argocd Command Reference The API server is a gRPC REST server which exposes the API consumed by the Web UI CLI and CI CD systems This command runs API server in the foreground It can be configured by following options Synopsis Run the ArgoCD API server argocd server

Answer:
# `argocd-server` Command Reference

## argocd-server

Run the ArgoCD API server

### Synopsis

The API server is a gRPC/REST server which exposes the API consumed by the Web UI, CLI, and CI/CD systems.  This command runs API server in the foreground.  It can be configured by following options.

```
argocd-server [flags]
```

### Examples

```
  # Start the Argo CD API server with default settings
  $ argocd-server

  # Start the Argo CD API server on a custom port and enable tracing
  $ argocd-server --port 8888 --otlp-address localhost:4317
```

### Options

```
      --address string                                  Listen on given address (default "0.0.0.0")
      --api-content-types string                        Semicolon separated list of allowed content types for non GET api requests. Any content type is allowed if empty. (default "application/json")
      --app-state-cache-expiration duration             Cache expiration for app state (default 1h0m0s)
      --application-namespaces strings                  List of additional namespaces where application resources can be managed in
      --appset-allowed-scm-providers strings            The list of allowed custom SCM provider API URLs. This restriction does not apply to SCM or PR generators which do not accept a custom API URL. (Default: Empty = all)
      --appset-enable-new-git-file-globbing             Enable new globbing in Git files generator.
      --appset-enable-scm-providers                     Enable retrieving information from SCM providers, used by the SCM and PR generators (Default: true) (default true)
      --appset-scm-root-ca-path string                  Provide Root CA Path for self-signed TLS Certificates
      --as string                                       Username to impersonate for the operation
      --as-group stringArray                            Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
      --as-uid string                                   UID to impersonate for the operation
      --basehref string                                 Value for base href in index.html. Used if Argo CD is running behind reverse proxy under subpath different from / (default "/")
      --certificate-authority string                    Path to a cert file for the certificate authority
      --client-certificate string                       Path to a client certificate file for TLS
      --client-key string                               Path to a client key file for TLS
      --cluster string                                  The name of the kubeconfig cluster to use
      --connection-status-cache-expiration duration     Cache expiration for cluster/repo connection status (default 1h0m0s)
      --content-security-policy value                   Set Content-Security-Policy header in HTTP responses to value. To disable, set to "". (default "frame-ancestors 'self';")
      --context string                                  The name of the kubeconfig context to use
      --default-cache-expiration duration               Cache expiration default (default 24h0m0s)
      --dex-server string                               Dex server address (default "argocd-dex-server:5556")
      --dex-server-plaintext                            Use a plaintext client (non-TLS) to connect to dex server
      --dex-server-strict-tls                           Perform strict validation of TLS certificates when connecting to dex server
      --disable-auth                                    Disable client authentication
      --disable-compression                             If true, opt-out of response compression for all requests to the server
      --enable-gzip                                     Enable GZIP compression (default true)
      --enable-k8s-event none                           Enable ArgoCD to use k8s event. For disabling all events, set the value as none. (e.g --enable-k8s-event=none), For enabling specific events, set the value as `event reason`. (e.g --enable-k8s-event=StatusRefreshed,ResourceCreated) (default [all])
      --enable-proxy-extension                          Enable Proxy Extension feature
      --gloglevel int                                   Set the glog logging level
  -h, --help                                            help for argocd-server
      --insecure                                        Run server without TLS
      --insecure-skip-tls-verify                        If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
      --kubeconfig string                               Path to a kube config. Only required if out-of-cluster
      --logformat string                                Set the logging format. One of: text|json (default "text")
      --login-attempts-expiration duration              Cache expiration for failed login attempts (default 24h0m0s)
      --loglevel string                                 Set the logging level. One of: debug|info|warn|error (default "info")
      --metrics-address string                          Listen for metrics on given address (default "0.0.0.0")
      --metrics-port int                                Start metrics on given port (default 8083)
  -n, --namespace string                                If present, the namespace scope for this CLI request
      --oidc-cache-expiration duration                  Cache expiration for OIDC state (default 3m0s)
      --otlp-address string                             OpenTelemetry collector address to send traces to
      --otlp-attrs strings                              List of OpenTelemetry collector extra attrs when send traces, each attribute is separated by a colon(e.g. key:value)
      --otlp-headers stringToString                     List of OpenTelemetry collector extra headers sent with traces, headers are comma-separated key-value pairs(e.g. key1=value1,key2=value2) (default [])
      --otlp-insecure                                   OpenTelemetry collector insecure mode (default true)
      --password string                                 Password for basic authentication to the API server
      --port int                                        Listen on given port (default 8080)
      --proxy-url string                                If provided, this URL will be used to connect via proxy
      --redis string                                    Redis server hostname and port (e.g. argocd-redis:6379).
      --redis-ca-certificate string                     Path to Redis server CA certificate (e.g. /etc/certs/redis/ca.crt). If not specified, system trusted CAs will be used for server certificate validation.
      --redis-client-certificate string                 Path to Redis client certificate (e.g. /etc/certs/redis/client.crt).
      --redis-client-key string                         Path to Redis client key (e.g. /etc/certs/redis/client.crt).
      --redis-compress string                           Enable compression for data sent to Redis with the required compression algorithm. (possible values: gzip, none) (default "gzip")
      --redis-insecure-skip-tls-verify                  Skip Redis server certificate validation.
      --redis-use-tls                                   Use TLS when connecting to Redis.
      --redisdb int                                     Redis database.
      --repo-cache-expiration duration                  Cache expiration for repo state, incl. app lists, app details, manifest generation, revision meta-data (default 24h0m0s)
      --repo-server string                              Repo server address (default "argocd-repo-server:8081")
      --repo-server-default-cache-expiration duration   Cache expiration default (default 24h0m0s)
      --repo-server-plaintext                           Use a plaintext client (non-TLS) to connect to repository server
      --repo-server-redis string                        Redis server hostname and port (e.g. argocd-redis:6379).
      --repo-server-redis-ca-certificate string         Path to Redis server CA certificate (e.g. /etc/certs/redis/ca.crt). If not specified, system trusted CAs will be used for server certificate validation.
      --repo-server-redis-client-certificate string     Path to Redis client certificate (e.g. /etc/certs/redis/client.crt).
      --repo-server-redis-client-key string             Path to Redis client key (e.g. /etc/certs/redis/client.crt).
      --repo-server-redis-compress string               Enable compression for data sent to Redis with the required compression algorithm. (possible values: gzip, none) (default "gzip")
      --repo-server-redis-insecure-skip-tls-verify      Skip Redis server certificate validation.
      --repo-server-redis-use-tls                       Use TLS when connecting to Redis.
      --repo-server-redisdb int                         Redis database.
      --repo-server-sentinel stringArray                Redis sentinel hostname and port (e.g. argocd-redis-ha-announce-0:6379).
      --repo-server-sentinelmaster string               Redis sentinel master group name. (default "master")
      --repo-server-strict-tls                          Perform strict validation of TLS certificates when connecting to repo server
      --repo-server-timeout-seconds int                 Repo server RPC call timeout seconds. (default 60)
      --request-timeout string                          The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
      --revision-cache-expiration duration              Cache expiration for cached revision (default 3m0s)
      --revision-cache-lock-timeout duration            Cache TTL for locks to prevent duplicate requests on revisions, set to 0 to disable (default 10s)
      --rootpath string                                 Used if Argo CD is running behind reverse proxy under subpath different from /
      --sentinel stringArray                            Redis sentinel hostname and port (e.g. argocd-redis-ha-announce-0:6379).
      --sentinelmaster string                           Redis sentinel master group name. (default "master")
      --server string                                   The address and port of the Kubernetes API server
      --staticassets string                             Directory path that contains additional static assets (default "/shared/app")
      --tls-server-name string                          If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
      --tlsciphers string                               The list of acceptable ciphers to be used when establishing TLS connections. Use 'list' to list available ciphers. (default "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384")
      --tlsmaxversion string                            The maximum SSL/TLS version that is acceptable (one of: 1.0|1.1|1.2|1.3) (default "1.3")
      --tlsminversion string                            The minimum SSL/TLS version that is acceptable (one of: 1.0|1.1|1.2|1.3) (default "1.2")
      --token string                                    Bearer token for authentication to the API server
      --user string                                     The name of the kubeconfig user to use
      --username string                                 Username for basic authentication to the API server
      --webhook-parallelism-limit int                   Number of webhook requests processed concurrently (default 50)
      --x-frame-options value                           Set X-Frame-Options header in HTTP responses to value. To disable, set to "". (default "sameorigin")
```

