IgnoreDifferences on partial image string value

[JonathanSerafini]

I'm curious to see if it would be possible to IgnoreDifferences on our applications, in such a away where
we only ignore changes to a part of the image string, specifically the @sha256 portion of the image.

Specifically, I'd like to consider the entire image before an optional @sha256:xxx as valid for diff
detection, and ignore everything after.

Currently, our CI pipelines are updating the application manifests to push out image changes
in a registry/image:tag format.

We are also looking at deploying the Sigstore policy controller which contains a validating/mutating webhook
that appends the shasum to the images so that the end result is an image in registry/image:tag@sha256:xxx
format.

With the apps set to automated syncPolicy, we'd end up with constant diffs and looping updates.

[rsmartins78]

I got the same issue here with Binary Authorization on GKE. The sha256 is appended to the image and ArgoCD then marks the app as out of sync.

Did anyone got a solution for that?
ArgoCD Version: v3.0.1+2bcef48

[crenshaw-dev]

Is it added by a mutating webhook? If so, Server-side-diff might handle this gracefully.

[rsmartins78]

Server side apply caused a different issue with cloudsql auth proxy operator, so I just stopped using the binary authorization mutation hook as it wasn’t in prod anyway

[cme-incom]

I’m experiencing the same issue.
Has anyone found a workaround or fix yet?