How to fix ArgoCD orphaned in Kubernetes

Open the ArgoCD web interface and navigate to the Applications view. Look for a "Show Orphaned" option in the sidebar (typically with a count badge). Click it to see all orphaned resources in your cluster.

Alternatively, use the CLI to list orphaned resources:

argocd app resources YOUR_APP_NAME --orphaned

This command only works if the resource was previously managed by the application. To see all orphaned resources across the entire cluster, access the ArgoCD UI.

For each orphaned resource, determine if it should be:

1. Adopted: Add the resource to your ArgoCD Application by including it in your git repository
2. Excluded: Ignore the resource as it is intentionally managed outside ArgoCD
3. Deleted: Remove the resource if it is no longer needed

Most commonly, resources created by operators (like cert-manager secrets) should be excluded from monitoring, while resources you want to manage should be adopted.

To adopt an orphaned resource, add it to your ArgoCD Application configuration:

1. Define the resource in your git repository (in the same Helm chart or kustomize base as your Application)
2. Ensure the resource path is included in your Application spec
3. Sync the Application

Example ArgoCD Application that includes the resource:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
spec:
  source:
    repoURL: https://github.com/myorg/myrepo
    path: k8s/
  destination:
    server: https://kubernetes.default.svc
    namespace: default

Make sure the resource YAML is in the k8s/ directory so ArgoCD tracks it.

To prevent specific resources from being marked as orphaned, add them to your AppProject's orphanedResources ignore list:

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: default
spec:
  orphanedResources:
    warn: true
    ignore:
    - group: cert-manager.io
      kind: Certificate
      name: my-cert
    - group: ""
      kind: ConfigMap
      name: kube-root-ca.crt

Or use the CLI:

argocd proj set default --add-orphaned-ignore='{"group":"cert-manager.io","kind":"Certificate","name":"my-cert"}'

This is ideal for resources intentionally managed outside ArgoCD (e.g., secrets created by operators).

If an orphaned resource should no longer exist, delete it from your cluster:

kubectl delete RESOURCE_TYPE RESOURCE_NAME -n NAMESPACE

Example:

kubectl delete deployment old-service -n production

Warning: Only delete resources you are certain are no longer needed. Some orphaned resources (like cert-manager certificates) should be excluded instead of deleted.

By default, ArgoCD warns about orphaned resources. To disable warnings (but still allow viewing orphaned resources in the UI):

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: default
spec:
  orphanedResources:
    warn: false

To re-enable warnings:

argocd proj set default --orphaned-resources-warn

Keep warnings enabled to maintain visibility into unclaimed resources in your cluster.

If you recently changed the resource tracking method (annotation vs. label), orphaned resources may appear temporarily:

1. Check your ArgoCD ConfigMap for the tracking method setting:

kubectl get configmap argocd-cm -n argocd -o yaml | grep resourceTrackingMethod

2. If you changed it and deleted the application before syncing, recreate the application
3. Sync the application to re-establish tracking labels/annotations
4. Verify orphaned resources are reassociated with the application

This is a temporary issue that resolves after re-syncing with the new tracking method.