How to fix ExcludedResourceWarning Resource /Application is excluded in the settings in Kubernetes

KubernetesINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 172 views

ExcludedResourceWarning appears when ArgoCD encounters resources excluded in global settings. Configure resource inclusions/exclusions properly or override exclusions per-application using sync options.

Quick fix

Fixes ExcludedResourceWarning Resource /Application is excluded in the settings

kubectl get configmap argocd-cm -n argocd -o yaml | grep -A 20 resource.exclusions
  1. Understand default exclusions
  2. View excluded resources in your Application
  3. Override exclusions per-Application using sync options
  4. Configure resource inclusions in argocd-cm
kubernetes — error
kubectl get configmap argocd-cm -n argocd -o yaml | grep -A 20 resource.exclusions
ExcludedResourceWarning Resource /Application is excluded in the settings

What this error means

ArgoCD shows ExcludedResourceWarning when it encounters a Kubernetes resource type that has been excluded from management via the global resource exclusion configuration. This is typically a warning rather than an error, but it prevents ArgoCD from managing those resources. Common exclusions include ServiceAccount, Secret, and NetworkPolicy by default to prevent security issues.

Typical symptoms

  • Warning displayed: "ExcludedResourceWarning Resource <kind> is excluded in the settings"
  • Application deploys but shows warnings for managed resources
  • Specific resource types are not synced by ArgoCD
  • App of Apps pattern fails with resource exclusion warnings
  • Custom resources are excluded but need to be managed
  • Secrets or ConfigMaps cannot be synced through ArgoCD
  • NetworkPolicy resources are silently ignored
  • Trying to deploy ArgoCD Application resources fails

Common causes

  1. Resource type is configured in argocd-cm resource.exclusions field
  2. Global exclusions block sensitive resource types by default
  3. Using App of Apps pattern with ArgoCD Application CRD which is excluded
  4. Custom resource type not in resource.inclusions allowlist
  5. Namespace is excluded when shoulde be included
  6. API group and kind match exclusion rules unintentionally
  7. Resource exclusion rules too broad with wildcards
  8. RBAC restrictions preventing resource synchronization

How to fix "ExcludedResourceWarning Resource /Application is excluded in the settings"

1Understand default exclusions

Check the argocd-cm ConfigMap to see what is excluded:

bash
kubectl get configmap argocd-cm -n argocd -o yaml | grep -A 20 resource.exclusions

Common exclusions include ServiceAccount, Secret, ResourceQuota, and NetworkPolicy for security.

2View excluded resources in your Application

Use ArgoCD UI to see which resources are excluded. Go to the Application details and check the Resource Tree tab. Resources marked as excluded will show a warning icon.

3Override exclusions per-Application using sync options

To allow specific excluded resources in your application, add the IgnoreExtraneous sync option:

yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
spec:
  syncPolicy:
    syncOptions:
    - RespectIgnoreDifferences=true

Or use annotations on resources to exclude them from diff detection.

4Configure resource inclusions in argocd-cm

To allow a specific resource type globally, edit the ConfigMap:

bash
kubectl edit configmap argocd-cm -n argocd

Add resource.inclusions to override exclusions:

yaml
resource.inclusions: |
  - apiGroups:
    - apps
    kinds:
    - Deployment
5Remove specific exclusions if needed

To stop excluding a resource type entirely, edit argocd-cm and remove it from resource.exclusions:

yaml
resource.exclusions: |
  - apiGroups:
    - rbac.authorization.k8s.io
    kinds:
    - ClusterRoleBinding
6For App of Apps, ensure ArgoCD Application is not excluded

When using the App of Apps pattern, the Application CRD itself must not be excluded. If it is, add it to inclusions:

yaml
resource.inclusions: |
  - apiGroups:
    - argoproj.io
    kinds:
    - Application
7Use RBAC-aware resource exclusions

For production, enable RBAC-aware exclusions in argocd-cm:

yaml
resource.respectRBAC: "strict"

This ensures resources are only excluded if the service account does not have permissions.

8Apply cluster comparison options for better control

Use cluster comparison options to handle excluded resources more carefully:

yaml
resource.customizations.comparison.rules: |
  - kinds:
    - Secret
    jqFilter: .

Advanced notes

Exclusions exist for security reasons - be cautious when removing them, especially for Secrets and RBAC resources. Use inclusion lists rather than exclusion lists when you want to manage only specific resource types. For multi-tenant clusters, use RBAC-aware exclusions to ensure access control is enforced. Consider using an external secrets operator instead of syncing Secrets through ArgoCD for better security posture.

Frequently asked questions

What does "ExcludedResourceWarning Resource /Application is excluded in the setti" mean?
ArgoCD shows ExcludedResourceWarning when it encounters a Kubernetes resource type that has been excluded from management via the global resource exclusion configuration. This is typically a warning rather than an error, but it prevents ArgoCD from managing those resources. Common exclusions include ServiceAccount, Secret, and NetworkPolicy by default to prevent security issues.
How do I fix "ExcludedResourceWarning Resource /Application is excluded in the setti"?
ExcludedResourceWarning appears when ArgoCD encounters resources excluded in global settings. Configure resource inclusions/exclusions properly or override exclusions per-application using sync options.
What causes "ExcludedResourceWarning Resource /Application is excluded in the setti"?
Resource type is configured in argocd-cm resource.exclusions field Global exclusions block sensitive resource types by default Using App of Apps pattern with ArgoCD Application CRD which is excluded
Is the "ExcludedResourceWarning Resource /Application is excluded in the setti" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading