chore(argo-cd): Update dependency argoproj/argo-cd to v3.2.0 (#3568)

* chore(argo-cd): Update dependency argoproj/argo-cd to v3.2.0

Signed-off-by: argoproj-renovate[bot] <161757507+argoproj-renovate[bot]@users.noreply.github.com>

* merge in crd changes

Signed-off-by: Tim Collins <[email protected]>

* chore: Sync more changes (redis, redis-ha, RBAC, env vars)

Signed-off-by: Marco Maurer <[email protected]>

* fix: Run helm-docs and bump minor version

Signed-off-by: Marco Maurer <[email protected]>

---------

Signed-off-by: argoproj-renovate[bot] <161757507+argoproj-renovate[bot]@users.noreply.github.com>
Signed-off-by: Tim Collins <[email protected]>
Signed-off-by: Marco Maurer <[email protected]>
Co-authored-by: argoproj-renovate[bot] <161757507+argoproj-renovate[bot]@users.noreply.github.com>
Co-authored-by: Tim Collins <[email protected]>
Co-authored-by: Marco Maurer <[email protected]>

Author: 3 people

charts/argo-cd/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: redis-ha
   repository: https://dandydeveloper.github.io/charts/
-  version: 4.33.7
-digest: sha256:a3eba6bba484e9fbfaca33e7f1ea3e6daed74014df7e7b077c496c2201b01996
-generated: "2025-05-25T11:18:29.356017-05:00"
+  version: 4.34.11
+digest: sha256:c8810d74bdcdbec4db273601203c1cf8a32c9a35c82caf0c9bfd7a750c7ca1fa
+generated: "2025-11-04T21:57:39.132262+01:00"

charts/argo-cd/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: v3.1.9
+appVersion: v3.2.0
 kubeVersion: ">=1.25.0-0"
 description: A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.
 name: argo-cd
-version: 9.0.6
+version: 9.1.0
 home: https://github.com/argoproj/argo-helm
 icon: https://argo-cd.readthedocs.io/en/stable/assets/logo.png
 sources:
@@ -18,7 +18,7 @@ maintainers:
     url: https://argoproj.github.io/
 dependencies:
   - name: redis-ha
-    version: 4.33.7
+    version: 4.34.11
     repository: https://dandydeveloper.github.io/charts/
     condition: redis-ha.enabled
 annotations:
@@ -27,4 +27,4 @@ annotations:
     url: https://argoproj.github.io/argo-helm/pgp_keys.asc
   artifacthub.io/changes: |
     - kind: changed
-      description: Bump redis_exporter to v1.80.0
+      description: Bump argo-cd to v3.2.0

charts/argo-cd/README.md

@@ -1478,7 +1478,7 @@ NAME: my-release
 | redis.extraContainers | list | `[]` | Additional containers to be added to the redis pod |
 | redis.image.imagePullPolicy | string | `""` (defaults to global.image.imagePullPolicy) | Redis image pull policy |
 | redis.image.repository | string | `"ecr-public.aws.com/docker/library/redis"` | Redis repository |
-| redis.image.tag | string | `"7.2.11-alpine"` | Redis tag |
+| redis.image.tag | string | `"8.2.2-alpine"` | Redis tag |
 | redis.imagePullSecrets | list | `[]` (defaults to global.imagePullSecrets) | Secrets with credentials to pull images from a private registry |
 | redis.initContainers | list | `[]` | Init containers to add to the redis pod |
 | redis.livenessProbe.enabled | bool | `false` | Enable Kubernetes liveness probe for Redis server |
@@ -1566,7 +1566,7 @@ The main options are listed here:
 | redis-ha.haproxy.tolerations | list | `[]` | [Tolerations] for use with node taints for haproxy pods. |
 | redis-ha.hardAntiAffinity | bool | `true` | Whether the Redis server pods should be forced to run on separate nodes. |
 | redis-ha.image.repository | string | `"ecr-public.aws.com/docker/library/redis"` | Redis repository |
-| redis-ha.image.tag | string | `"7.2.11-alpine"` | Redis tag |
+| redis-ha.image.tag | string | `"8.2.2-alpine"` | Redis tag |
 | redis-ha.persistentVolume.enabled | bool | `false` | Configures persistence on Redis nodes |
 | redis-ha.redis.config | object | See [values.yaml] | Any valid redis config options in this section will be applied to each server (see `redis-ha` chart) |
 | redis-ha.redis.config.save | string | `'""'` | Will save the DB if both the given number of seconds and the given number of write operations against the DB occurred. `""`  is disabled |

charts/argo-cd/templates/argocd-application-controller/deployment.yaml

@@ -190,6 +190,12 @@ spec:
                 name: argocd-cmd-params-cm
                 key: controller.self.heal.backoff.cooldown.seconds
                 optional: true
+          - name: ARGOCD_SYNC_WAVE_DELAY
+            valueFrom:
+              configMapKeyRef:
+                name: argocd-cmd-params-cm
+                key: controller.sync.wave.delay.seconds
+                optional: true
           - name: ARGOCD_APPLICATION_CONTROLLER_SYNC_TIMEOUT
             valueFrom:
               configMapKeyRef:

charts/argo-cd/templates/argocd-application-controller/statefulset.yaml

@@ -186,6 +186,12 @@ spec:
                 name: argocd-cmd-params-cm
                 key: controller.self.heal.backoff.cooldown.seconds
                 optional: true
+          - name: ARGOCD_SYNC_WAVE_DELAY
+            valueFrom:
+              configMapKeyRef:
+                name: argocd-cmd-params-cm
+                key: controller.sync.wave.delay.seconds
+                optional: true
           - name: ARGOCD_APPLICATION_CONTROLLER_SYNC_TIMEOUT
             valueFrom:
               configMapKeyRef:

charts/argo-cd/templates/argocd-applicationset/clusterrole.yaml

@@ -20,14 +20,6 @@ rules:
     - patch
     - update
     - watch
-  - apiGroups:
-    - argoproj.io
-    resources:
-    - applicationsets/status
-    verbs:
-    - get
-    - patch
-    - update
   - apiGroups:
     - argoproj.io
     resources:
@@ -37,23 +29,19 @@ rules:
     - list
     - watch
   - apiGroups:
-    - ""
+    - argoproj.io
     resources:
-    - events
+    - applicationsets/status
     verbs:
-    - create
     - get
-    - list
     - patch
-    - watch
+    - update
   - apiGroups:
     - ""
     resources:
-    - configmaps
+    - events
     verbs:
     - create
-    - update
-    - delete
     - get
     - list
     - patch
@@ -62,29 +50,28 @@ rules:
     - ""
     resources:
     - secrets
+    - configmaps
     verbs:
     - get
     - list
     - watch
+  # argocd-applicationset-controller leader election rules
+  # Create with resourceNames fails, so use a separate rule for the lease creation
   - apiGroups:
-    - apps
-    - extensions
+    - coordination.k8s.io
     resources:
-    - deployments
+    - leases
     verbs:
-    - get
-    - list
-    - watch
+    - create
   - apiGroups:
     - coordination.k8s.io
     resources:
     - leases
+    resourceNames:
+    # Defined in `cmd/argocd-applicationset-controller/commands/applicationset_controller.go`
+    - 58ac56fa.applicationsets.argoproj.io
     verbs:
-    - create
-    - delete
     - get
-    - list
-    - patch
     - update
-    - watch
+    - create
 {{- end }}

charts/argo-cd/templates/argocd-applicationset/deployment.yaml

@@ -298,6 +298,8 @@ spec:
               name: gpg-keyring
             - mountPath: /app/config/reposerver/tls
               name: argocd-repo-server-tls
+            - mountPath: /home/argocd/params
+              name: argocd-cmd-params-cm
             - mountPath: /tmp
               name: tmp
         {{- with .Values.applicationSet.extraContainers }}
@@ -368,6 +370,13 @@ spec:
                 path: tls.key
               - key: ca.crt
                 path: ca.crt
+        - name: argocd-cmd-params-cm
+          configMap:
+            optional: true
+            name: argocd-cmd-params-cm
+            items:
+              - key: applicationsetcontroller.profile.enabled
+                path: profiler.enabled
       {{- with .Values.applicationSet.dnsConfig }}
       dnsConfig:
         {{- toYaml . | nindent 8 }}

