ServerSideDiff triggers diff error on .dockerconfigjson

Author: baurmattCreated Sep 16, 2026Updated Sep 17, 2026

Labelsbugbug/severity:minortriage/pendingfeature:server-side-diff

Checklist:

I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
I've included steps to reproduce the bug.
I've pasted the output of argocd version.

Describe the bug

ServerSideDiff triggers an diff error on Secret containing .dockerconfigjson

$ argocd app diff argocd/argo-cd-server-side-diff-bug
{"level":"fatal","msg":"rpc error: code = Unknown desc = error performing state diffs: failed to calculate diff: error calculating server side diff: serverSideDiff error: error running server side apply in dryrun mode for resource Secret/repro-pullsecret: Secret \"repro-pullsecret\" is invalid: data[.dockerconfigjson]: Invalid value: \"\u003csecret contents redacted\u003e\": invalid character '%C3%BB' looking for beginning of value","time":"2026-09-16T14:35:11+02:00"}

To Reproduce

bash

kind create cluster --name argo-cd-server-side-diff-bug

helm repo add argo https://argoproj.github.io/argo-helm >/dev/null 2>&1 || true
helm upgrade --install argocd argo/argo-cd -n argocd --create-namespace --wait --timeout 5m

kubectl apply -n argocd -f - <<EOF
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: argo-cd-server-side-diff-bug
  annotations:
    argocd.argoproj.io/compare-options: ServerSideDiff=true
spec:
  project: default
  source:
    repoURL: https://github.com/baurmatt/argo-cd-server-side-diff-bug
    targetRevision: main
    path: templates
  destination:
    server: https://kubernetes.default.svc
    namespace: default
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - ServerSideApply=true
EOF

kubectl -n argocd port-forward svc/argocd-server 8080:443 >/dev/null 2>&1 &
PF_PID=$!; trap 'kill $PF_PID 2>/dev/null || true; rm -rf "$WORKDIR"' EXIT
sleep 5
ADMIN_PW="$(kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d)"
argocd login localhost:8080 --username admin --password "$ADMIN_PW" --insecure --grpc-web

argocd app diff argocd/argo-cd-server-side-diff-bug

kind delete cluster --name argo-cd-server-side-diff-bug

Expected behavior

Diff works, as without ServerSideDiff:

$ kubectl annotate -n argocd app argo-cd-server-side-diff-bug argocd.argoproj.io/compare-options-
application.argoproj.io/argo-cd-server-side-diff-bug annotated
$ argocd app diff argocd/argo-cd-server-side-diff-bug

Screenshots

Version

bash

argocd version
argocd: v3.4.5+564b949.dirty
  BuildDate: 2026-07-09T17:43:05Z
  GitCommit: 564b94973b284b8de98da7cee6eeade2cb941e46
  GitTreeState: dirty
  GitTag: v3.4.5
  GoVersion: go1.26.5
  Compiler: gc
  Platform: darwin/arm64
argocd-server: v3.5.3
  BuildDate: 2026-09-14T07:18:56Z
  GitCommit: c9c369efcc5b2a0bd720803f8d14a1c3eaddf579
  GitTreeState: clean
  GitTag: v3.5.3
  GoVersion: go1.26.4
  Compiler: gc
  Platform: linux/arm64
  Kustomize Version: v5.8.1 2026-02-09T16:15:27Z
  Helm Version: v4.2.1+gd591a19
  Kubectl Version: v0.36.1
  Jsonnet Version: v0.22.0

