---
title: "Fixing Argo CD Out-of-Sync Due to Cilium Identity on RKE2"
source: "https://support.tools/cilium-identity-argo-out-of-sync-rke2/"
published: 2024-10-15
categories: ["Kubernetes","RKE2"]
tags: ["Cilium","ArgoCD","RKE2"]
---


## Fixing Argo CD Out-of-Sync Due to Cilium Identity on RKE2

If you're running a Kubernetes cluster with RKE2 and Cilium as your networking solution, you might encounter a situation where Argo CD shows an out-of-sync status due to the presence of **CiliumIdentity** resources. Although the actual application is in sync and functioning normally, this false out-of-sync status can be frustrating to see in your CI/CD workflows.

### Problem

When using Argo CD on RKE2 with Cilium as the CNI, **CiliumIdentity** objects may appear in Argo CD as out of sync. This happens even though they are auto-generated by Cilium and have no direct impact on the application's state. This can cause the entire application to show as out of sync, even though everything is working correctly.

### Solution

The solution is to configure Argo CD to exclude **CiliumIdentity** objects from being tracked, as these resources are not needed for application state reconciliation. This can be done by adding a resource exclusion rule in Argo CD's configuration.

### Step-by-Step Fix

1. **Access the Argo CD ConfigMap**

   To fix this issue, the first step is to access and edit the Argo CD configuration to exclude the **CiliumIdentity** resource type. You can view the current configmap for Argo CD with the following command:

   ```bash
   kubectl get cm -n argocd
   ```

   Find the configmap named `argocd-cm`, which holds the main configuration for Argo CD.

2. **Edit the ConfigMap**

   Use the following command to open the configmap in a text editor (we'll use `nano` here for simplicity, but you can use any editor):

   ```bash
   KUBE_EDITOR="nano" kubectl edit cm argocd-cm -n argocd
   ```

3. **Add Resource Exclusion Rules**

   In the configmap, add the following exclusion rule under the `data` section to tell Argo CD to ignore Cilium Identity resources:

   ```yaml
   data:
     resource.exclusions: |
       - apiGroups:
         - cilium.io
         kinds:
         - CiliumIdentity
         clusters:
         - "*"
   ```

   This configuration tells Argo CD to ignore all **CiliumIdentity** resources across all clusters. The `apiGroups` field matches resources belonging to `cilium.io`, and the `kinds` field targets the **CiliumIdentity** resource specifically.

4. **Save and Exit**

   Press `CTRL + O` to save the changes, and then `CTRL + X` to exit the nano editor.

5. **Apply Changes**

   Once you've updated the configmap, the Cilium Identity resources will no longer be tracked by Argo CD. The out-of-sync status caused by these resources will disappear, and your application's actual sync status will be displayed correctly.

### Why This Works

By adding this resource exclusion rule, Argo CD is instructed to ignore **CiliumIdentity** objects, which are dynamically managed by Cilium and aren't essential for Argo CD to track. This keeps your Argo CD dashboard clean and ensures that only application-related resources are synced.

### Conclusion

Fixing the out-of-sync status in Argo CD caused by **CiliumIdentity** resources is a simple configuration change that can help you maintain a clean and accurate view of your application's state. By excluding these non-essential resources, you can focus on the actual application components and avoid unnecessary alerts or confusion in your CI/CD pipelines.