Fix ArgoCD ServerSideDiff permanent OutOfSync diffs

Add explicit CRD/API defaults to manifests that were causing ArgoCD's
SSA dry-run to produce results different from live state:

- HTTPRoutes: add group, kind, weight defaults to parentRefs/backendRefs
- Kyverno ClusterPolicies: add skipBackgroundRequests, allowExistingViolations
- Tetragon TracingPolicies: add return, maxData, resolve, returnCopy defaults
- Gateway certificateRefs: add group="" default
- Guacamole Gateway: add group="" to certificateRefs

Add ignoreDifferences for resources that legitimately differ:
- Cilium cert Secrets (auto-generated, data always differs)
- Istio ValidatingWebhookConfiguration failurePolicy (istiod mutates)
- Crowdsec LAPI Secrets (randomly generated)
- ServiceMonitor/PodMonitor relabeling action defaults
- StatefulSet volumeClaimTemplates apiVersion/kind defaults

Persist argocd-cm ignoreDifferences config in ArgoCD Helm values.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/argocd/manifests/envoy-route.yaml

@@ -5,7 +5,9 @@ metadata:
   namespace: argocd
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -16,5 +18,8 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: argocd-server
+        - group: ""
+          kind: Service
+          name: argocd-server
           port: 80
+          weight: 1

apps/argocd/values.yaml

@@ -6,6 +6,36 @@ global:
 configs:
   cm:
     url: https://argocd.kube.huskypup.net
+    resource.customizations.ignoreDifferences.all: |
+      managedFieldsManagers:
+        - external-secrets
+        - istio-system
+      jqPathExpressions:
+        - .metadata.finalizers
+    resource.customizations.ignoreDifferences.external-secrets.io_ExternalSecret: |
+      jqPathExpressions:
+        - .metadata.annotations."force-sync"
+        - .metadata.annotations."reconcile.external-secrets.io/force-sync"
+        - .metadata.finalizers
+        - .spec.data[].remoteRef.conversionStrategy
+        - .spec.data[].remoteRef.decodingStrategy
+        - .spec.data[].remoteRef.metadataPolicy
+    resource.customizations.ignoreDifferences.gateway.networking.k8s.io_HTTPRoute: |
+      jqPathExpressions:
+        - .metadata.annotations
+        - .spec.parentRefs[].port
+    resource.customizations.ignoreDifferences.monitoring.coreos.com_ServiceMonitor: |
+      jqPathExpressions:
+        - .spec.endpoints[].relabelings[].action
+        - .spec.endpoints[].metricRelabelings[].action
+    resource.customizations.ignoreDifferences.monitoring.coreos.com_PodMonitor: |
+      jqPathExpressions:
+        - .spec.podMetricsEndpoints[].relabelings[].action
+        - .spec.podMetricsEndpoints[].metricRelabelings[].action
+    resource.customizations.ignoreDifferences.apps_StatefulSet: |
+      jqPathExpressions:
+        - .spec.volumeClaimTemplates[].apiVersion
+        - .spec.volumeClaimTemplates[].kind
     oidc.config: |
       name: Authentik
       issuer: https://auth.kube.huskypup.net/application/o/argocd/

apps/frigate/manifests/envoy-route.yaml

@@ -5,7 +5,9 @@ metadata:
   namespace: frigate
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -16,5 +18,8 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: frigate
+        - group: ""
+          kind: Service
+          name: frigate
           port: 5000
+          weight: 1

apps/gitlab/manifests/envoy-routes.yaml

@@ -5,7 +5,9 @@ metadata:
   namespace: gitlab
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -16,8 +18,11 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: gitlab-webservice-default
+        - group: ""
+          kind: Service
+          name: gitlab-webservice-default
           port: 8181
+          weight: 1
 
 ---
 apiVersion: gateway.networking.k8s.io/v1
@@ -27,7 +32,9 @@ metadata:
   namespace: gitlab
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -38,8 +45,11 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: gitlab-registry
+        - group: ""
+          kind: Service
+          name: gitlab-registry
           port: 5000
+          weight: 1
 
 ---
 apiVersion: gateway.networking.k8s.io/v1
@@ -49,7 +59,9 @@ metadata:
   namespace: gitlab
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -60,8 +72,11 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: gitlab-minio-svc
+        - group: ""
+          kind: Service
+          name: gitlab-minio-svc
           port: 9000
+          weight: 1
 
 ---
 apiVersion: gateway.networking.k8s.io/v1
@@ -71,7 +86,9 @@ metadata:
   namespace: gitlab
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -82,5 +99,8 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: gitlab-kas
+        - group: ""
+          kind: Service
+          name: gitlab-kas
           port: 8154
+          weight: 1

apps/guacamole/manifests/envoy-gateway.yaml

@@ -27,7 +27,8 @@ spec:
       tls:
         mode: Terminate
         certificateRefs:
-          - kind: Secret
+          - group: ""
+            kind: Secret
             name: guacamole-envoy-tls
 
 ---
@@ -38,7 +39,9 @@ metadata:
   namespace: guacamole
 spec:
   parentRefs:
-    - name: guacamole
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: guacamole
       sectionName: https
   hostnames:
     - guacamole.kube.huskypup.net
@@ -55,13 +58,19 @@ spec:
               type: ReplacePrefixMatch
               replacePrefixMatch: /
       backendRefs:
-        - name: guacamole
+        - group: ""
+          kind: Service
+          name: guacamole
           port: 8080
+          weight: 1
     # Standard root routing
     - matches:
         - path:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: guacamole
+        - group: ""
+          kind: Service
+          name: guacamole
           port: 8080
+          weight: 1

apps/home-assistant/esphome/envoy-route.yaml

@@ -5,7 +5,9 @@ metadata:
   namespace: home-assistant
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -16,5 +18,8 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: esphome
+        - group: ""
+          kind: Service
+          name: esphome
           port: 6052
+          weight: 1

apps/home-assistant/manifests/envoy-route.yaml

@@ -5,7 +5,9 @@ metadata:
   namespace: home-assistant
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -16,5 +18,8 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: home-assistant
+        - group: ""
+          kind: Service
+          name: home-assistant
           port: 8123
+          weight: 1

apps/n8n/manifests/envoy-route.yaml

@@ -5,7 +5,9 @@ metadata:
   namespace: n8n
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -16,5 +18,8 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: n8n
+        - group: ""
+          kind: Service
+          name: n8n
           port: 80
+          weight: 1

apps/nextcloud/manifests/envoy-route.yaml

@@ -5,7 +5,9 @@ metadata:
   namespace: nextcloud
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -16,5 +18,8 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: nextcloud
+        - group: ""
+          kind: Service
+          name: nextcloud
           port: 8080
+          weight: 1

apps/teslamate/manifests/envoy-route.yaml

@@ -5,7 +5,9 @@ metadata:
   namespace: teslamate
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -16,5 +18,8 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: teslamate
+        - group: ""
+          kind: Service
+          name: teslamate
           port: 4000
+          weight: 1

argocd-apps/infrastructure/cilium.yaml

@@ -9,6 +9,26 @@ metadata:
     - resources-finalizer.argocd.argoproj.io
 spec:
   project: infrastructure
+  ignoreDifferences:
+    - group: ""
+      kind: Secret
+      name: cilium-ca
+      jsonPointers:
+        - /data
+    - group: ""
+      kind: Secret
+      name: hubble-relay-client-certs
+      jsonPointers:
+        - /data
+    - group: ""
+      kind: Secret
+      name: hubble-server-certs
+      jsonPointers:
+        - /data
+    - group: monitoring.coreos.com
+      kind: ServiceMonitor
+      jqPathExpressions:
+        - .spec.endpoints[].relabelings[].action
   sources:
     - repoURL: https://helm.cilium.io
       chart: cilium

