ArgoCD App Diff

An ArgoCD App Diff compares the desired state (defined in Git) against the live state (currently running in the Kubernetes cluster). When these states differ, ArgoCD reports the application as 'OutOfSync'. Understanding the diff helps you identify what changed, whether it was an intentional update or unexpected drift, and what ArgoCD will do on the next sync.

Run: kubectl get application <app-name> -n argocd -o yaml. This outputs the full Application resource including its current status, syncPolicy, and source configuration. You can also use the ArgoCD CLI: argocd app get <app-name> -o yaml.

OutOfSync means the cluster state doesn't match what Git defines. Configuration drift specifically refers to manual changes made directly to Kubernetes resources (kubectl edit, kubectl patch) that bypass Git. ArgoCD with selfHeal: true automatically reverts drift. Without selfHeal, drift persists until a manual sync. Use this diff tool to identify both types of discrepancies.

targetRevision tells ArgoCD which Git ref (branch, tag, or commit SHA) to use as the source of truth. 'HEAD' tracks the tip of the default branch and syncs with every commit. A pinned tag like 'v1.2.0' ensures only explicit releases are deployed. For production environments, always pin to a specific tag or SHA — never use HEAD, which can cause unexpected automatic deployments.

prune: true tells ArgoCD to delete Kubernetes resources that exist in the cluster but are no longer defined in Git (orphaned resources). selfHeal: true tells ArgoCD to revert any manual changes made directly to the cluster that differ from Git. Both are components of automated sync — without prune, deleted Git resources remain running; without selfHeal, direct kubectl changes persist.

It depends on your team's release process. Automated sync with prune and selfHeal provides the strongest GitOps guarantees — Git is always the single source of truth. However, it can cause unexpected changes if a bad commit is pushed. Many teams use automated sync for dev/staging and manual sync for production, combined with branch protection and required reviews before merging to the production branch.