Update dependency argoproj/argo-cd to v3

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
argoproj/argo-cd	major	v2.11.4 → v3.3.0

---

Release Notes

argoproj/argo-cd (argoproj/argo-cd)

v3.3.0

Compare Source

[!IMPORTANT]
Before upgrading all types of Argo CD installations to this release, please read the upgrade guide first:
https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/3.2-3.3/#breaking-changes

Upgrading Argo CD which is managing itself

Users who have an Argo CD Application that manages their Argo CD installation, must enable ServerSideApply=true sync option on this Application in order for the upgrade to succeed.

In some cases, like when the self-managing of Argo CD is performed with Kustomize, setting the above is not enough and there might be a sync error like Failed to perform client-side apply migration: failed to perform client-side apply migration on manager kubectl-client-side-apply.

If you hit this scenario, the remediation is to additionally set the ClientSideApplyMigration=false sync option on this Application.

More details here:
https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#client-side-apply-migration

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.0/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.0/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Features

• ce2fb70: Revert "feat: Ability to create custom labels for namespaces created … (#​455) (@​pasha-codefresh)
• e50dd00: feat(actions): Add cloudnativepg reload, restart, promote, suspend and resume actions (#​24192) (@​rouke-broersma)
• 3ee16c0: feat(actions): PullRequest merge action (#​24823) (@​crenshaw-dev)
• 0c77f3c: feat(actions): add icons to apps actions (#​25343) (#​25344) (@​rickbrouwer)
• a64933f: feat(actions): add pause action for KEDA ScaledObject and ScaledJob (#​25301) (#​25302) (@​rickbrouwer)
• 97d50a1: feat(appset): add pprof endpoints (#​25044) (@​rumstead)
• 482440b: feat(appset): use clone instead of replace on sprig templates to reduce function copies (#​25576) (@​rumstead)
• 64421a7: feat(ci): add run failure link to cherry pick comment (#​24838) (@​crenshaw-dev)
• 4678361: feat(cli): Add additional examples to proj list command (#​25169) (@​onasser1)
• ac12ab9: feat(cli): Updated CLI to show Plugins during tab completion (#​24758) (@​christianh814)
• 53c3542: feat(cli): add powershell completion (#​25595) (@​onasser1)
• f866959: feat(cli): added support for filtering by group in app get-resource CLI command (#​25495) (@​sabre1041)
• ac1a2f8: feat(health): add grafana-org-operator Health (#​25662) (@​sathieu)
• 0c6fa28: feat(hydrator): add inline parameter support to Source Hydrator (#​24228) (#​24277) (@​sangyeong01)
• dea7ead: feat(hydrator): avoid unnecessary repo-server calls (#​25150) (@​pbhatnagar-oss)
• 6cd30d3: feat(hydrator): don't push commits if manifests don't change (#​25056) (@​pbhatnagar-oss)
• fe02a8f: feat(redis): Secrets credentials via volume mount (#​24597) (@​Mangaal)
• bbc3e99: feat(repo): add support for github app authentication without installationid (#​25339) (#​25374) (@​pbhatnagar-oss)
• 1ae13b2: feat(ui): conditionally render app view extensions (#​25132) (@​jwinters01)
• afaf16b: feat(ui): hide sync option 'replace' if sync with replace is disabled in the server (issue no. #​22625) (#​22647) (@​jan-mrm)
• 528482c: feat(ui): implement abstraction layer for appset ui support (#​24916) (@​pjiang-dev)
• b74c7aa: feat(ui): improve sync warnings (#​25524) (@​jwinters01)
• 90b3e85: feat(ui): support custom icons (#​20864) (@​crenshaw-dev)
• a56a803: feat: Ability to create custom labels for namespaces created with syncOptions CreateNamespace (#​443) (@​pasha-codefresh)
• 9ab0b2e: feat: Add ability to hide certain annotations on secret resources (#​577) (@​svghadi)
• 9ee5cca: feat: Add health check for Ceph CRD (#​24111) (@​afarbos)
• 51c9add: feat: Add health checks for ServiceBinding and ServiceInstance (#​25007) (@​dzahariev)
• 8c890d4: feat: Add impersonation support for App finalizer deletion (#​24524) (@​ccjette-logmein)
• ed537d5: feat: Add path flag to ArgoCD CLI app list (#​24834) (@​onasser1)
• 1c4ef33: feat: Add server-side apply manager config (#​418) (@​leoluz)
• 7493226: feat: Add support for HPA v2 (autoscaling/v2) (#​411) (@​EppO)
• 1a6973a: feat: Add the ability to not autogenerate external URLs from ingress object (#​13705) (#​25383) (@​rkevin-arch)
• ed7c77a: feat: Apply out of sync option only (#​533) (@​pasha-codefresh)
• d65e9d9: feat: Enable SkipDryRunOnMissingResource sync option on Application level (#​712) (@​pasha-codefresh)