charts/argo-cd/templates/argocd-applicationset/role.yaml

@@ -75,15 +75,22 @@ rules:
     - get
     - list
     - watch
+  # argocd-applicationset-controller leader election rules
+  # Create with resourceNames fails, so use a separate rule for the lease creation
   - apiGroups:
     - coordination.k8s.io
     resources:
     - leases
     verbs:
     - create
-    - delete
+  - apiGroups:
+    - coordination.k8s.io
+    resources:
+    - leases
+    resourceNames:
+    # Defined in `cmd/argocd-applicationset-controller/commands/applicationset_controller.go`
+    - 58ac56fa.applicationsets.argoproj.io
+    verbs:
     - get
-    - list
-    - patch
     - update
-    - watch
+    - create

charts/argo-cd/templates/crds/crd-application.yaml

@@ -121,6 +121,10 @@ spec:
                       a failed sync. If set to 0, no retries will be performed.
                     format: int64
                     type: integer
+                  refresh:
+                    description: 'Refresh indicates if the latest revision should
+                      be used on retry instead of the initial one (default: false)'
+                    type: boolean
                 type: object
               sync:
                 description: Sync contains parameters for the operation
@@ -1485,11 +1489,15 @@ spec:
                       path:
                         description: |-
                           Path is a directory path within the git repository where hydrated manifests should be committed to and synced
-                          from. If hydrateTo is set, this is just the path from which hydrated manifests will be synced.
+                          from. The Path should never point to the root of the repo. If hydrateTo is set, this is just the path from which
+                          hydrated manifests will be synced.
+                        minLength: 1
+                        pattern: ^.{2,}|[^./]$
                         type: string
                       targetBranch:
-                        description: TargetBranch is the branch to which hydrated
-                          manifests should be committed
+                        description: |-
+                          TargetBranch is the branch from which hydrated manifests will be synced.
+                          If HydrateTo is not set, this is also the branch to which hydrated manifests are committed.
                         type: string
                     required:
                     - path
@@ -1948,6 +1956,10 @@ spec:
                           a failed sync. If set to 0, no retries will be performed.
                         format: int64
                         type: integer
+                      refresh:
+                        description: 'Refresh indicates if the latest revision should
+                          be used on retry instead of the initial one (default: false)'
+                        type: boolean
                     type: object
                   syncOptions:
                     description: Options allow you to specify whole app sync-options
@@ -2916,6 +2928,11 @@ spec:
                               be performed.
                             format: int64
                             type: integer
+                          refresh:
+                            description: 'Refresh indicates if the latest revision
+                              should be used on retry instead of the initial one (default:
+                              false)'
+                            type: boolean
                         type: object
                       sync:
                         description: Sync contains parameters for the operation
@@ -4888,11 +4905,15 @@ spec:
                               path:
                                 description: |-
                                   Path is a directory path within the git repository where hydrated manifests should be committed to and synced
-                                  from. If hydrateTo is set, this is just the path from which hydrated manifests will be synced.
+                                  from. The Path should never point to the root of the repo. If hydrateTo is set, this is just the path from which
+                                  hydrated manifests will be synced.
+                                minLength: 1
+                                pattern: ^.{2,}|[^./]$
                                 type: string
                               targetBranch:
-                                description: TargetBranch is the branch to which hydrated
-                                  manifests should be committed
+                                description: |-
+                                  TargetBranch is the branch from which hydrated manifests will be synced.
+                                  If HydrateTo is not set, this is also the branch to which hydrated manifests are committed.
                                 type: string
                             required:
                             - path
@@ -4967,11 +4988,15 @@ spec:
                               path:
                                 description: |-
                                   Path is a directory path within the git repository where hydrated manifests should be committed to and synced
-                                  from. If hydrateTo is set, this is just the path from which hydrated manifests will be synced.
+                                  from. The Path should never point to the root of the repo. If hydrateTo is set, this is just the path from which
+                                  hydrated manifests will be synced.
+                                minLength: 1
+                                pattern: ^.{2,}|[^./]$
                                 type: string
                               targetBranch:
-                                description: TargetBranch is the branch to which hydrated
-                                  manifests should be committed
+                                description: |-
+                                  TargetBranch is the branch from which hydrated manifests will be synced.
+                                  If HydrateTo is not set, this is also the branch to which hydrated manifests are committed.
                                 type: string
                             required:
                             - path
@@ -5900,4 +5925,3 @@ spec:
     storage: true
     subresources: {}
 {{- end }}
-