[vitalii-codefresh]

Changelog

Breaking changes

Warning

This release bumps the bundled ArgoCD to v3.6.1.

1. GitOps operator is disabled by default (End-of-Life): gitops-operator.enabled now defaults to false.

   • On upgrade, the chart removes the gitops-operator Deployment, ServiceAccount, RBAC and PDB, the promotion-template ServiceAccount/RBAC, and the operator CRDs in the codefresh.io group: products, promotionflows, promotionpolicies, promotiontasks, promotiontemplates, restrictedgitsources.
   • Deleting a CRD deletes all custom resources of that kind in the cluster. Functionality that depends on these resources stops working in the runtime:
     • Restricted Git Sources (RestrictedGitSource): restrictions on which Git sources Applications in the runtime can use are no longer enforced.
       > - Operator-based promotion resources (Product, PromotionFlow, PromotionPolicy, PromotionTemplate, PromotionTask) are removed from the cluster, together with the promotion-template ServiceAccount used by promotion workflows.

2. Increased minimal supported version of BYOA up from 3.3.X to 3.4.X (supported range is now >=3.4 <=3.6)

3. ArgoCD 3.6 introduces the following breaking changes: More about changes in Argo CD here.

• OpenTelemetry changes:
  • Repo-server OTLP headers env var renamed: ARGOCD_REPO_OTLP_HEADERS is now ARGOCD_REPO_SERVER_OTLP_HEADERS. The old name is no longer read. The default manifests already use the new name, but custom Deployment patches or Helm values that set the old variable must be updated.
    > - otlp.insecure now fully controls TLS: "true" (default) always uses plaintext. Setting OTEL_EXPORTER_OTLP_CERTIFICATE / client cert env vars no longer enables TLS on its own, so set otlp.insecure: "false" if you relied on that. With "false", OTEL_EXPORTER_OTLP_INSECURE and http:// endpoints no longer force plaintext. A component fails to start if its OTLP TLS env vars point to an unreadable CA or an incomplete client cert/key pair.
    > - Collector TLS and authentication: with otlp.insecure: "false", Argo CD also trusts the CA for the collector host from argocd-tls-certs-cm, and honors OTEL_EXPORTER_OTLP_CERTIFICATE, OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE, OTEL_EXPORTER_OTLP_CLIENT_KEY (mTLS) and OTEL_EXPORTER_OTLP_HEADERS. The application controller now mounts argocd-tls-certs-cm.
    > - Header values may contain =: each pair now splits on its first =, matching the --otlp-headers flag. Previously, such a value caused all headers to be dropped.
    > - Parent-based sampler: instead of AlwaysSample, the root sampling rate is now set with --otlp-sample-ratio / ARGOCD_<COMPONENT>_OTLP_SAMPLE_RATIO (default 1.0 keeps existing behavior). Sampling decisions propagate to repo-server and commit-server, so set the same ratio on all components. An inbound W3C traceparent marked "not sampled" is now honored. An out-of-range or NaN flag value fails at startup; an invalid env var value is ignored with a warning.
    > - Instrumentation upgraded: otelgrpc and otelhttp are now v0.70.0 (semantic conventions v1.42.0 / v1.43.0). Some span attribute names changed or were dropped, so Grafana dashboards and alerts may need updates. otelgrpc now sets server.address/server.port from the gRPC dial target rather than the resolved peer IP.
• Default --local-include paths for argocd app diff: with --local and --server-side-generate, the defaults now also include *.tpl (Helm template helpers) and Chart.lock, in addition to *.yaml, *.yml, *.json. Specifying --local-include replaces the defaults entirely, so list every pattern you need. To restore pre-3.6 behavior: --local-include "*.yaml" --local-include "*.yml" --local-include "*.json".

Behavioral changes:

• Server-Side Apply now uses Server-Side Diff: the Structured-Merge Diff approximation was removed. Server-Side Diff is used when controller.diff.server.side is enabled, the argocd.argoproj.io/compare-options: ServerSideDiff=true annotation is set, or (new in 3.6) the ServerSideApply=true sync option is enabled. This adds kube-apiserver load, and validating webhooks now run during diff, so rejections appear as diff errors. To keep the legacy diff for an app with ServerSideApply=true, set the ServerSideDiff=false annotation (it always takes precedence).
• GitOps Promoter health status: PromotionStrategy and ChangeTransferPolicy now report Healthy (not Progressing) while a promotion is in progress. Automation that treats Progressing as "promotion active" should use the health message or Promoter status fields instead.
• Health transition events: the Updated health status event now adds a (Caused by ...) suffix naming up to three resources, for example Updated health status: Healthy -> Degraded (Caused by apps/Deployment:default/api). Update any parser of these events to tolerate the suffix.
• Progressive Sync: the ApplicationSet controller now adds a refresh annotation to all owned Applications when it detects a change, and waits for all of them to reconcile before progressing. With many Applications, step progression may be slower.

API changes:

• A new ephemeral configHash field on the Cluster object. It is computed at query time, not stored in the cluster secret, and should be treated as opaque.
• Gitops Engine: pkg/utils/kube/KubectlOptionsRunner.Create() now ignores its third argument (cmd *cobra.Command). It will be removed in the next major release.

Features and enhancements

• New bundled health check for CloudNativePG postgresql.cnpg.io/Database: reports Healthy only when status.applied is set and status.observedGeneration matches the current generation.
• Health checks during deletion: the default health check for resources being deleted now lists any pending finalizers. Built-in or custom health checks can return an optional deletionMessage to override this.

More about changes in Argo CD here.

Changes to the chart

Value	Before (0.31.x)	Now (0.32.0)	Notes
gitops-operator.enabled	true	false	GitOps operator is End-of-Life.

Related tickets

• Closes CF-1832
• Closes CF-2727
• Closes CFS-23915

[vitalii-codefresh]

/e2e

[vitalii-codefresh]

/e2e