• aba3819: feat: Implement Server-Side Diffs (#​522) (@​leoluz)
• 6b2984e: feat: More optimal IterateHierarchyV2 and iterateChildrenV2 [#​600] (#​601) (@​andrii-korotkov-verkada)
• 4eb3ca3: feat: Namespace/CRD creation should happen before PreSync phase (#​159) ( <>)
• 3bf3d8a: feat: PreDelete hooks support (Issue #​13975) (#​22288) (@​pedro-cs-ribeiro)
• 5fd9f44: feat: Prune resources in reverse of sync wave order (#​538) (@​svghadi)
• e360551: feat: Support for retries when building up cluster cache (#​374) (@​jannfis)
• e56739c: feat: add CreateResource to kubectl (#​12174 and #​4116) (#​516) (@​reggie-k)
• 0b4199b: feat: add FindResources method that allows to find any resource in cache (#​204) ( <>)
• f9456de: feat: add GvkParser in cluster cache (#​404) (@​leoluz)
• 1b08fd1: feat: add ability to use shallow clone for repositories (#​24931) (@​alexmt)
• d8b1a12: feat: add basic support for server-side apply (#​363) (@​sathieu)
• bfac3f5: feat: add creation timestamp (#​87) (@​taisho6339)
• 9664cf8: feat: add profile feature for agent, and fix logr's panic (#​444) (@​alswl)
• f6f1a42: feat: add status.resourcesCount field to appset and change limit default (#​24698) (@​alexmt)
• c7bab2e: feat: add support split yaml that return actual yamls (#​346) (@​pasha-codefresh)
• ed70eac: feat: add sync delete option (#​507) (@​gdsoumya)
• aae8ded: feat: added cascade option to DeleteResource - argo-cd #​5368 (#​220) (@​ishitasequeira)
• 0000f05: feat: adds various OCI metrics (#​25493) (@​ppapapetrou76)
• e77acec: feat: allow limiting clusterResourceWhitelist by resource name (#​12208) (#​24674) (@​crenshaw-dev)
• 09e5225: feat: application resource deletion protection (#​630) (@​alexmt)
• 69dfa70: feat: auto migrate kubectl-client-side-apply fields for SSA (#​727) (@​pjiang-dev)
• 187312f: feat: auto respect rbac for discovery/sync (#​532) (@​gdsoumya)
• bc9ce57: feat: better error message for sync operations (#​336) (@​pasha-codefresh)
• 9163758: feat: cluster cache should expose synchronization error (#​32) ( <>)
• ae94ad9: feat: configurable watch resync timeout. ability to disable cluster resync (#​353) (@​jessesuen)
• 3c54508: feat: create namespace (#​94) (@​mayzhang2000)
• ddce93c: feat: cross namespace hierarchy traversal from cluster-scoped parents to namespaced children (fixes #​24379) (#​24847) (@​jcogilvie)
• 92a3433: feat: detect PVC StatefulSet ownership (#​112) ( <>)
• 4ea93db: feat: enable forks to release and publish to custom quay registries (#​25365) (@​reggie-k)
• ddc92c9: feat: expose APIGroups in GetClusterInfo (#​283) ( <>)
• 762cb1b: feat: expose all kubernetes resources in cluster info (#​337) ( <>)
• 8aefb18: feat: expose cluster sync retry timeout (#​373) (@​yeya24)
• e58bdf2: feat: implement KEDA scaledJob health-checks (#​25106) (@​rickbrouwer)
• cd2e16d: feat: implement gitops-agent (#​37) ( <>)
• 605958d: feat: improve memory consumption limiting (#​100) (@​ash2k)
• 344b1bc: feat: improve sync operation messages (#​84) ( <>)
• cfdefa4: feat: introduce SyncWaveHook callbacks invoked after applying each sync wave (#​177) (@​jessesuen)
• 5c6aa59: feat: oidc background token refresh (#​23727) (@​devopsjedi)
• 82f0935: feat: prune last (#​203) (@​mayzhang2000)
• c0c2dd1: feat: retry with client side dry run if server one was failed (#​548) (@​pasha-codefresh)
• c617562: feat: return images from resources when sync occurs (#​642) (@​Aaron-9900)
• 7669da6: feat: split refresh button with dropdown for hard refresh (#​25445) (@​choejwoo)
• 89ddd0d: feat: support 'Replace=true' sync option (#​246) ( <>)
• 11d47a6: feat: support configuring cluster cache re-sync timeout (#​107) ( <>)
• 723667d: feat: support exiting early from IterateHierarchy method (#​388) (@​alexmt)
• e8cfb83: feat: support limiting number of concurrent k8s list queries (#​55) ( <>)
• a4c77d5: feat: support managing cluster resources in a namespaced mode (#​297) ( <>)
• 1ce2acc: feat: support replace strategy for CRD (#​252) ( <>)
• 89cb483: feat: support resource prune propagation policy (#​235) ( <>)
• ff6e9f8: feat: support resource pruning in gitops-agent (#​45) ( <>)
• fbecbb8: feat: sync-options annotation with Force=true (#​414) (#​560) (@​kkk777-7)
• 026d10e: feat: syncing to a different revision requires override privilege (#​22858) (@​schraax)
• 552ad1c: feat: update unpause fast/gradual actions for Numaplane rollouts (#​24545) (@​dpadhiar)
• 90979fe: feat: use Kubernetes v1.18.6 libraries (#​102) (@​ash2k)
• 1301eaa: feat: use different env variable to control server side K8s API call timeout (#​25271) (@​ppapapetrou76)