### SEE ALSO

* [argocd-server version](argocd-server_version.md)	 - Print version information

argocd server  Command Reference     argocd server  Run the ArgoCD API server      Synopsis  The API server is a gRPC REST server which exposes the API consumed by the Web UI  CLI  and CI CD systems   This command runs API server in the foreground   It can be configured by following options       argocd server  flags           Examples          Start the Argo CD API server with default settings     argocd server        Start the Argo CD API server on a custom port and enable tracing     argocd server   port 8888   otlp address localhost 4317          Options              address string                                  Listen on given address  default  0 0 0 0           api content types string                        Semicolon separated list of allowed content types for non GET api requests  Any content type is allowed if empty   default  application json           app state cache expiration duration             Cache expiration for app state  default 1h0m0s          application namespaces strings                  List of additional namespaces where application resources can be managed in         appset allowed scm providers strings            The list of allowed custom SCM provider API URLs  This restriction does not apply to SCM or PR generators which do not accept a custom API URL   Default  Empty   all          appset enable new git file globbing             Enable new globbing in Git files generator          appset enable scm providers                     Enable retrieving information from SCM providers  used by the SCM and PR generators  Default  true   default true          appset scm root ca path string                  Provide Root CA Path for self signed TLS Certificates         as string                                       Username to impersonate for the operation         as group stringArray                            Group to impersonate for the operation  this flag can be repeated to specify multiple groups          as uid string                                   UID to impersonate for the operation         basehref string                                 Value for base href in index html  Used if Argo CD is running behind reverse proxy under subpath different from    default              certificate authority string                    Path to a cert file for the certificate authority         client certificate string                       Path to a client certificate file for TLS         client key string                               Path to a client key file for TLS         cluster string                                  The name of the kubeconfig cluster to use         connection status cache expiration duration     Cache expiration for cluster repo connection status  default 1h0m0s          content security policy value                   Set Content Security Policy header in HTTP responses to value  To disable  set to      default  frame ancestors  self             context string                                  The name of the kubeconfig context to use         default cache expiration duration               Cache expiration default  default 24h0m0s          dex server string                               Dex server address  default  argocd dex server 5556           dex server plaintext                            Use a plaintext client  non TLS  to connect to dex server         dex server strict tls                           Perform strict validation of TLS certificates when connecting to dex server         disable auth                                    Disable client authentication         disable compression                             If true  opt out of response compression for all requests to the server         enable gzip                                     Enable GZIP compression  default true          enable k8s event none                           Enable ArgoCD to use k8s event  For disabling all events  set the value as none   e g   enable k8s event none   For enabling specific events  set the value as  event reason    e g   enable k8s event StatusRefreshed ResourceCreated   default  all           enable proxy extension                          Enable Proxy Extension feature         gloglevel int                                   Set the glog logging level    h    help                                            help for argocd server         insecure                                        Run server without TLS         insecure skip tls verify                        If true  the server s certificate will not be checked for validity  This will make your HTTPS connections insecure         kubeconfig string                               Path to a kube config  Only required if out of cluster         logformat string                                Set the logging format  One of  text json  default  text           login attempts expiration duration              Cache expiration for failed login attempts  default 24h0m0s          loglevel string                                 Set the logging level  One of  debug info warn error  default  info           metrics address string                          Listen for metrics on given address  default  0 0 0 0           metrics port int                                Start metrics on given port  default 8083     n    namespace string                                If present  the namespace scope for this CLI request         oidc cache expiration duration                  Cache expiration for OIDC state  default 3m0s          otlp address string                             OpenTelemetry collector address to send traces to         otlp attrs strings                              List of OpenTelemetry collector extra attrs when send traces  each attribute is separated by a colon e g  key value          otlp headers stringToString                     List of OpenTelemetry collector extra headers sent with traces  headers are comma separated key value pairs e g  key1 value1 key2 value2   default             otlp insecure                                   OpenTelemetry collector insecure mode  default true          password string                                 Password for basic authentication to the API server         port int                                        Listen on given port  default 8080          proxy url string                                If provided  this URL will be used to connect via proxy         redis string                                    Redis server hostname and port  e g  argocd redis 6379            redis ca certificate string                     Path to Redis server CA certificate  e g   etc certs redis ca crt   If not specified  system trusted CAs will be used for server certificate validation          redis client certificate string                 Path to Redis client certificate  e g   etc certs redis client crt           redis client key string                         Path to Redis client key  e g   etc certs redis client crt           redis compress string                           Enable compression for data sent to Redis with the required compression algorithm   possible values  gzip  none   default  gzip           redis insecure skip tls verify                  Skip Redis server certificate validation          redis use tls                                   Use TLS when connecting to Redis           redisdb int                                     Redis database          repo cache expiration duration                  Cache expiration for repo state  incl  app lists  app details  manifest generation  revision meta data  default 24h0m0s          repo server string                              Repo server address  default  argocd repo server 8081           repo server default cache expiration duration   Cache expiration default  default 24h0m0s          repo server plaintext                           Use a plaintext client  non TLS  to connect to repository server         repo server redis string                        Redis server hostname and port  e g  argocd redis 6379            repo server redis ca certificate string         Path to Redis server CA certificate  e g   etc certs redis ca crt   If not specified  system trusted CAs will be used for server certificate validation          repo server redis client certificate string     Path to Redis client certificate  e g   etc certs redis client crt           repo server redis client key string             Path to Redis client key  e g   etc certs redis client crt           repo server redis compress string               Enable compression for data sent to Redis with the required compression algorithm   possible values  gzip  none   default  gzip           repo server redis insecure skip tls verify      Skip Redis server certificate validation          repo server redis use tls                       Use TLS when connecting to Redis           repo server redisdb int                         Redis database          repo server sentinel stringArray                Redis sentinel hostname and port  e g  argocd redis ha announce 0 6379            repo server sentinelmaster string               Redis sentinel master group name   default  master           repo server strict tls                          Perform strict validation of TLS certificates when connecting to repo server         repo server timeout seconds int                 Repo server RPC call timeout seconds   default 60          request timeout string                          The length of time to wait before giving up on a single server request  Non zero values should contain a corresponding time unit  e g  1s  2m  3h   A value of zero means don t timeout requests   default  0           revision cache expiration duration              Cache expiration for cached revision  default 3m0s          revision cache lock timeout duration            Cache TTL for locks to prevent duplicate requests on revisions  set to 0 to disable  default 10s          rootpath string                                 Used if Argo CD is running behind reverse proxy under subpath different from           sentinel stringArray                            Redis sentinel hostname and port  e g  argocd redis ha announce 0 6379            sentinelmaster string                           Redis sentinel master group name   default  master           server string                                   The address and port of the Kubernetes API server         staticassets string                             Directory path that contains additional static assets  default   shared app           tls server name string                          If provided  this name will be used to validate server certificate  If this is not provided  hostname used to contact the server is used          tlsciphers string                               The list of acceptable ciphers to be used when establishing TLS connections  Use  list  to list available ciphers   default  TLS ECDHE RSA WITH AES 256 GCM SHA384           tlsmaxversion string                            The maximum SSL TLS version that is acceptable  one of  1 0 1 1 1 2 1 3   default  1 3           tlsminversion string                            The minimum SSL TLS version that is acceptable  one of  1 0 1 1 1 2 1 3   default  1 2           token string                                    Bearer token for authentication to the API server         user string                                     The name of the kubeconfig user to use         username string                                 Username for basic authentication to the API server         webhook parallelism limit int                   Number of webhook requests processed concurrently  default 50          x frame options value                           Set X Frame Options header in HTTP responses to value  To disable  set to      default  sameorigin            SEE ALSO     argocd server version  argocd server version md     Print version information


