ArgoCD's client-side structured merge diff fails on VirtualMCPServer resources that use spec.incomingAuth.oidc because the CRD schema does not declare that subfield. ServerSideDiff=true switches diff computation to a server-side dry-run which handles preserved-unknown-fields correctly. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>