Bug fixes

• f3ae26b: fix(actions): enable pause action so deployment can be paused (#​25394) (#​25395) (@​rickbrouwer)
• 15568cb: fix(appset): do not trigger reconciliation on appsets not part of allowed namespaces when updating a cluster secret (cherry-pick #​25622 for 3.3) (#​25909) (@​argo-cd-cherry-pick-bot[bot])
• e582975: fix(appset): ensure finalizer is added when deletionOrder is set as reverse (#​25125) (@​ranakan19)
• 40e9a06: fix(appset): handle pre/post delete hook finalizers conflicts (#​25539) (@​agaudreault)
• c377101: fix(appset): progressive sync loop when application has sync errors (#​24507) (@​agaudreault)
• d78929e: fix(cluster): reduce lock contention on cluster initialization (#​660) (@​crenshaw-dev)
• adb68bc: fix(clusterCache): don't miss finding live obj if obj is cluster-scoped and namespacedResources is in transition (#​597) (@​ncdc)
• e181fbb: fix(cmp): fix plugins not having access to argocd cli for git ASKPASS (#​24665) (@​zachaller)
• ef5b778: fix(health): incorrect reason in PullRequest script (#​24826) (@​crenshaw-dev)
• 2849f53: fix(health): typo in PromotionStrategy health.lua (@​crenshaw-dev)
• 7c0f032: fix(health): update crossplane healthchecks (#​25386) (@​jonasz-lasut)
• 28ec26a: fix(health): use promotion resource Ready condition regardless of reason (#​24971) (@​crenshaw-dev)
• dab4cc0: fix(hooks): always remove finalizers on create if hook exists (#​770) (@​agaudreault)
• b52a075: fix(hydrator): .gitattributes include deeply nested files (#​25870) (cherry-pick #​26011 for 3.3) (#​26013) (@​argo-cd-cherry-pick-bot[bot])
• a2659e9: fix(hydrator): appset should preserve annotation when hydration is requested (#​25644) (@​agaudreault)
• 48a9dcc: fix(hydrator): empty links for failed operation (#​25025) (cherry-pick #​26014 for 3.3) (#​26018) (@​argo-cd-cherry-pick-bot[bot])
• fe0466d: fix(hydrator): git fetch needs creds (#​25727) (cherry-pick #​25738 for 3.3) (#​25742) (@​argo-cd-cherry-pick-bot[bot])
• 393cb97: fix(hydrator): hydrated sha missing on no-ops (#​25694) (cherry-pick #​25695 for 3.3) (#​25697) (@​argo-cd-cherry-pick-bot[bot])
• 0fa47b1: fix(hydrator): pass destination.namespace to manifest rendering (#​25478) (cherry-pick #​25699 for 3.3) (#​26019) (@​argo-cd-cherry-pick-bot[bot])
• 708c636: fix(hydrator): race when pushing notes (cherry-pick #​25700 for 3.3) (#​25709) (@​argo-cd-cherry-pick-bot[bot])
• 05b4169: fix(metrics): more consistent oci metrics (cherry-pick #​25549 for 3.3) (#​25728) (@​argo-cd-cherry-pick-bot[bot])
• ed983d8: fix(oci): loosen up layer restrictions (#​24640) (@​blakepettersson)
• 5efb184: fix(oidc): check userinfo endpoint in AuthMiddleware (#​23586) (@​the-technat)
• 7921242: fix(server): Dry run always in client mode just for yaml manifest validation even with server side apply (#​564) (@​anandf)
• 7430650: fix(server): ensure resource health status is inferred on application retrieval (#​24832) (#​24851) (@​vr009)
• 20604f1: fix(server): update resourceVersion on Terminate retry (cherry-pick #​25650 for 3.3) (#​25717) (@​argo-cd-cherry-pick-bot[bot])
• 4a5648e: fix(server): use server side dry run in case if it is server side apply (#​546) (@​pasha-codefresh)
• b3a2ec1: fix(sync): ApplyOutOfSyncOnly=true sync option is not honoured for cluster scoped resources (#​765) (@​anandf)
• 8007df5: fix(sync): create namespace before dry-run (#​731) (@​agaudreault)
• c2f611f: fix(ui): Improve Delete Dialog Behaviour when deleting child apps in the app-of-app pattern (#​24802) (@​aali309)
• 27a503a: fix(ui): add null-safe handling for assignedWindows in status panel (#​25128) (@​choejwoo)
• 65cbbca: fix(ui): convert EditablePanel, EditbleSection and Query to function component (#​22776) (@​linghaoSu)
• 7e1db4a: fix(ui): convert PodView components to functional components (#​23781) (@​chansuke)
• de901da: fix(ui): convert ProjectDetails components to functional components (#​23797) (@​chansuke)
• 59c9c60: fix(ui): convert TagsInput component to functional component (#​23795) (@​jiwlee97)
• b4e022c: fix(ui): convert class component to functional component in project-sync-windows-edit (#​23837) (@​jiwlee97)
• 6d40847: fix(ui): fix minor UI issue in app operation state (#​24845) (@​choejwoo)
• ed1fb04: fix(ui): inaccurate timestamp in tooltip for root node (#​25014) (@​choejwoo)
• e7b51da: fix(ui): migrate certs-list.tsx from class to functional (#​23646) (#​23820) (@​bianbbc87)
• 68d10fe: fix(ui): migrate gpgkeys-list.tsx from class to functional (#​23646) (#​23821) (@​bianbbc87)
• 44324c0: fix(ui): migrate repos-list.tsx from class to functional (#​23646) (#​23818) (@​bianbbc87)
• ad96cb8: fix(ui): overlapping UI elements and add resource units to tooltips (#​24717) (@​choejwoo)
• 0b40e3b: fix(ui): refactor tooltip, align action btns in app tile view (#​25098) (@​choejwoo)
• 8dcaa2f: fix(ui): show delete/details action dropdown for orphaned resource (#​24766) (@​choejwoo)
• 24fbf28: fix: shell compatibility issues in Procfile (#​24792) (@​adityaraj178)
• 0679215: fix: #​24781 update crossplane healthchecks to V2 version (#​24782) (@​jonasz-lasut)
• 2c97a96: fix: 'ResourceOperations.CreateResource' should use 'kubectl' package to properly execute create operation (#​298) ( <>)
• 847cfc9: fix: Ability to disable Server Side Apply on individual resource level (#​634) (@​pasha-codefresh)
• 2565df3: fix: Add ScaleDownLimit as health state for HPA (#​343) (@​harikrongali)
• 23f41cb: fix: Add ScalingDisabled healthy state to HPA (#​323) (@​maruina)
• 5d680d6: fix: Add additional healthy states for HPA (#​234) (@​mikebryant)
• 61c0cc7: fix: Add missing IngressClass in kind order when syncing tasks (#​380) (@​terrytangyuan)
• c0b63af: fix: Address issue during diff when secret data is nil (#​345) (@​leoluz)
• ed6fe76: fix: Allow the ISVC to be healthy when the Stopped Condition is False (#​25312) (@​hdefazio)