argocd Known Issues Argo CD 2 4 0 introduced a breaking API change renaming the filter to v2 4 to 2 5 Impact to API clients Broken filter before 2 5 15

Answer:
# v2.4 to 2.5

## Known Issues

### Broken `project` filter before 2.5.15

Argo CD 2.4.0 introduced a breaking API change, renaming the `project` filter to `projects`.

#### Impact to API clients

A similar issue applies to other API clients which communicate with the Argo CD API server via its REST API. If the
client uses the `project` field to filter projects, the filter will not be applied. **The failing project filter could
have detrimental consequences if, for example, you rely on it to list Applications to be deleted.**

#### Impact to CLI clients

CLI clients older that v2.4.0 rely on client-side filtering and are not impacted by this bug.

#### How to fix the problem

Upgrade to Argo CD >=2.4.27, >=2.5.15, or >=2.6.6. This version of Argo CD will accept both `project` and `projects` as
valid filters.

### Broken matrix-nested git files generator in 2.5.14

Argo CD 2.5.14 introduced a bug in the matrix-nested git files generator. The bug only applies when the git files
generator is the second generator nested under a matrix. For example:

```yaml
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: guestbook
spec:
  generators:
  - matrix:
      generators:
        - clusters: {}
        - git:
            repoURL: https://git.example.com/org/repo.git
            revision: HEAD
            files:
              - path: "defaults/*.yaml"
  template:
    # ...
```

The nested git files generator will produce no parameters, causing the matrix generator to also produce no parameters.
This will cause the ApplicationSet to produce no Applications. If the ApplicationSet controller is
[configured with the ability to delete applications](https://argo-cd.readthedocs.io/en/latest/operator-manual/applicationset/Controlling-Resource-Modification/),
it will delete all Applications which were previously created by the ApplicationSet.

To avoid this issue, upgrade directly to >=2.5.15 or >= 2.6.6.

## Configure RBAC to account for new `applicationsets` resource

2.5 introduces a new `applicationsets` [RBAC resource](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-resources-and-actions).

When you upgrade to 2.5, RBAC policies with `*` in the resource field and `create`, `update`, `delete`, `get`, or `*` in the action field will automatically grant the `applicationsets` privilege.

To avoid granting the new privilege, replace the existing policy with a list of new policies explicitly listing the old resources.

### Example

Old:

```csv
p, role:org-admin, *, create, *, allow
```

New:

```csv
p, role:org-admin, clusters,     create, *, allow
p, role:org-admin, projects,     create, *, allow
p, role:org-admin, applications, create, *, allow
p, role:org-admin, repositories, create, *, allow
p, role:org-admin, certificates, create, *, allow
p, role:org-admin, accounts,     create, *, allow
p, role:org-admin, gpgkeys,      create, *, allow
p, role:org-admin, exec,         create, *, allow
```

(Note that `applicationsets` is missing from the list, to preserve pre-2.5 permissions.)

## argocd-cm plugins (CMPs) are deprecated

Starting with Argo CD v2.5, installing config management plugins (CMPs) via the `argocd-cm` ConfigMap is deprecated.
Support will be removed in v2.7.

You can continue to use the plugins by [installing them as sidecars](https://argo-cd.readthedocs.io/en/stable/user-guide/config-management-plugins/)
on the repo-server Deployment.

Sidecar plugins are significantly more secure. Plugin code runs in its own container with an almost completely-isolated
filesystem. If an attacker compromises a plugin, the attacker's ability to cause harm is significantly mitigated.

To determine whether argocd-cm plugins are still in use, scan your argocd-repo-server and argocd-server logs for the
following message:

> argocd-cm plugins are deprecated, and support will be removed in v2.6. Upgrade your plugin to be installed via sidecar. https://argo-cd.readthedocs.io/en/stable/user-guide/config-management-plugins/

**NOTE:** removal of argocd-cm plugin support was delayed to v2.7. Update your logs scan to use `v2.7` instead of `v2.6`.

If you run `argocd app list` as admin, the list of Applications using deprecated plugins will be logged as a warning.

## Dex server TLS configuration

In order to secure the communications between the dex server and the Argo CD API server, TLS is now enabled by default on the dex server.

