GitOps Sync Conflict Resolver
Resolve ArgoCD/Flux sync conflicts by analyzing the diff between Git and cluster state and generating a reconciliation plan.
Tested against argocd cli 2.x · fluxctl/ks · claude-code-1.8+
You are a GitOps reliability engineer. Your task is to resolve a sync conflict where Git and cluster state disagree, by analyzing the diff and producing a reconciliation plan. Context: - A leading ArgoCD or Flux reconciliation shows out-of-sync resources or a stuck sync. - You have read access to the Git repo and to the GitOps controller API (argocd or flux). - This is analysis; the apply is the user's decision. Steps: 1. Identify the out-of-sync resources: argocd app diff <app> (or argocd app get <app> -o wide) / flux get kustomization <k>, and capture the diff. 2. Determine the conflict direction: does the diff show live state diverging from Git (manual drift) or Git manifest errors (schema/invalid YAML) preventing sync? 3. For drift: check if it is a health-adjustment by the operator, a manual kubectl edit, or a Helm-managed field, using annotations like last-applied-configuration where available. 4. Plan reconciliation: propose the safe path, usually updating Git to match an intentional live change, or letting Git revert the drift via a targeted sync, never a blind delete. 5. Present the plan with the exact command for the chosen path and a guardrail against affecting unrelated resources. Output format: - Diff summary grouped by resource with direction (drift vs manifest error). - A reconciliation plan: update Git, targeted sync, or inspect-only, with the exact command. Constraints: - Do not run sync or delete commands; propose them. - Never apply a delete to a resource holding state (secrets, PVC) as a Standard conflict resolution. - Flag any diff touching secrets or volumes as needing manual review. Example: Input: app payments OutOfSync on Deployment api because live image tag differs from Git. Output: drift on api Deployment image tag; plan: if intentional, commit the new tag; if not, run argocd app sync payments --resource payments:Deployment:api --revision <git> to revert just that resource.
Why this directive matters
A GitOps sync that shows OutOfSync is not a crisis, it is an information prompt, but only if someone reads it correctly. The underlying question is whether live state drifted away from Git or whether Git itself has a manifest problem, and the two reconciliations are opposites. This directive gives the agent a structured way to answer it from the diff. It uses the GitOps controller's own diff commands to see exactly which fields diverge, then classifies the cause, a manual kubectl edit, a Helm-adjustment, or a YAML schema error in the manifest. It is blunt that a blind delete is not a resolution for state-bearing resources. The output is a diff summary and a reconciliation plan with the precise sync command scoped to only the affected resource, keeping a fix surgical rather than a mass reconcile of the whole app.
Test Command
kubectl get applications -n argocd -o wide 2>/dev/null || kubectl get kustomizations -n flux-systemPrerequisites
- argocd/flux CLI or kubectl access
- Git repo read
- List of tracked apps
Expected Outputs
- Diff summary by resource
- Conflict-direction verdict
- Scoped reconciliation plan
References
- Kubernetes Documentation | Concepts: authoritative concepts for cluster, RBAC, and workload audits.
- Terraform Documentation: plan, state, and provider reference for IaC directives.
- AWS Documentation: IAM, Cost Explorer, and service reference for cloud directives.
- CNCF Landscape: cloud-native tooling context for multi-cloud directives.
Automate it past the prompt.
This advanced directive is a manual, read-only run. Devopsify can run the same check continuously across your estate, with policy gates, approvals, and a retained audit trail.