argocd-apps/infrastructure/crowdsec.yaml

@@ -9,6 +9,12 @@ metadata:
     - resources-finalizer.argocd.argoproj.io
 spec:
   project: infrastructure
+  ignoreDifferences:
+    - group: ""
+      kind: Secret
+      name: crowdsec-lapi-secrets
+      jsonPointers:
+        - /data
   sources:
     - repoURL: https://crowdsecurity.github.io/helm-charts
       chart: crowdsec

argocd-apps/infrastructure/istio-base.yaml

@@ -9,6 +9,11 @@ metadata:
     - resources-finalizer.argocd.argoproj.io
 spec:
   project: infrastructure
+  ignoreDifferences:
+    - group: admissionregistration.k8s.io
+      kind: ValidatingWebhookConfiguration
+      jqPathExpressions:
+        - .webhooks[].failurePolicy
   source:
     repoURL: https://istio-release.storage.googleapis.com/charts
     chart: base

argocd-apps/infrastructure/istiod.yaml

@@ -9,6 +9,11 @@ metadata:
     - resources-finalizer.argocd.argoproj.io
 spec:
   project: infrastructure
+  ignoreDifferences:
+    - group: admissionregistration.k8s.io
+      kind: ValidatingWebhookConfiguration
+      jqPathExpressions:
+        - .webhooks[].failurePolicy
   sources:
     - repoURL: https://istio-release.storage.googleapis.com/charts
       chart: istiod

infrastructure/authentik/manifests/envoy-route.yaml

@@ -5,7 +5,9 @@ metadata:
   namespace: authentik
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -16,5 +18,8 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: authentik-server
+        - group: ""
+          kind: Service
+          name: authentik-server
           port: 80
+          weight: 1

infrastructure/envoy-gateway/manifests/edge.yaml

@@ -82,7 +82,8 @@ spec:
       tls:
         mode: Terminate
         certificateRefs:
-          - kind: Secret
+          - group: ""
+            kind: Secret
             name: edge-wildcard-kube-huskypup-net
       allowedRoutes:
         namespaces:

infrastructure/grafana/manifests/envoy-route.yaml

@@ -5,7 +5,9 @@ metadata:
   namespace: grafana
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -16,5 +18,8 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: grafana
+        - group: ""
+          kind: Service
+          name: grafana
           port: 80
+          weight: 1

infrastructure/kyverno/policies/disallow-automount-sa-token.yaml

@@ -16,6 +16,7 @@ spec:
   background: true
   rules:
     - name: validate-automount
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -60,6 +61,7 @@ spec:
                 - n8n
                 - nessus
       validate:
+        allowExistingViolations: true
         message: >-
           Pods should set automountServiceAccountToken to false unless API
           access is required (STIG V-242382).

infrastructure/kyverno/policies/disallow-default-namespace.yaml

@@ -14,6 +14,7 @@ spec:
   background: true
   rules:
     - name: validate-namespace
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -27,6 +28,7 @@ spec:
               namespaces:
                 - default
       validate:
+        allowExistingViolations: true
         message: >-
           Workloads must not run in the default namespace (STIG V-242383).
           Create a dedicated namespace for your application.

infrastructure/kyverno/policies/disallow-host-namespaces.yaml

@@ -15,6 +15,7 @@ spec:
   background: true
   rules:
     - name: host-namespaces
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -31,6 +32,7 @@ spec:
                 - kyverno
                 - crowdsec
       validate:
+        allowExistingViolations: true
         message: >-
           Sharing host PID, IPC, or network namespaces is not allowed (STIG V-242386).
         pattern:

