argocd app diff --revision does not show changes to Secret resources for CMP/helmfile apps
- Dominant language
- Go
- Stars
- 24.2k
- Forks
- 7.8k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 246
Description
Checklist:
- [x] I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
- [x] I've included steps to reproduce the bug.
- [x] I've pasted the output of `argocd version`.
**Describe the bug**
When using a CMP plugin (helmfile with SOPS-encrypted secrets), argocd app diff --revision does not show any diff output for Kubernetes Secret resources. Non-secret resources (Deployments, ConfigMaps, etc.) from the same helmfile render are shown correctly. Secret resources are silently absent from the diff — no error, no redacted output, nothing.
**To Reproduce**
1. Have an ArgoCD application backed by a helmfile CMP plugin with a release that manages Kubernetes Secret resources via SOPS-encrypted files in the secrets: block.
_helmfile.yaml:_
```yaml
releases:
- name: secret-oc
chart: myorg-repo/anything
version: 1.0.0
missingFileHandler: Error
namespace: oc
createNamespace: false
installed: true
secrets:
- ../../secrets/dev/oc.yaml
- ../../secrets/dev/test.yaml
```
2. Push a commit that adds a new Secret or modifies an existing one.
3. Run:
```
argocd app diff --revision
```
4. Observe that the diff output contains no mention of the Secret resource, while other resource changes in the same commit are shown correctly.
**Expected behavior**
Secret resources should appear in the diff output with values redacted (e.g. [redacted] or ***), consistent with how ArgoCD handles Secrets in its UI.
**Screenshots**
N/A — the output simply omits the Secret entirely with no indication that it was excluded.
**Version**
```shell
argocd: v3.4.3+1801122.dirty
BuildDate: 2026-05-28T15:08:05Z
GitCommit: 1801122b4391cad4961301f787006dc9a88c2dd3
GitTag: v3.4.3
GoVersion: go1.26.3
Compiler: gc
Platform: darwin/arm64
argocd-server: v3.3.8
BuildDate: 2026-04-21T17:19:47Z
GitCommit: 7ae7d2cc723f5408b080a31263e705198af08613
GitTag: v3.3.8
GoVersion: go1.25.5
Compiler: gc
Platform: linux/arm64
Kustomize Version: v5.8.1
Helm Version: v3.19.4+g7cfb6e4
Kubectl Version: v0.34.0
```
**Logs**
argocd app diff output for dev-oc-api — Deployment diff shown, Secret entirely absent:
```
===== apps/Deployment oc/oc-api-spring-boot ======
@@ -356,7 +356,7 @@
- image: .../oc:2.15.206-71616386-SNAPSHOT
+ image: .../oc:2.15.202-71531741-SNAPSHOT
(differences found above)
# Secret from secret-oc helmfile release: no output at all
```
Contributor guide
Assessment
This issue has not been assessed yet.