Logs

argocd-server-78ffb9d6-chg95 server time="2026-09-16T12:41:52Z" level=info msg="received unary call /application.ApplicationService/ServerSideDiff" grpc.request.content="appName:\"argo-cd-server-side-diff-bug\" appNamespace:\"argocd\" project:\"default\" liveResources:<group:\"\" kind:\"Secret\" namespace:\"default\" name:\"repro-pullsecret\" targetState:\"{\\\"apiVersion\\\":\\\"v1\\\",\\\"data\\\":{\\\".dockerconfigjson\\\":\\\"++++++++\\\"},\\\"kind\\\":\\\"Secret\\\",\\\"metadata\\\":{\\\"annotations\\\":{\\\"argocd.argoproj.io/tracking-id\\\":\\\"argo-cd-server-side-diff-bug:/Secret:default/repro-pullsecret\\\"},\\\"name\\\":\\\"repro-pullsecret\\\",\\\"namespace\\\":\\\"default\\\"},\\\"type\\\":\\\"kubernetes.io/dockerconfigjson\\\"}\" liveState:\"{\\\"apiVersion\\\":\\\"v1\\\",\\\"data\\\":{\\\".dockerconfigjson\\\":\\\"++++++++\\\"},\\\"kind\\\":\\\"Secret\\\",\\\"metadata\\\":{\\\"annotations\\\":{\\\"argocd.argoproj.io/tracking-id\\\":\\\"argo-cd-server-side-diff-bug:/Secret:default/repro-pullsecret\\\"},\\\"creationTimestamp\\\":\\\"2026-09-16T12:40:40Z\\\",\\\"managedFields\\\":[{\\\"apiVersion\\\":\\\"v1\\\",\\\"fieldsType\\\":\\\"FieldsV1\\\",\\\"fieldsV1\\\":{\\\"f:data\\\":{\\\"f:.dockerconfigjson\\\":{}},\\\"f:metadata\\\":{\\\"f:annotations\\\":{\\\"f:argocd.argoproj.io/tracking-id\\\":{}}},\\\"f:type\\\":{}},\\\"manager\\\":\\\"argocd-controller\\\",\\\"operation\\\":\\\"Apply\\\",\\\"time\\\":\\\"2026-09-16T12:40:40Z\\\"}],\\\"name\\\":\\\"repro-pullsecret\\\",\\\"namespace\\\":\\\"default\\\",\\\"resourceVersion\\\":\\\"865\\\",\\\"uid\\\":\\\"b7aaae00-daf7-4b91-a95a-b02657387b73\\\"},\\\"type\\\":\\\"kubernetes.io/dockerconfigjson\\\"}\" diff:\"\" hook:false normalizedLiveState:\"{\\\"apiVersion\\\":\\\"v1\\\",\\\"data\\\":{\\\".dockerconfigjson\\\":\\\"++++++++\\\"},\\\"kind\\\":\\\"Secret\\\",\\\"metadata\\\":{\\\"annotations\\\":{\\\"argocd.argoproj.io/tracking-id\\\":\\\"argo-cd-server-side-diff-bug:/Secret:default/repro-pullsecret\\\"},\\\"name\\\":\\\"repro-pullsecret\\\",\\\"namespace\\\":\\\"default\\\",\\\"uid\\\":\\\"b7aaae00-daf7-4b91-a95a-b02657387b73\\\"},\\\"type\\\":\\\"kubernetes.io/dockerconfigjson\\\"}\" predictedLiveState:\"{\\\"apiVersion\\\":\\\"v1\\\",\\\"data\\\":{\\\".dockerconfigjson\\\":\\\"++++++++\\\"},\\\"kind\\\":\\\"Secret\\\",\\\"metadata\\\":{\\\"annotations\\\":{\\\"argocd.argoproj.io/tracking-id\\\":\\\"argo-cd-server-side-diff-bug:/Secret:default/repro-pullsecret\\\"},\\\"name\\\":\\\"repro-pullsecret\\\",\\\"namespace\\\":\\\"default\\\",\\\"uid\\\":\\\"b7aaae00-daf7-4b91-a95a-b02657387b73\\\"},\\\"type\\\":\\\"kubernetes.io/dockerconfigjson\\\"}\" resourceVersion:\"865\" modified:false > targetManifests:\"{\\\"apiVersion\\\":\\\"v1\\\",\\\"data\\\":{\\\".dockerconfigjson\\\":\\\"++++++++\\\"},\\\"kind\\\":\\\"Secret\\\",\\\"metadata\\\":{\\\"annotations\\\":{\\\"argocd.argoproj.io/tracking-id\\\":\\\"argo-cd-server-side-diff-bug:/Secret:default/repro-pullsecret\\\"},\\\"name\\\":\\\"repro-pullsecret\\\",\\\"namespace\\\":\\\"default\\\"},\\\"type\\\":\\\"kubernetes.io/dockerconfigjson\\\"}\" "
argocd-server-78ffb9d6-chg95 server time="2026-09-16T12:41:52Z" level=info msg="Ignore status for all objects"
argocd-server-78ffb9d6-chg95 server time="2026-09-16T12:41:52Z" level=error msg="finished call" grpc.code=Unknown grpc.component=server grpc.error="error performing state diffs: failed to calculate diff: error calculating server side diff: serverSideDiff error: error running server side apply in dryrun mode for resource Secret/repro-pullsecret: Secret \"repro-pullsecret\" is invalid: data[.dockerconfigjson]: Invalid value: \"<secret contents redacted>\": invalid character 'û' looking for beginning of value" grpc.method=ServerSideDiff grpc.method_type=unary grpc.service=application.ApplicationService grpc.start_time="2026-09-16T12:41:52Z" grpc.time_ms=198.06 peer.address="127.0.0.1:56814" protocol=grpc

Source: argoproj/argo-cd

View original on GitHub View discussion on GitHub