What is self-healing in ArgoCD and how do you enable it?

Self-healing in ArgoCD means that when the live cluster state drifts from the desired Git state — due to manual changes, operator mistakes, or other controllers modifying resources — ArgoCD automatically detects the drift and re-applies the Git state to bring the cluster back into sync, without any human intervention.

Self-healing is distinct from simply enabling automated sync. Automated sync fires when Git changes (a new commit is detected). Self-healing fires when the cluster changes while Git stays the same. Together they cover both directions of drift.

Enable self-healing in the Application's syncPolicy:

syncPolicy:
  automated:
    selfHeal: true
    prune: true       # also enable pruning if you want deleted Git resources removed

With selfHeal: true, the Application Controller compares live state against Git state every time a watch event fires from the Kubernetes API (near-real-time). When it detects OutOfSync, it immediately triggers a sync to restore the desired state.

A practical example: if an engineer runs kubectl scale deployment my-app --replicas=0 in production, ArgoCD with selfHeal enabled will detect the replica count change within seconds and restore replicas to the count defined in Git.

Self-healing should be combined with Sync Windows if you want to restrict when auto-corrections can occur (e.g., only during business hours or excluding a maintenance window).