• da66819: fix: Change wrong log level in cluster.go openAPISchema, gvkParser (#​430) (@​dllegru)
• 6657adf: fix: Check for err == nil before Fatal (#​61) (@​darshanime)
• 3a3f6a3: fix: Child apps should not affect parent app's health by default (#​153) (@​keithchong)
• d59276a: fix: Clear ApplicationSet applicationStatus when ProgressiveSync is disabled (#​24587) (@​aali309)
• 760fcb6: fix: Current time is not set in startedAt in NewSyncContext (#​180) (@​yutachaos)
• 814d79d: fix: Data race between gitops-engine's pkg/cache/cluster.go and itself, on Argo CD startup (#​4627) (#​168) (@​jgwest)
• 872c470: fix: Detect unknown fields in invalid specs as OutOfSync (#​154) (@​jgwest)
• 380f7be: fix: Dry run stuck on pre sync hook (#​236) (@​mayzhang2000)
• 2bc3fef: fix: Fix argument order in resource filter (#​436) (@​jannfis)
• 762f9b7: fix: Fix checking dryRun when using Server Side Apply (#​699) (@​pjiang-dev)
• dbef22c: fix: Fixed inconsistent alignment of titles and headings in status panel (#​23160) (@​sivasath16)
• 30abebd: fix: GCP config connector healthchecks do not make use of existing observedGeneration #​24458 (#​24459) (@​Hapshanko)
• 53cbe5f: fix: HPA health check is making incorrect assumption on annotations (#​190) (@​mayzhang2000)
• 2daaf1e: fix: Health status for HTTPRoute with multiple generations (#​24958) (#​24959) (@​lindeskar)
• 54bbebf: fix: Hook Deletion Policies HookSucceeded should be run after whole H… (#​144) (@​mayzhang2000)
• 93cf3c5: fix: Lock to write MockKubectlCmd.LastValidate to fix the race condition (#​52) (@​suzuki-shunsuke)
• 1f14791: fix: Make CephCluster CRD health script deterministic (#​25391) (#​25392) (@​rkevin-arch)
• dcb86f7: fix: Namespace auto-creation (#​105) (@​mayzhang2000)
• 3ef5ab1: fix: New kube applier for server side diff dry run with refactoring (#​662) (@​andrii-korotkov-verkada)
• ed31317: fix: Only consider resources which supports appropriate verb for any given operation (#​423) (@​jannfis)
• 0d0cec6: fix: Only show apiVersion/kind when targetState is defined (#​25068) (@​jsoref)
• 32c32a6: fix: Only show please update resource specification message when spec… (cherry-pick #​25066 for 3.3) (#​25894) (@​argo-cd-cherry-pick-bot[bot])
• b7c7d02: fix: Opentelemetry Collector in sidecar mode doesn't count instances (#​25407) (@​JorTurFer)
• fbcaf35: fix: Progress Sync Unknown in UI (#​24202) (@​aali309)
• 69d5d94: fix: Revert test tools image redis to non-alpine based image (#​25381) (#​25382) (@​rkevin-arch)
• 8849c3f: fix: Server side diff now works correctly with fields removal (#​640) (@​andrii-korotkov-verkada)
• 89c110b: fix: Server-Side diff removed fields missing in diff (#​722) (@​pjiang-dev)
• 4fd1847: fix: Server-side diff shows incorrect diffs for list related changes (#​688) (@​pjiang-dev)
• 73bcea9: fix: Set QPS and burst rate for resource ops client (#​395) (@​jannfis)
• 8d99997: fix: Set TLSServerName in NewKubeConfig ([#​156](https://redirect.github.com/argoproj/argo-cd/issues/