Stale force and resource scope leak into every later Argo CD sync via merge patch

The permanent fix replaced the merge patch with a replace of the operation subtree (PR #28778, cherry-picked to the 3.5/3.4/3.3 release branches), so upgrade to a release that carries it. If you are stuck on an affected version, the workaround is surgical: clear the leaked fields with a merge patch that nulls them, e.g. kubectl patch app [app name] --type merge -p the JSON that sets status.operationState.operation.sync.syncStrategy and .resources to null, then run the sync again. Single-wave syncs never resume and never hit this, which is a useful signal when diagnosing: if single-wave works but multi-wave fails forever, check status.operationState.operation.sync for a force or resource scope nobody submitted.

Context: GitHub issue argoproj/argo-cd#29332 (closed, 6 comments): setOperationState persisted status.operationState with a JSON merge patch while syncStrategy, resources, and apply force are all tagged omitempty. A prior operation's force:true or resource scope therefore survived in the CR indefinitely, and any multi-wave sync that resumes across a reconcile boundary rehydrates the poisoned state. With ServerSideApply=true every resumed task fails with --force cannot be used with --server-side; without SSA a resumed leg can silently apply a stale subset and report Succeeded while skipping resources.

Source: GitHub issue argoproj/argo-cd#29332 (closed, 6 comments): setOperationState persisted status.operationState with a JSON merge patch while syncStrategy, resources, and apply force are all tagged omitempty. A prior operation's force:true or resource scope therefore survived in the CR indefinitely, and any multi-wave sync that resumes across a reconcile boundary rehydrates the poisoned state. With ServerSideApply=true every resumed task fails with --force cannot be used with --server-side; without SSA a resumed leg can silently apply a stale subset and report Succeeded while skipping resources.

Verified resolution: The permanent fix replaced the merge patch with a replace of the operation subtree (PR #28778, cherry-picked to the 3.5/3.4/3.3 release branches), so upgrade to a release that carries it. If you are stuck on an affected version, the workaround is surgical: clear the leaked fields with a merge patch that nulls them, e.g. kubectl patch app [app name] --type merge -p the JSON that sets status.operationState.operation.sync.syncStrategy and .resources to null, then run the sync again. Single-wave syncs never resume and never hit this, which is a useful signal when diagnosing: if single-wave works but multi-wave fails forever, check status.operationState.operation.sync for a force or resource scope nobody submitted.

Source URL: https://github.com/argoproj/argo-cd/issues/29332