infrastructure/kyverno/policies/disallow-latest-tag.yaml

@@ -11,6 +11,7 @@ spec:
   background: true
   rules:
     - name: disallow-latest
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -25,6 +26,7 @@ spec:
                 - crowdsec
                 - home-assistant
       validate:
+        allowExistingViolations: true
         message: "Using ':latest' image tag is not allowed. Specify an explicit tag."
         pattern:
           spec:

infrastructure/kyverno/policies/disallow-nodeport.yaml

@@ -11,6 +11,7 @@ spec:
   background: true
   rules:
     - name: disallow-nodeport
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -23,6 +24,7 @@ spec:
                 - kube-system
                 - istio-system
       validate:
+        allowExistingViolations: true
         message: "NodePort services are not allowed. Use ClusterIP or LoadBalancer."
         pattern:
           spec:

infrastructure/kyverno/policies/disallow-privileged.yaml

@@ -11,6 +11,7 @@ spec:
   background: true
   rules:
     - name: disallow-privileged
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -29,6 +30,7 @@ spec:
                 - tetragon
                 - crowdsec
       validate:
+        allowExistingViolations: true
         message: "Privileged containers are not allowed."
         pattern:
           spec:

infrastructure/kyverno/policies/require-drop-all-capabilities.yaml

@@ -15,6 +15,7 @@ spec:
   background: true
   rules:
     - name: require-drop-all
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -55,6 +56,7 @@ spec:
                 - checkov
                 - external-secrets
       validate:
+        allowExistingViolations: true
         message: >-
           Containers must drop ALL capabilities (STIG V-242398).
           Add securityContext.capabilities.drop: ["ALL"] to each container.

infrastructure/kyverno/policies/require-istio-ambient.yaml

@@ -14,6 +14,7 @@ spec:
   background: true
   rules:
     - name: check-namespace-ambient-label
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -74,6 +75,7 @@ spec:
                 - user-*
                 - cluster-fleet-*
       validate:
+        allowExistingViolations: true
         message: "Application namespaces must have istio.io/dataplane-mode=ambient for zero-trust mTLS."
         pattern:
           metadata:

infrastructure/kyverno/policies/require-labels.yaml

@@ -11,6 +11,7 @@ spec:
   background: true
   rules:
     - name: require-app-label
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -33,6 +34,7 @@ spec:
                 - scylla-operator
                 - cert-manager
       validate:
+        allowExistingViolations: true
         message: "The label 'app' or 'app.kubernetes.io/name' is required."
         anyPattern:
           - metadata:

infrastructure/kyverno/policies/require-non-root.yaml

@@ -11,6 +11,7 @@ spec:
   background: true
   rules:
     - name: require-run-as-non-root
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -27,6 +28,7 @@ spec:
                 - kyverno
                 - tetragon
       validate:
+        allowExistingViolations: true
         message: "Containers must run as non-root. Set runAsNonRoot to true."
         pattern:
           spec:

infrastructure/kyverno/policies/require-probes.yaml

@@ -11,6 +11,7 @@ spec:
   background: true
   rules:
     - name: require-probes
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -44,6 +45,7 @@ spec:
                 - nextcloud
                 - scylla-manager
       validate:
+        allowExistingViolations: true
         message: "Liveness and readiness probes are required for all containers."
         pattern:
           spec:

infrastructure/kyverno/policies/require-resource-limits.yaml

@@ -11,6 +11,7 @@ spec:
   background: true
   rules:
     - name: require-limits
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -53,6 +54,7 @@ spec:
                 - checkov
                 - scylla-manager
       validate:
+        allowExistingViolations: true
         message: "All containers must have CPU and memory limits defined."
         pattern:
           spec:

infrastructure/kyverno/policies/require-ro-rootfs.yaml

@@ -11,6 +11,7 @@ spec:
   background: true
   rules:
     - name: require-ro-rootfs
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -31,6 +32,7 @@ spec:
                 - nextcloud
                 - home-assistant
       validate:
+        allowExistingViolations: true
         message: "Containers should use a read-only root filesystem."
         pattern:
           spec:

