ArgoCD Sync Failed & Degraded Cheatsheet

argocd app get <app-name>

→ Sync, operation and per-resource health at a glance. Shows which resource is the problem.

argocd app get <app-name> --show-operation

→ Phase (Failed/Error) and the exact error message of the last sync operation.

kubectl logs -n argocd \
  -l app.kubernetes.io/name=argocd-application-controller \
  --tail=100

→ Apply errors, RBAC and timeouts that are not visible in the UI.

kubectl apply --dry-run=server -f manifest.yaml

→ Server-side dry-run uses the same validation as ArgoCD on the real apply.

metadata:
  annotations:
    argocd.argoproj.io/sync-options: Replace=true

→ For fields that cannot change after creation (selector, clusterIP, volumeName).

spec:
  syncPolicy:
    syncOptions:
      - CreateNamespace=true

→ Fixes "namespace not found" during sync.

kubectl get pods -n <namespace> -l job-name=<hook-job>
kubectl logs -n <namespace> job/<hook-job>

→ A PreSync/PostSync job with a non-zero exit aborts the sync. Check the job logs.

kubectl get pods -n <namespace> -l app=<name>
kubectl logs -n <namespace> <pod> --previous

→ CrashLoopBackOff/ImagePullBackOff: logs of the previous, crashed container.

kubectl describe pod -n <namespace> <pod> | grep -A5 -i readiness
kubectl get events -n <namespace> | grep -i probe

→ Pods run but never go Ready: check path, port and initialDelaySeconds.

kubectl get endpoints -n <namespace> <service>

→ Empty endpoints = the service selector matches no pod labels.

kubectl logs -n argocd \
  -l app.kubernetes.io/name=argocd-application-controller \
  --tail=100 | grep -i forbidden

→ The controller lacks cluster permissions: extend the ClusterRole or whitelist in the project.

kubectl get validatingwebhookconfigurations
kubectl describe constraint <name>   # Gatekeeper

→ Which webhook (OPA/Kyverno) rejects the apply. Also stated in the sync message.

kubectl describe certificate -n <namespace> <name>

→ Built-in health checks: read the Certificate/Rollout status directly (Reason).