drift-check

Drift Check

Detect configuration drift between what's deployed via ArgoCD and what's in the Git source.

Process

Step 1: List Applications

Call list_applications to get all ArgoCD-managed applications.

Step 2: Check Sync Status

For each application, call get_application and check:

• syncStatus — is it OutOfSync?
• operationState — any failed sync operations?
• reconciledAt vs observedAt — are there unreconciled changes?

Step 3: Compare Drifted Apps

For any OutOfSync application:

• Call get_resources to pull the live K8s manifests
• Read the corresponding Helm chart values from the local Git repo (e.g., deploy/charts/{app}/values-{env}.yaml)
• Compare key fields: image tags, replica counts, environment variables, resource limits

Step 4: Report

## Drift Report

**Checked:** {count} applications
**Drifted:** {count} applications

### Drifted Applications

#### {app-name}
- **Sync Status:** OutOfSync
- **Git revision:** {expected}
- **Live revision:** {actual}
- **Differences:**
  - Image: `v1.2.3` (Git) vs `v1.2.1` (live)
  - Replicas: 3 (Git) vs 2 (live)

### Clean Applications
All other {count} applications are in sync.

Common Causes of Drift

• Manual kubectl edits bypassing GitOps
• Failed ArgoCD sync that left partial state
• Auto-scaling changing replica counts
• Emergency hotfixes applied directly to cluster