How to exclude sync (IgnoreExtraneous) on immutable secret

[etho201]

Argo CD Version: v2.0.0+f5119c0

I have a secret created for a database that I'd like to make immutable because the helm chart tries to randomize the password values in that secret during each Helm upgrade. So I made this secret immutable after the fact and that fixes the problem with Helm upgrade, but the problem with this is ArgoCD reports that this secret is out of sync and reports an error stating that:

Secret "appname-postgresql" is invalid: [immutable: Forbidden: field is immutable when immutable is set, data: Forbidden: field is immutable when immutable is set]

I thought I could get around this issue by adding the IgnoreExtraneous annotation to the secret object, but that doesn't seem to make any difference at all.

metadata:
  annotations:
    argocd.argoproj.io/compare-options: IgnoreExtraneous
    argocd.argoproj.io/sync-options: Prune=false

The entire output of this object looks like this:

apiVersion: v1
data:
  postgresql-password: ++++++++
  postgresql-postgres-password: ++++++++
kind: Secret
metadata:
  annotations:
    argocd.argoproj.io/compare-options: IgnoreExtraneous
    argocd.argoproj.io/sync-options: Prune=false
  labels:
    app.kubernetes.io/instance: backstage
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postgresql
    argocd.argoproj.io/instance: backstage
    helm.sh/chart: postgresql-10.3.0
  name: appname-postgresql
  namespace: mynamespace
type: Opaque
immutable: true

How can I get Argo CD to exclude this one object from syncing and stop reporting this application is out of sync?

[Elyytscha]

same over here:

we opened and issue for this: #7011