ServerSide Diff always shows single app out of sync

[andrewjamesbrown]

Checklist:

• [ ] I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• [ ] I've included steps to reproduce the bug.
• [ ] I've pasted the output of argocd version.

Describe the bug

With Server Side Diff + Kyverno mutating image policy, ArgoCD 0.10.3 always shows a diff for Fluentbit. All other apps in this ArgoCD cluster show as in sync. Repeated attempts to refresh, hard refresh, or sync do not result in any change. Deleting the fluentbit daemonset does not resolve the problem.

The kyverno mutating image policy changes docker.io/namespace/image, namespace/image and image to direct to an ECR pullthrough cache. We also have a istio mutating webhooks and datadog mutating webhooks, but these are not being used for fluent-bit.

To Reproduce

I'm not sure how to reproduce this problem. We have 5 ArgoCD clusters that are near identical, and two show the issue while the other 3 are fine. Every other app in this cluster shows in-sync - only fluent-bit is the issue (as shown in the screenshot)

Expected behavior

Application shows in-sync with ServerSideDiff enabled.

Screenshots

Version

v2.10.3+0fd6344

Logs

Paste any relevant application logs here.

[andrii-korotkov-verkada]

ArgoCD versions 2.10 and below have reached EOL. Can you upgrade and tell us if the issue is still present, please?