By default, without configuration, the dex server will generate a self-signed certificate upon startup. However, we recommend that users
configure their own TLS certificate using the `argocd-dex-server-tls` secret. Please refer to the [TLS configuration guide](../tls.md#configuring-tls-to-argocd-dex-server) for more information.

## Invalid users.session.duration values now fall back to 24h

Before v2.5, an invalid `users.session.duration` value in argocd-cm would 1) log a warning and 2) result in user sessions having no duration limit.

Starting with v2.5, invalid duration values will fall back to the default value of 24 hours with a warning.

## Out-of-bounds symlinks now blocked at fetch

There have been several path traversal and identification vulnerabilities disclosed in the past related to symlinks. To help prevent any further vulnerabilities, we now scan all repositories and Helm charts for **out of bounds symlinks** at the time they are fetched and block further processing if they are found.

An out-of-bounds symlink is defined as any symlink that leaves the root of the Git repository or Helm chart, even if the final target is within the root.

If an out of bounds symlink is found, a warning will be printed to the repo server console and an error will be shown in the UI or CLI.

Below is an example directory structure showing valid symlinks and invalid symlinks.

```
chart
├── Chart.yaml
├── values
│   └── values.yaml
├── bad-link.yaml   -> ../out-of-bounds.yaml       # Blocked
├── bad-link-2.yaml -> ../chart/values/values.yaml # Blocked because it leaves the root
├── bad-link-3.yaml -> /absolute/link.yaml         # Blocked
└── good-link.yaml  -> values/values.yaml          # OK
```

If you rely on out of bounds symlinks, this check can be disabled one of three ways:

1. The `--allow-oob-symlinks` argument on the repo server.
2. The `reposerver.allow.oob.symlinks` key if you are using `argocd-cmd-params-cm`
3. Directly setting `ARGOCD_REPO_SERVER_ALLOW_OOB_SYMLINKS` environment variable on the repo server.

It is **strongly recommended** to leave this check enabled. Disabling the check will not allow _all_ out-of-bounds symlinks. Those will still be blocked for things like values files in Helm charts, but symlinks which are not explicitly blocked by other checks will be allowed.

## Deprecated client-side manifest diffs

When using `argocd app diff --local`, code from the repo server is run on the user's machine in order to locally generate manifests for comparing against the live manifests of an app. However, this requires that the necessary tools (Helm, Kustomize, etc) are installed with the correct versions. Even worse, it does not support Config Management Plugins (CMPs) whatsoever.

In order to support CMPs and reduce local requirements, we have implemented *server-side generation* of local manifests via the `--server-side-generate` argument. For example, `argocd app diff --local repoDir --server-side-generate` will upload the contents of `repoDir` to the repo server and run your manifest generation pipeline against it, the same as it would for a Git repo.

In v2.7, the `--server-side-generate` argument will become the default, and client-side generation will be supported as an alternative.

!!! warning
    The semantics of *where* Argo will start generating manifests within a repo has changed between client-side and server-side generation. With client-side generation, the application's path (`spec.source.path`) was ignored and the value of `--local-repo-root` was effectively used (by default `/` relative to `--local`).

    For example, given an application that has an application path of `/manifests`, you would have had to run `argocd app diff --local yourRepo/manifests`. This behavior did not match the repo server's process of downloading the full repo/chart and then beginning generation in the path specified in the application manifest.

    When switching to server-side generation, `--local` should point to the root of your repo *without* including your `spec.source.path`. This is especially important to keep in mind when `--server-side-generate` becomes the default in v2.7. Existing scripts utilizing `diff --local` may break in v2.7 if `spec.source.path` was not `/`.

## Upgraded Kustomize Version

The bundled Kustomize version has been upgraded from 4.4.1 to 4.5.7.

## Upgraded Helm Version

Note that bundled Helm version has been upgraded from 3.9.0 to 3.10.1.

## Upgraded HAProxy version

The HAProxy version in the HA manifests has been upgraded from 2.0.25 to 2.6.2. To read about the changes/improvements,
see the HAProxy major release announcements ([2.1.0](https://www.mail-archive.com/haproxy@formilux.org/msg35491.html),
[2.2.0](https://www.mail-archive.com/haproxy@formilux.org/msg37852.html),
[2.3.0](https://www.mail-archive.com/haproxy@formilux.org/msg38812.html),
[2.4.0](https://www.mail-archive.com/haproxy@formilux.org/msg40499.html),
[2.5.0](https://www.mail-archive.com/haproxy@formilux.org/msg41508.html), and
[2.6.0](https://www.mail-archive.com/haproxy@formilux.org/msg42371.html).

## Logs RBAC enforcement will remain opt-in

This note is just for clarity. No action is required.

We [expected](../upgrading/2.3-2.4.md#enable-logs-rbac-enforcement) to enable logs RBAC enforcement by default in 2.5.
We have decided not to do that in the 2.x series due to disruption for users of [Project Roles](../../user-guide/projects.md#project-roles).

## `argocd app create` for old CLI versions fails with API version >=2.5.16

Starting with Argo CD 2.5.16, the API returns `PermissionDenied` instead of `NotFound` for Application `GET` requests if
the Application does not exist.

