Diff not working correctly with cluster scoped resource ENIConfig

[mra89]

Checklist:

• [ x ] I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• [ x ] I've included steps to reproduce the bug.
• [ x ] I've pasted the output of argocd version.

Describe the bug

ArgoCD does not show the application out of sync when the resource on the cluster side is different than what is in my repo, specifically for a resource of apiVersion crd.k8s.amazonaws.com/v1alpha1 and kind of ENIConfig. In addition to this, when clicking on the resource, ArgoCD does reflect the 'LIVE MANIFEST' and 'DESIRED MANIFEST' correctly but the DIFF section shows nothing, even though the live and desired are different

To Reproduce

Apply the eniconfigs.crd.k8s.amazonaws.com CRD to your cluster along with custom resource ENIConfig via an argocd application, get the application in sync. Make a change directly to the ENIConfig resource within the cluster to spec.securityGroups, observe that the argocd application will not show as out of sync

Expected behavior

I would expect the application to show as out of sync being that the state of the resource is different than what is in my repo

Screenshots

Here is my live state after making a change to spec.securityGroups

Here is showing that nothing is different between the live and desired

Here is my desired state

Version

argocd: v3.2.0+66b2f30
  BuildDate: 2025-11-04T15:21:01Z
  GitCommit: 66b2f302d91a42cc151808da0eec0846bbe1062c
  GitTreeState: clean
  GoVersion: go1.25.0
  Compiler: gc
  Platform: windows/amd64
argocd-server: v3.2.0+66b2f30
  BuildDate: 2025-11-04T15:21:01Z
  GitCommit: 66b2f302d91a42cc151808da0eec0846bbe1062c
  GitTreeState: clean
  GoVersion: go1.25.0
  Compiler: gc
  Platform: windows/amd64
  Kustomize Version: v5.5.0 2024-10-09T13:10:16Z
  Helm Version: v3.18.6+gb76a950
  Kubectl Version: v0.34.0
  Jsonnet Version: v0.21.0

Logs

Paste any relevant application logs here.

[mehrdadbn9]

I'd like to help with investigating this issue.

I'm currently reviewing ArgoCD diff logic for cluster-scoped resources to try fixing ENIConfig synchronization issue.

Plan:

• Step 1: Locate diff comparison logic for custom resources
• Step 2: Examine how ENIConfig changes are being detected
• Step 3: Test with an ENIConfig CRD setup to validate fix

Please let me know if there's any specific data or logging you'd like me to focus on.

[mra89]

Thank you @mehrdadbn9. This was my first issue I have opened up so I'm not too familiar with the process. Do you need anything from me?

[ppapapetrou76]

@mra89 I want to double check that I have understood the issue.
You are making a change manually on the app on the server side and the expectation is to see the app out of sync right?
Do you have by chance the self-heal enabled on this app?

[mra89]

@mra89 I want to double check that I have understood the issue.
You are making a change manually on the app on the server side and the expectation is to see the app out of sync right?
Do you have by chance the self-heal enabled on this app?

I am making a change directly on the cluster. The expectation is to then seen the app out of sync but it never shows that way. I do not have self heal enabled on the app which is why I can see via the diff tab, live manifest section that Argo is showing the state accurately but just never bubbles it up to the app level in the form of it showing as out of sync, being my repo has a different config