ignoreDifferences hits even when managedFieldsManagers is not a match

[madaraszg-tulip]

Checklist:

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug

We have the tempo-distributed chart installed. We have increased the replicas count for the tempo-metrics-generator statefulset, however argocd does not see the diff.

To Reproduce

We do have the following config in argocd to ignore replica changes by HPA.

      resource.customizations.ignoreDifferences.apps_StatefulSet: |
        managedFieldsManagers:
          - kube-controller-manager
        jsonPointers:
          - /spec/replicas

If we remove this config, then argocd correctly sees the diff in the replicas count. However /spec/replicas is NOT managed by kube-controller-manager

Expected behavior

I would expect argocd to see the replicas change, as it should not be ignored according to the configuration.

Screenshots

managedFields is too long to post a screenshot, here's an excerpt:

  managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          ...
        f:spec:
          f:minReadySeconds: {}
          f:persistentVolumeClaimRetentionPolicy:
            .: {}
            f:whenDeleted: {}
            f:whenScaled: {}
          f:podManagementPolicy: {}
          f:replicas: {}
          ...
      manager: argocd-controller
      operation: Update
      time: '2025-10-27T21:02:12Z'

If I remove the above mentioned config snippet, which refers to kube-controller-manager, the diff shows up.

Version

$ argocd version
argocd: v3.0.12+ed1e239
  BuildDate: 2025-07-25T19:36:41Z
  GitCommit: ed1e2397ef9af6d23b284e39d504308cdda1957b
  GitTreeState: clean
  GoVersion: go1.24.4
  Compiler: gc
  Platform: linux/amd64

Logs

[madaraszg-tulip]

I have tested with the following config, and the diff shows up. It looks like the relation between managedFieldsManagers and jsonPointers is an or relation instead of and ?

  resource.customizations.ignoreDifferences.apps_StatefulSet: |
    managedFieldsManagers:
      - kube-controller-manager

[madaraszg-tulip]

I looked at the source code, and added the following test to the release-3.0 branch. The test fails

diff --git a/util/argo/diff/diff_test.go b/util/argo/diff/diff_test.go
index 71ff962c4..ac25c26cd 100644
--- a/util/argo/diff/diff_test.go
+++ b/util/argo/diff/diff_test.go
@@ -93,6 +93,25 @@ func TestStateDiff(t *testing.T) {
                        expectedNormalizedReplicas: 2,
                        expectedPredictedReplicas:  3,
                },
+               {
+                       name: "will keep replica field not owned by trusted manager v2",
+                       params: func() *diffConfigParams {
+                               params := defaultDiffConfigParams()
+                               params.ignores = []v1alpha1.ResourceIgnoreDifferences{
+                                       {
+                                               Group:                 "*",
+                                               Kind:                  "*",
+                                               ManagedFieldsManagers: []string{"some-other-manager"},
+                                               JSONPointers:          []string{"/spec/replicas"},
+                                       },
+                               }
+                               return params
+                       },
+                       desiredState:               testutil.YamlToUnstructured(testdata.DesiredDeploymentYaml),
+                       liveState:                  testutil.YamlToUnstructured(testdata.LiveDeploymentWithManagedReplicaYaml),
+                       expectedNormalizedReplicas: 2,
+                       expectedPredictedReplicas:  3,
+               },
                {
                        name: "will normalize replica field if configured with json pointers",
                        params: func() *diffConfigParams {

As I understand, it shouldn't normalize the replicas, because the manager field does not match some-other-manager

The same test fails on the release-3.1 and release-3.2 branches too

[madaraszg-tulip]

So, the combination of these three bugs put us in an awkward situation.

The current setting:

      resource.customizations.ignoreDifferences.apps_StatefulSet: |
        managedFieldsManagers:
          - kube-controller-manager
        jsonPointers:
          - /spec/replicas

As per this bug, managedFieldsManagers is ignored, and this behaves as if there was only a jsonPointers setting:

      resource.customizations.ignoreDifferences.apps_StatefulSet: |
        jsonPointers:
          - /spec/replicas

This means that even if /spec/replicas changes in the desired manifest, it will be ignored by argocd.

Meanwhile, due to #25112, for any resources where the desired manifest did not include explicit /spec/replicas, argocd got the value from the live manifest, explicitly applying it, meaning it is now present in the kubectl.kubernetes.io/last-applied-configuration annotation

My intention was to change the ignore definition to be done based only on the manager, without jsonPointers, with the expectation to allow desired /spec/replicas to be applied properly while continuing to ignore HPA managed resources.

      resource.customizations.ignoreDifferences.apps_StatefulSet: |
        managedFieldsManagers:
          - kube-controller-manager

However, due to #25110, all resources that don't have /spec/replicas in the desired manifest, and having /spec/replicas in the kubectl.kubernetes.io/last-applied-configuration annotation (previous bug) will have /spec/replicas explicitly removed by argocd in the next sync, causing temporary scaledown of these resources to 1, potentially causing serious disruption - unless we go through every resource having this problem and manually edit the annotation.

Because of this, it looks like it would be important to fix #25110 before this bug, to prevent fallout from fixing this bug.