infrastructure/kyverno/policies/restrict-image-registries.yaml

@@ -16,6 +16,7 @@ spec:
   background: true
   rules:
     - name: validate-container-registries
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -29,6 +30,7 @@ spec:
                 - kube-node-lease
                 - kyverno
       validate:
+        allowExistingViolations: true
         message: >-
           Images must come from allowed registries: docker.io, ghcr.io, quay.io,
           registry.k8s.io, gcr.io, lscr.io, registry.gitlab.com, cr.fluentbit.io,

infrastructure/prometheus/manifests/envoy-route.yaml

@@ -5,7 +5,9 @@ metadata:
   namespace: prometheus
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -16,5 +18,8 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: kube-prometheus-stack-prometheus
+        - group: ""
+          kind: Service
+          name: kube-prometheus-stack-prometheus
           port: 9090
+          weight: 1

infrastructure/rook-ceph/manifests/envoy-route.yaml

@@ -5,7 +5,9 @@ metadata:
   namespace: rook-ceph
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -19,3 +21,4 @@ spec:
         - group: gateway.envoyproxy.io
           kind: Backend
           name: ceph-dashboard
+          weight: 1

infrastructure/tetragon/tracing-policies/kubernetes-api-access.yaml

@@ -6,9 +6,13 @@ spec:
   kprobes:
     - call: tcp_connect
       syscall: false
+      return: false
       args:
         - index: 0
           type: sock
+          maxData: false
+          resolve: ""
+          returnCopy: false
       selectors:
         - matchArgs:
             - index: 0

infrastructure/tetragon/tracing-policies/network-monitoring.yaml

@@ -6,17 +6,25 @@ spec:
   kprobes:
     - call: tcp_connect
       syscall: false
+      return: false
       args:
         - index: 0
           type: sock
+          maxData: false
+          resolve: ""
+          returnCopy: false
       selectors:
         - matchActions:
             - action: Post
     - call: tcp_close
       syscall: false
+      return: false
       args:
         - index: 0
           type: sock
+          maxData: false
+          resolve: ""
+          returnCopy: false
       selectors:
         - matchActions:
             - action: Post

infrastructure/tetragon/tracing-policies/privilege-escalation.yaml

@@ -6,9 +6,13 @@ spec:
   kprobes:
     - call: __x64_sys_setuid
       syscall: true
+      return: false
       args:
         - index: 0
           type: int
+          maxData: false
+          resolve: ""
+          returnCopy: false
       selectors:
         - matchArgs:
             - index: 0
@@ -19,9 +23,13 @@ spec:
             - action: Post
     - call: __x64_sys_setgid
       syscall: true
+      return: false
       args:
         - index: 0
           type: int
+          maxData: false
+          resolve: ""
+          returnCopy: false
       selectors:
         - matchArgs:
             - index: 0

infrastructure/tetragon/tracing-policies/process-execution.yaml

@@ -9,6 +9,9 @@ spec:
       args:
         - index: 4
           type: syscall64
+          maxData: false
+          resolve: ""
+          returnCopy: false
       selectors:
         - matchArgs:
             - index: 4

infrastructure/tetragon/tracing-policies/sensitive-file-access.yaml

@@ -6,11 +6,18 @@ spec:
   kprobes:
     - call: fd_install
       syscall: false
+      return: false
       args:
         - index: 0
           type: int
+          maxData: false
+          resolve: ""
+          returnCopy: false
         - index: 1
           type: file
+          maxData: false
+          resolve: ""
+          returnCopy: false
       selectors:
         - matchArgs:
             - index: 1

infrastructure/vault/manifests/envoy-route.yaml

@@ -5,7 +5,9 @@ metadata:
   namespace: vault
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -16,5 +18,8 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: vault
+        - group: ""
+          kind: Service
+          name: vault
           port: 8200
+          weight: 1