GitOps says everything lives in Git, and secrets are the exception that breaks the rule. This guide compares encrypting secrets in Git with SOPS or Sealed Secrets against referencing them from a secret manager with External Secrets Operator or the CSI driver, including rotation and bootstrap.
We lowered a rate limit in a ConfigMap, Argo CD reported Synced, and the service kept using the old limit for two days. Environment variables from ConfigMaps are read once at container start, and our file mount used subPath, which never updates. A checksum annotation fixed rollouts.
Half our Argo CD applications showed OutOfSync seconds after every successful sync, and auto-sync kept fighting the HPA over replica counts. The live objects had fields set by controllers and webhooks that Git never mentioned. Targeted ignoreDifferences and server-side diff fixed it.