The Argo CD CLI before versions starting with version 2.5.0-rc1 and before versions 2.5.16 and 2.6.7 does a `GET`
request before the `POST` request in `argocd app create`. The command does not gracefully handle the `PermissionDenied`
response and will therefore fail to create/update the Application.

To solve the issue, upgrade the CLI to at least 2.5.16, or 2.6.7.

CLIs older than 2.5.0-rc1 are unaffected.

## Golang upgrade in 2.5.20

In 2.5.20, we upgrade the Golang version used to build Argo CD from 1.18 to 1.19. If you use Argo CD as a library, you
may need to upgrade your Go version.

v2 4 to 2 5     Known Issues      Broken  project  filter before 2 5 15  Argo CD 2 4 0 introduced a breaking API change  renaming the  project  filter to  projects         Impact to API clients  A similar issue applies to other API clients which communicate with the Argo CD API server via its REST API  If the client uses the  project  field to filter projects  the filter will not be applied    The failing project filter could have detrimental consequences if  for example  you rely on it to list Applications to be deleted          Impact to CLI clients  CLI clients older that v2 4 0 rely on client side filtering and are not impacted by this bug        How to fix the problem  Upgrade to Argo CD   2 4 27    2 5 15  or   2 6 6  This version of Argo CD will accept both  project  and  projects  as valid filters       Broken matrix nested git files generator in 2 5 14  Argo CD 2 5 14 introduced a bug in the matrix nested git files generator  The bug only applies when the git files generator is the second generator nested under a matrix  For example      yaml apiVersion  argoproj io v1alpha1 kind  ApplicationSet metadata    name  guestbook spec    generators      matrix        generators            clusters               git              repoURL  https   git example com org repo git             revision  HEAD             files                  path   defaults   yaml    template                 The nested git files generator will produce no parameters  causing the matrix generator to also produce no parameters  This will cause the ApplicationSet to produce no Applications  If the ApplicationSet controller is  configured with the ability to delete applications  https   argo cd readthedocs io en latest operator manual applicationset Controlling Resource Modification    it will delete all Applications which were previously created by the ApplicationSet   To avoid this issue  upgrade directly to   2 5 15 or    2 6 6      Configure RBAC to account for new  applicationsets  resource  2 5 introduces a new  applicationsets   RBAC resource  https   argo cd readthedocs io en stable operator manual rbac  rbac resources and actions    When you upgrade to 2 5  RBAC policies with     in the resource field and  create    update    delete    get   or     in the action field will automatically grant the  applicationsets  privilege   To avoid granting the new privilege  replace the existing policy with a list of new policies explicitly listing the old resources       Example  Old      csv p  role org admin     create     allow      New      csv p  role org admin  clusters      create     allow p  role org admin  projects      create     allow p  role org admin  applications  create     allow p  role org admin  repositories  create     allow p  role org admin  certificates  create     allow p  role org admin  accounts      create     allow p  role org admin  gpgkeys       create     allow p  role org admin  exec          create     allow       Note that  applicationsets  is missing from the list  to preserve pre 2 5 permissions       argocd cm plugins  CMPs  are deprecated  Starting with Argo CD v2 5  installing config management plugins  CMPs  via the  argocd cm  ConfigMap is deprecated  Support will be removed in v2 7   You can continue to use the plugins by  installing them as sidecars  https   argo cd readthedocs io en stable user guide config management plugins   on the repo server Deployment   Sidecar plugins are significantly more secure  Plugin code runs in its own container with an almost completely isolated filesystem  If an attacker compromises a plugin  the attacker s ability to cause harm is significantly mitigated   To determine whether argocd cm plugins are still in use  scan your argocd repo server and argocd server logs for the  following message     argocd cm plugins are deprecated  and support will be removed in v2 6  Upgrade your plugin to be installed via sidecar  https   argo cd readthedocs io en stable user guide config management plugins     NOTE    removal of argocd cm plugin support was delayed to v2 7  Update your logs scan to use  v2 7  instead of  v2 6    If you run  argocd app list  as admin  the list of Applications using deprecated plugins will be logged as a warning      Dex server TLS configuration  In order to secure the communications between the dex server and the Argo CD API server  TLS is now enabled by default on the dex server   By default  without configuration  the dex server will generate a self signed certificate upon startup  However  we recommend that users configure their own TLS certificate using the  argocd dex server tls  secret  Please refer to the  TLS configuration guide     tls md configuring tls to argocd dex server  for more information      Invalid users session duration values now fall back to 24h  Before v2 5  an invalid  users session duration  value in argocd cm would 1  log a warning and 2  result in user sessions having no duration limit   Starting with v2 5  invalid duration values will fall back to the default value of 24 hours with a