustomization/" rel="nofollow noreferrer">Kustomize</a>.</p>
<p>I have managed to encrypt the secrets using the kubeseal CLI, these are already deployed on the Kubernetes cluster as Sealed secrets and can be unsealed by the Sealed Secret Controller running on the cluster. The unsealed Secrets contain the expected values. I have defined the secrets using Kustomize Secret Generators - as described in this tutorial: <a href="https://faun.pub/sealing-secrets-with-kustomize-51d1b79105d8" rel="nofollow noreferrer">Sealing Secrets with Kustomize</a>. This is also working fine, since ArgoCD recognizes that there should be Secrets generated.</p>
<p>However, ArgoCD expects the secrets to be empty, as they are defined as empty in the Secret Generator part of my kustomization.yaml for the application:</p>
<pre class="lang-yaml prettyprint-override"><code>secretGenerator:
- name: secret1
  type: Opaque
- name: secret2
  type: Opaque
- name: secret3
  type: Opaque
... 

</code></pre>
<p>Since ArgoCD expects the secrets to be empty, they are detected to be &quot;out of sync&quot; after the Sealed Secrets Controller unseals and decrypts the secrets:</p>
<p><a href="https://i.stack.imgur.com/VO9kc.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/VO9kc.png" alt="SecretOutOfSync" /></a></p>
<p>Since ArgoCD thinks that the secrets should be empty, these are replaced by empty secrets. Then the Sealed Secrets Operator updates the Secrets once again and populates the data fields with the decrypted data - leading to an endless loop of ArgoCD synchronization.</p>
<p>The secrets are marked to be managed by Bitnami Sealed Secrets using the <code>sealedsecrets.bitnami.com/managed: &quot;true&quot;</code> annotation. So they are being updated by the Sealed Secrets controller.</p>
<p>How could I change the manifest to make sure that the unsealed secrets are recognized as &quot;in sync&quot; and ArgoCD doesn't keep on syncing beceause of the &quot;OutOfSync&quot; status of the unsealed secrets? (Which seems to be caused by the decrypted data in the unsealed secrets - as shown in the diff on the screenshot above.)</p>

<p>It is possible to ignore some differences.</p>
<p>This can be defined in the ArgoCD Application manifest:</p>
<pre><code>apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
...
spec:
  project: my-project
  ...
  syncPolicy:
    ...
    syncOptions:
    ...
    - RespectIgnoreDifferences=true
  ...
  ignoreDifferences:
  - kind: Secret
    jsonPointers:
    - /data
</code></pre>
<p>The <code>ignoreDifferences</code> specification tells ArgoCD to ignore the differences in the specified path. (In our case everything under <code>/data</code> for secrets).</p>
<p>It is also important to avoid applying the changes. This can be defined using the <code>RespectIgnoreDifferences</code> syncOption.</p>
<p>After adding the ignoreDifferences entry for the Secret kind and setting RespectIgnoreDifferences to true, the Sync Status of the application is shown as &quot;Synced&quot; and the endless loop of syncing has stopped.</p>
