app is permanently OutOfSync on one resource while every sync reports success

How to confirm it

• Find which resource is stuck

  kubectl -n argocd get app APP -o json | jq '.status.resources[] | select(.status!="Synced")'

  One resource OutOfSync forever, with a successful operation state, is the signature. A whole app failing is a different problem.

• Catch the lie in the controller log

  kubectl -n argocd logs argocd-application-controller-0 | grep RESOURCE

  The log says the resource was configured, and it was — with a truncated payload. Success in the log is not success in the object.

• Prove the write lands but is short

  kubectl get RESOURCE NAME -o jsonpath='{.metadata.annotations.kubectl\.kubernetes\.io/last-applied-configuration}' | jq '.spec.data | length'

  The last-applied record already shows the old list. That distinguishes a truncated apply from a correct apply being reverted afterwards.

• Render the chart the way the controller does

  helm template REL ./helm -n NS -f helm/values.yaml -f helm/values/ENV.yaml

  Diff desired against live for that one field. This is the step that turns "GitOps is broken" into "the patch is truncated".

• Remember env vars do not hot reload

  kubectl -n NS rollout restart deploy/SVC

  A secret consumed by reference is injected at pod start. Fixing the sync leaves running pods on the old values, and a missing key is silent — no crash, the variable simply does not exist.