Handling Resource Orphans and Auth Failures During Argo CD to Akuity Migration

Resolving "OutOfSync" Deletion Warnings and Git Auth Issues When Migrating Argo CD Applications

When migrating services from a self-managed Argo CD instance to the Akuity-managed platform, you may encounter issues related to:

  • Stale or orphaned resources, such as Argo CD Projects showing OutOfSync with deletion warnings.

  • Git authentication failures during application sync.

This guide outlines how to handle those issues to ensure a clean and secure migration.


Issue 1: Orphaned Project Resource with Deletion Warning

Symptom:

An Argo CD Project is marked as OutOfSync with the warning:

"This resource is not present in the application's source. It will be deleted from Kubernetes if the prune option is enabled during sync."

Cause:

This happens when the application no longer references the resource, but it still exists in the cluster.

Resolution:

  1. Delete the Application using --cascade=false
    This prevents deletion of child resources like Projects that you want to retain or manually manage.

    argocd app delete <app-name> --cascade=false

  2. Update the argocd-cm ConfigMap in the source Argo CD
    Before migration, ensure that your original Argo CD instance does not prune resources it no longer owns. This avoids unintended deletions.
    data:
      resource.exclusions: |
        - apiGroups:
          - argoproj.io
          kinds:
          - AppProject

Issue 2: Git Auth Error During Application Sync

Symptom:

An application fails to sync with the error:

Failed to load target state: failed to generate manifest for source 1 of 1: rpc error: code = Unknown desc = failed to list refs: WRONGPASS invalid username-password pair or user is disabled.

Cause:

This indicates a Git authentication failure — usually with repositories that use HTTPS credentials that are not correctly configured on the Akuity Argo CD instance.

Resolution:

  1. Re-add your Git repository credentials in the Akuity Argo CD UI:

    • Go to Settings → Repositories

    • Click + Connect Repo

    • Choose HTTPS and add the correct username and password/token

  2. Confirm repository connectivity:

    • Use argocd repo list to verify connectivity.

    • Ensure tokens are scoped correctly if using GitHub/GitLab/Bitbucket.


Best Practices for Migration

  • Perform dry runs using argocd app diff to identify discrepancies.

  • Use argocd app sync --prune only after confirming that all intended resources are in the new Git source.

  • Monitor the AppProject role mappings and RBAC differences between instances.