[vitalii-codefresh]

Changelog

Breaking changes

Warning

This release bumps the bundled ArgoCD to v3.6.1.

1. Increased minimal supported version of BYOA up from 3.3.X to 3.4.X (supported range is now >=3.4 <=3.6)

2. ArgoCD 3.6 introduces the following breaking changes: More about changes in Argo CD here.

• OpenTelemetry changes:
  • Repo-server OTLP headers env var renamed: ARGOCD_REPO_OTLP_HEADERS is now ARGOCD_REPO_SERVER_OTLP_HEADERS. The old name is no longer read. The default manifests already use the new name, but custom Deployment patches or Helm values that set the old variable must be updated.
  • otlp.insecure now fully controls TLS: "true" (default) always uses plaintext. Setting OTEL_EXPORTER_OTLP_CERTIFICATE / client cert env vars no longer enables TLS on its own, so set otlp.insecure: "false" if you relied on that. With "false", OTEL_EXPORTER_OTLP_INSECURE and http:// endpoints no longer force plaintext. A component fails to start if its OTLP TLS env vars point to an unreadable CA or an incomplete client cert/key pair.
  • Collector TLS and authentication: with otlp.insecure: "false", Argo CD also trusts the CA for the collector host from argocd-tls-certs-cm, and honors OTEL_EXPORTER_OTLP_CERTIFICATE, OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE, OTEL_EXPORTER_OTLP_CLIENT_KEY (mTLS) and OTEL_EXPORTER_OTLP_HEADERS. The application controller now mounts argocd-tls-certs-cm.
  • Header values may contain =: each pair now splits on its first =, matching the --otlp-headers flag. Previously, such a value caused all headers to be dropped.
  • Parent-based sampler: instead of AlwaysSample, the root sampling rate is now set with --otlp-sample-ratio / ARGOCD_<COMPONENT>_OTLP_SAMPLE_RATIO (default 1.0 keeps existing behavior). Sampling decisions propagate to repo-server and commit-server, so set the same ratio on all components. An inbound W3C traceparent marked "not sampled" is now honored. An out-of-range or NaN flag value fails at startup; an invalid env var value is ignored with a warning.
  • Instrumentation upgraded: otelgrpc and otelhttp are now v0.70.0 (semantic conventions v1.42.0 / v1.43.0). Some span attribute names changed or were dropped, so Grafana dashboards and alerts may need updates. otelgrpc now sets server.address/server.port from the gRPC dial target rather than the resolved peer IP.
• Default --local-include paths for argocd app diff: with --local and --server-side-generate, the defaults now also include *.tpl (Helm template helpers) and Chart.lock, in addition to *.yaml, *.yml, *.json. Specifying --local-include replaces the defaults entirely, so list every pattern you need. To restore pre-3.6 behavior: --local-include "*.yaml" --local-include "*.yml" --local-include "*.json".

Behavioral changes:

• Server-Side Apply now uses Server-Side Diff: the Structured-Merge Diff approximation was removed. Server-Side Diff is used when controller.diff.server.side is enabled, the argocd.argoproj.io/compare-options: ServerSideDiff=true annotation is set, or (new in 3.6) the ServerSideApply=true sync option is enabled. This adds kube-apiserver load, and validating webhooks now run during diff, so rejections appear as diff errors. To keep the legacy diff for an app with ServerSideApply=true, set the ServerSideDiff=false annotation (it always takes precedence).
• GitOps Promoter health status: PromotionStrategy and ChangeTransferPolicy now report Healthy (not Progressing) while a promotion is in progress. Automation that treats Progressing as "promotion active" should use the health message or Promoter status fields instead.
• Health transition events: the Updated health status event now adds a (Caused by ...) suffix naming up to three resources, for example Updated health status: Healthy -> Degraded (Caused by apps/Deployment:default/api). Update any parser of these events to tolerate the suffix.
• Progressive Sync: the ApplicationSet controller now adds a refresh annotation to all owned Applications when it detects a change, and waits for all of them to reconcile before progressing. With many Applications, step progression may be slower.

API changes:

• A new ephemeral configHash field on the Cluster object. It is computed at query time, not stored in the cluster secret, and should be treated as opaque.
• Gitops Engine: pkg/utils/kube/KubectlOptionsRunner.Create() now ignores its third argument (cmd *cobra.Command). It will be removed in the next major release.

Features and enhancements

• New bundled health check for CloudNativePG postgresql.cnpg.io/Database: reports Healthy only when status.applied is set and status.observedGeneration matches the current generation.
• Health checks during deletion: the default health check for resources being deleted now lists any pending finalizers. Built-in or custom health checks can return an optional deletionMessage to override this.

More about changes in Argo CD here.

Related tickets

• Closes CF-2727