openshiftargocd

How to exclude the configMap content from sync

The reference framework is Openshift/ArgoCD. I have an application defined in ArgoCD that, among other resources, contains a configMap that serves for certificate injection into the namespace:

apiVersion: v1
data: {}
kind: ConfigMap
metadata:
  labels:
    config.openshift.io/inject-trusted-cabundle: "true"
  name: ca-inject 
  namespace: apache

The data field is empty, for the label config.openshift.io/inject-trusted-cabundle: "true" guarantees that the such field is automatically populated with a predefined set of certificates when the ConfigMap is loaded:

$ oc get ca-inject -o yaml

apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    config.openshift.io/inject-trusted-cabundle: "true"
  name: ca-inject 
  namespace: apache
data: 
  ca-bundle.crt: "-----BEGIN CERTIFICATE-----\n etc."

(reference: OpenShift manual)

However, this behaviour prevents the ConfigMap to ever appear as "in sync" in ArgoCD because the diff between the actual and the desired manifest is always showing the content of the CA bundle: enter image description here

I have tried to exclude the field using ignoreDifferences in the Application spec with no success:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: test-app-cm
  namespace: openshift-gitops
spec:
  destination:
    namespace: test-app-cm
    server: [redacted]
  ignoreDifferences:
  - group: core
    kind: ConfigMap
    managedFieldsManagers:
    - ca-bundle.crt
  project: test-app-cm
  source:
    path: .
    repoURL: [redacted]
    targetRevision: main
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=false
    - Prune=true
    - RespectIgnoreDifferences=true
Solution

  • I had done almost everything correctly but I missed some little details:

    Here is the correct Application configuration:

    apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: test-app-cm
  namespace: openshift-gitops
spec:
  destination:
    namespace: test-app-cm
    server: [redacted]
  ignoreDifferences:
  - group: "*"
    kind: ConfigMap
    jsonPointers:
      - /data
    name: ca-inject
  project: test-app-cm
  source:
    path: .
    repoURL: [redacted]
    targetRevision: main
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=false
    - Prune=true
    - RespectIgnoreDifferences=true