Description of problem: Using ArgoCD to configure authentication.
We noticed that the secrets mentioned in the OAuth configuration are copied from the openshift-config namespace to the openshift-authentication namespace. This copy also contains the kubernetes.io/instance label, which makes ArgoCD think the copied secret is managed by itself, as well, and it shows this as 'out of sync'.

The situation gets worse, when auto-heal and pruning is enabled. This makes ArgoCD remove these secrets, followed by the operator, adding them back, after which ArgoCD removes them again, and so on.

As workaround we added "argocd.argoproj.io/compare-options: IgnoreExtraneous"  annotation.
To build further on my example, I defined the secret as follows:

---
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
  annotations:
    argocd.argoproj.io/compare-options: IgnoreExtraneous
spec:
  identityProviders:
    - name: local_accounts
      type: HTPasswd
      htpasswd:
        fileData:
          name: htpass-users
    - name: Active_Directory
      type: LDAP
      ldap:
        ...
        bindPassword:
          name: ad-secret

The annotations are copied to the corresponding secret which itself gets ignored. This allows me to activate the self-heal with prune option, without having the loop effect.

This solves the issue only partly, because now the secret itself (not the copy in openshift-authentication) will still not be pruned when I remove it from my configuration. Their existence will be ignored by the annotation.

While this seems to be a valid (partial) workaround,