argocd_cluster.config.tls_client_config.ca_cert is never in sync on terraform apply

[flaviomoringa]

Hi, my argocd terraform is always out of sync regarding the ca_cert of the cluster, seems that is changed on every terraform apply, which it isn't. Am I missing something in my config?

Thanks

Terraform Version, ArgoCD Provider Version and ArgoCD Version

Terraform version: v1.3.2
ArgoCD provider version: v7.11.2
ArgoCD version: v3.1.8+becb020

Affected Resource(s)

• argocd_cluster

Terraform Configuration Files

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use an online file storage service and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public release key.
provider "argocd" {
  server_addr = "argocd.euc1.cicd.mywebsite.com:443"
  auth_token  = var.argocd_auth_token
  insecure    = false
  grpc_web    = true
}

resource "argocd_cluster" "this" {
  server = module.eks.cluster_endpoint
  name   = format("dh-io-%s-%s-%s-%s", var.tenant_name, var.cluster_name, local.dns_region, var.environment)

  config {
    bearer_token = data.kubernetes_secret_v1.argocd_manager.data.token
    tls_client_config {
      ca_data = base64decode(module.eks.cluster_certificate_authority_data)
    }
  }
}

Debug Output

Panic Output

Steps to Reproduce

Expected Behavior

No changes found

Actual Behavior

# argocd_cluster.this will be updated in-place
  ~ resource "argocd_cluster" "this" {
        id         = "https://xxxxxxxxxxxxxxxxxx.gr7.eu-central-1.eks.amazonaws.com/hosting-cluster1-euc1-nprd"
        name       = "hosting-cluster1-euc1-nprd"
        # (4 unchanged attributes hidden)

      ~ config {
            # (3 unchanged attributes hidden)

          ~ tls_client_config {
              + ca_data  = <<-EOT
                    -----BEGIN CERTIFICATE-----
                    XXXXXXXXXXXXXXXXXXXXX
                    -----END CERTIFICATE-----
                EOT
                # (1 unchanged attribute hidden)
            }
        }
    }

Important Factoids

References

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[AkakievKD]

yes i have the same

  # module.argocd-basic-resources.argocd_cluster.kubernetes["prod"] will be updated in-place
  ~ resource "argocd_cluster" "kubernetes" {
        id         = ""
        name       = "prod"
        # (4 unchanged attributes hidden)
      ~ config {
            # (3 unchanged attributes hidden)
          ~ tls_client_config {
              + ca_data     = (sensitive value)
              + cert_data   = (sensitive value)
                # (3 unchanged attributes hidden)
            }
        }
        # (1 unchanged block hidden)
    }

[barnscott]

I'm encountering the same issue after upgrade my Argo to v3.1

{
"Version": "v3.1.9+8665140",
"BuildDate": "2025-10-17T21:35:08Z",
"GitCommit": "8665140f96f6b238a20e578dba7f9aef91ddac51",
"GitTreeState": "clean",
"GoVersion": "go1.24.6",
"Compiler": "gc",
"Platform": "linux/amd64",
"KustomizeVersion": "v5.7.0 2025-06-28T07:00:07Z",
"HelmVersion": "v3.18.4+gd80839c",
"KubectlVersion": "v0.33.1",
"JsonnetVersion": "v0.21.0"
}

After every plan/apply, i maintain persistent TF drift on the following:

Terraform will perform the following actions:
  # module.cluster_configuration.module.register_with_cargo[0].argocd_cluster.this will be updated in-place
  ~ resource "argocd_cluster" "this" {
        id         = "https://*remove*"
        name       = "*remove*"
        # (4 unchanged attributes hidden)
      ~ config {
            # (3 unchanged attributes hidden)
          ~ tls_client_config {
              + ca_data     = (sensitive value)
                # (4 unchanged attributes hidden)
            }
        }
        # (1 unchanged block hidden)
    }
Plan: 0 to add, 1 to change, 0 to destroy.

[reneeckstein]

Same issue on our side.

[knowlesy]

Just to add were seeing the same

[sidewinder12s]

Also seeing this on 2.14, seems like it might have been triggered by a change on my cluster side (using EKS 1.31)