[Feature Request] Add flag to disable default ignore patterns

[Amoolaa]

The tool has a hardcoded defaultIgnorePatterns list in pkg/matching/output.go that unconditionally suppresses diff lines matching patterns like caBundle: , ca.crt: , tls.crt:

Some background: we require (don't ask why) passing in an inline caBundle. As part of a refactor, the ArgoCD diff produced no output for a caBundle change (which we interpreted as a successful refactor - if there's no change to the rendered manifests, there's no change to the live cluster) when in reality there was a hidden change.

Requested change:

Add a flag (e.g. --no-default-diff-ignore or --default-diff-ignore=false) that disables the hardcoded defaultIgnorePatterns, letting users rely solely on their own --diff-ignore regex if desired.

[dag-andersen]

@Amoolaa
Hi again!

Thank you for showing interest in the project and for taking the time to open both the issue and PR.

Haha, okay, I will not ask why you determine changes based on caBundle changes 👀

My main concern with the proposed solution is the user experience of disabling all default ignore patterns. The current default list is:

var defaultIgnorePatterns = []string{
	"app.kubernetes.io/version: ",
	"helm.sh/chart: ",
	"checksum/config: ",
	"checksum/rules: ",
	"checksum/certs: ",
	"checksum/cmd-params: ",
	"checksum/cm: ",
	"checksum/config-maps: ",
	"checksum/secret: ",
	"checksum/secrets: ",
	"caBundle: ",
	"ca.crt: ",
	"tls.crt: ",
	"tls.key: ",
}

If we add a flag that disables all of these, then users who only want to stop ignoring caBundle would have to reimplement the rest of the default ignore behavior themselves through --diff-ignore. I imagine that could become a pretty bad and error-prone experience.

At the same time, over the last 2.5 years this project has existed, no one has requested this functionality before, so my impression is that this is a fairly niche feature Because of that, I am hesitant to add another CLI flag unless there is a broader need or we find a solution that feels very natural.

One possible workaround is to use the existing rendered manifest output. The tool can already write the fully rendered manifests before diff filtering is applied:

argocd-diff-preview ... --output-branch-manifests

This writes:

./output/base-branch.yaml
./output/target-branch.yaml

You could then check for caBundle changes directly with something like:

git diff --no-index ./output/base-branch.yaml ./output/target-branch.yaml | grep 'caBundle'

I verified locally that this gives output like:

-      caBundle: OLD_BUNDLE
+      caBundle: NEW_BUNDLE

If you want to include that in a PR comment, you could write it to a file and use something like:

git diff --no-index ./output/base-branch.yaml ./output/target-branch.yaml | grep 'caBundle' > file-output.md

gh pr comment ${{ github.event.number }} \
  --repo ${{ github.repository }} \
  --body-file file-output.md

There is also --output-app-manifests, which writes each application's rendered manifests separately under:

./output/base/<app-id>
./output/target/<app-id>

I am not sure if that is sufficient for your use case, but maybe it can help you solve this without needing a dedicated flag in the main diff output. I will think a bit more about whether this belongs as a built-in option, but my initial feeling is that using the rendered manifest output might be the better fit for this kind of edge case.