argoproj / argoproj/argo-cd

argocd app diff --revision does not show changes to Secret resources for CMP/helmfile apps

Open
#28,107 3 comments 0 reactions 1 assignee Claimed by @maheshz09 View on GitHub
bug triage/pending
Dominant language
Go
Stars
24.2k
Forks
7.8k
Avg merge
1d 14h
Merged PRs (30d)
246

Description

Checklist:

- [x] I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
- [x] I've included steps to reproduce the bug.
- [x] I've pasted the output of `argocd version`.

**Describe the bug**

When using a CMP plugin (helmfile with SOPS-encrypted secrets), argocd app diff --revision does not show any diff output for Kubernetes Secret resources. Non-secret resources (Deployments, ConfigMaps, etc.) from the same helmfile render are shown correctly. Secret resources are silently absent from the diff — no error, no redacted output, nothing.

**To Reproduce**

1. Have an ArgoCD application backed by a helmfile CMP plugin with a release that manages Kubernetes Secret resources via SOPS-encrypted files in the secrets: block.
_helmfile.yaml:_
```yaml
releases:
- name: secret-oc
chart: myorg-repo/anything
version: 1.0.0
missingFileHandler: Error
namespace: oc
createNamespace: false
installed: true
secrets:
- ../../secrets/dev/oc.yaml
- ../../secrets/dev/test.yaml
```
2. Push a commit that adds a new Secret or modifies an existing one.
3. Run:
```
argocd app diff --revision
```
4. Observe that the diff output contains no mention of the Secret resource, while other resource changes in the same commit are shown correctly.

**Expected behavior**

Secret resources should appear in the diff output with values redacted (e.g. [redacted] or ***), consistent with how ArgoCD handles Secrets in its UI.

**Screenshots**

N/A — the output simply omits the Secret entirely with no indication that it was excluded.

**Version**

```shell
argocd: v3.4.3+1801122.dirty
BuildDate: 2026-05-28T15:08:05Z
GitCommit: 1801122b4391cad4961301f787006dc9a88c2dd3
GitTag: v3.4.3
GoVersion: go1.26.3
Compiler: gc
Platform: darwin/arm64

argocd-server: v3.3.8
BuildDate: 2026-04-21T17:19:47Z
GitCommit: 7ae7d2cc723f5408b080a31263e705198af08613
GitTag: v3.3.8
GoVersion: go1.25.5
Compiler: gc
Platform: linux/arm64
Kustomize Version: v5.8.1
Helm Version: v3.19.4+g7cfb6e4
Kubectl Version: v0.34.0
```

**Logs**

argocd app diff output for dev-oc-api — Deployment diff shown, Secret entirely absent:
```
===== apps/Deployment oc/oc-api-spring-boot ======
@@ -356,7 +356,7 @@
- image: .../oc:2.15.206-71616386-SNAPSHOT
+ image: .../oc:2.15.202-71531741-SNAPSHOT
(differences found above)
# Secret from secret-oc helmfile release: no output at all
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.