warning      Out of bounds symlinks now blocked at fetch  There have been several path traversal and identification vulnerabilities disclosed in the past related to symlinks  To help prevent any further vulnerabilities  we now scan all repositories and Helm charts for   out of bounds symlinks   at the time they are fetched and block further processing if they are found   An out of bounds symlink is defined as any symlink that leaves the root of the Git repository or Helm chart  even if the final target is within the root   If an out of bounds symlink is found  a warning will be printed to the repo server console and an error will be shown in the UI or CLI   Below is an example directory structure showing valid symlinks and invalid symlinks       chart     Chart yaml     values         values yaml     bad link yaml         out of bounds yaml         Blocked     bad link 2 yaml       chart values values yaml   Blocked because it leaves the root     bad link 3 yaml     absolute link yaml           Blocked     good link yaml     values values yaml            OK      If you rely on out of bounds symlinks  this check can be disabled one of three ways   1  The    allow oob symlinks  argument on the repo server  2  The  reposerver allow oob symlinks  key if you are using  argocd cmd params cm  3  Directly setting  ARGOCD REPO SERVER ALLOW OOB SYMLINKS  environment variable on the repo server   It is   strongly recommended   to leave this check enabled  Disabling the check will not allow  all  out of bounds symlinks  Those will still be blocked for things like values files in Helm charts  but symlinks which are not explicitly blocked by other checks will be allowed      Deprecated client side manifest diffs  When using  argocd app diff   local   code from the repo server is run on the user s machine in order to locally generate manifests for comparing against the live manifests of an app  However  this requires that the necessary tools  Helm  Kustomize  etc  are installed with the correct versions  Even worse  it does not support Config Management Plugins  CMPs  whatsoever   In order to support CMPs and reduce local requirements  we have implemented  server side generation  of local manifests via the    server side generate  argument  For example   argocd app diff   local repoDir   server side generate  will upload the contents of  repoDir  to the repo server and run your manifest generation pipeline against it  the same as it would for a Git repo   In v2 7  the    server side generate  argument will become the default  and client side generation will be supported as an alternative       warning     The semantics of  where  Argo will start generating manifests within a repo has changed between client side and server side generation  With client side generation  the application s path   spec source path   was ignored and the value of    local repo root  was effectively used  by default     relative to    local             For example  given an application that has an application path of   manifests   you would have had to run  argocd app diff   local yourRepo manifests   This behavior did not match the repo server s process of downloading the full repo chart and then beginning generation in the path specified in the application manifest       When switching to server side generation     local  should point to the root of your repo  without  including your  spec source path   This is especially important to keep in mind when    server side generate  becomes the default in v2 7  Existing scripts utilizing  diff   local  may break in v2 7 if  spec source path  was not              Upgraded Kustomize Version  The bundled Kustomize version has been upgraded from 4 4 1 to 4 5 7      Upgraded Helm Version  Note that bundled Helm version has been upgraded from 3 9 0 to 3 10 1      Upgraded HAProxy version  The HAProxy version in the HA manifests has been upgraded from 2 0 25 to 2 6 2  To read about the changes improvements  see the HAProxy major release announcements   2 1 0  https   www mail archive com haproxy formilux org msg35491 html    2 2 0  https   www mail archive com haproxy formilux org msg37852 html    2 3 0  https   www mail archive com haproxy formilux org msg38812 html    2 4 0  https   www mail archive com haproxy formilux org msg40499 html    2 5 0  https   www mail archive com haproxy formilux org msg41508 html   and  2 6 0  https   www mail archive com haproxy formilux org msg42371 html       Logs RBAC enforcement will remain opt in  This note is just for clarity  No action is required   We  expected     upgrading 2 3 2 4 md enable logs rbac enforcement  to enable logs RBAC enforcement by default in 2 5  We have decided not to do that in the 2 x series due to disruption for users of  Project Roles        user guide projects md project roles        argocd app create  for old CLI versions fails with API version   2 5 16  Starting with Argo CD 2 5 16  the API returns  PermissionDenied  instead of  NotFound  for Application  GET  requests if the Application does not exist   The Argo CD CLI before versions starting with version 2 5 0 rc1 and before versions 2 5 16 and 2 6 7 does a  GET   request before the  POST  request in  argocd app create   The command does not gracefully handle the  PermissionDenied   response and will therefore fail to create update the Application   To solve the issue  upgrade the CLI to at least 2 5 16  or 2 6 7   CLIs older than 2 5 0 rc1 are unaffected      Golang upgrade in 2 5 20  In 2 5 20  we upgrade the Golang version used to build Argo CD from 1 18 to 1 19  If you use Argo CD as a library  you may need to upgrade your Go version


argocd Argo CD Notifications and ApplicationSet Are Bundled into Argo CD remove references to https github com argoproj labs argocd notifications and https github com argoproj labs applicationset The Argo CD Notifications and ApplicationSet are part of Argo CD now You no longer need to install them separately v2 2 to 2 3 The bundled manifests are drop in replacements for the previous versions If you are using Kustomize to bundle the manifests together then just The Notifications and ApplicationSet components are bundled into default Argo CD installation manifests

Answer:
# v2.2 to 2.3

## Argo CD Notifications and ApplicationSet Are Bundled into Argo CD

The Argo CD Notifications and ApplicationSet are part of Argo CD now. You no longer need to install them separately.
The Notifications and ApplicationSet components are bundled into default Argo CD installation manifests.

The bundled manifests are drop-in replacements for the previous versions. If you are using Kustomize to bundle the manifests together then just
remove references to https://github.com/argoproj-labs/argocd-notifications and https://github.com/argoproj-labs/applicationset.

If you are using [the argocd-notifications helm chart](https://github.com/argoproj/argo-helm/tree/argocd-notifications-1.8.1/charts/argocd-notifications), you can move the chart [values](https://github.com/argoproj/argo-helm/blob/argocd-notifications-1.8.1/charts/argocd-notifications/values.yaml) to the `notifications` section of the argo-cd chart [values](https://github.com/argoproj/argo-helm/blob/main/charts/argo-cd/values.yaml#L2152). Although most values remain as is, for details please look up the values that are relevant to you.

No action is required if you are using `kubectl apply`.

## Configure Additional Argo CD Binaries

We have removed non-Linux Argo CD binaries (Darwin amd64 and Windows amd64) from the image ([#7668](https://github.com/argoproj/argo-cd/pull/7668)) and the associated download buttons in the help page in the UI.

Those removed binaries will still be included in the release assets and we made those configurable in [#7755](https://github.com/argoproj/argo-cd/pull/7755). You can add download buttons for other OS architectures by adding the following to your `argocd-cm` ConfigMap:

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
data:
  help.download.linux-arm64: "path-or-url-to-download"
  help.download.darwin-amd64: "path-or-url-to-download"
  help.download.darwin-arm64: "path-or-url-to-download"
  help.download.windows-amd64: "path-or-url-to-download"
```

## Removed Python from the base image

If you are using a [Config Management Plugin](../config-management-plugins.md) that relies on Python, you
will need to build a custom image on the Argo CD base to install Python.

## Upgraded Kustomize Version

Note that bundled Kustomize version has been upgraded from 4.2.0 to 4.4.1.

## Upgraded Helm Version

Note that bundled Helm version has been upgraded from 3.7.1 to 3.8.0.

## Support for private repo SSH keys using the SHA-1 signature hash algorithm is removed in 2.3.7

Argo CD 2.3.7 upgraded its base image from Ubuntu 21.04 to Ubuntu 22.04, which upgraded OpenSSH to 8.9. OpenSSH starting
with 8.8 [dropped support for the `ssh-rsa` SHA-1 key signature algorithm](https://www.openssh.com/txt/release-8.8).

The signature algorithm is _not_ the same as the algorithm used when generating the key. There is no need to update
keys.

The signature algorithm is negotiated with the SSH server when the connection is being set up. The client offers its
list of accepted signature algorithms, and if the server has a match, the connection proceeds. For most SSH servers on
up-to-date git providers, acceptable algorithms other than `ssh-rsa` should be available.

Before upgrading to Argo CD 2.3.7, check whether your git provider(s) using SSH authentication support algorithms newer
than `rsa-ssh`.

1. Make sure your version of SSH >= 8.9 (the version used by Argo CD). If not, upgrade it before proceeding.

   ```shell
   ssh -V
   ```

   Example output: `OpenSSH_8.9p1 Ubuntu-3, OpenSSL 3.0.2 15 Mar 2022`

2. Once you have a recent version of OpenSSH, follow the directions from the [OpenSSH 8.8 release notes](https://www.openssh.com/txt/release-8.7):

   > To check whether a server is using the weak ssh-rsa public key
   > algorithm, for host authentication, try to connect to it after
   > removing the ssh-rsa algorithm from ssh(1)'s allowed list:
   >
   > ```shell
   > ssh -oHostKeyAlgorithms=-ssh-rsa user@host
   > ```
   >
   > If the host key verification fails and no other supported host key
   > types are available, the server software on that host should be
   > upgraded.

   If the server does not support an acceptable version, you will get an error similar to this;

   ```
   $ ssh -oHostKeyAlgorithms=-ssh-rsa vs-ssh.visualstudio.com
   Unable to negotiate with 20.42.134.1 port 22: no matching host key type found. Their offer: ssh-rsa
   ```

   This indicates that the server needs to update its supported key signature algorithms, and Argo CD will not connect
   to it.

### Workaround

The [OpenSSH 8.8 release notes](https://www.openssh.com/txt/release-8.8) describe a workaround if you cannot change the
server's key signature algorithms configuration.

> Incompatibility is more likely when connecting to older SSH
> implementations that have not been upgraded or have not closely tracked
> improvements in the SSH protocol. For these cases, it may be necessary
> to selectively re-enable RSA/SHA1 to allow connection and/or user
> authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
> options. For example, the following stanza in ~/.ssh/config will enable
> RSA/SHA1 for host and user authentication for a single destination host:
>
> ```
> Host old-host
>     HostkeyAlgorithms +ssh-rsa
>     PubkeyAcceptedAlgorithms +ssh-rsa
> ```
>
> We recommend enabling RSA/SHA1 only as a stopgap measure until legacy
> implementations can be upgraded or reconfigured with another key type
> (such as ECDSA or Ed25519).

To apply this to Argo CD, you could create a ConfigMap with the desired ssh config file and then mount it at
`/home/argocd/.ssh/config`.

v2 2 to 2 3     Argo CD Notifications and ApplicationSet Are Bundled into Argo CD  The Argo CD Notifications and ApplicationSet are part of Argo CD now  You no longer need to install them separately  The Notifications and ApplicationSet components are bundled into default Argo CD installation manifests   The bundled manifests are drop in replacements for the previous versions  If you are using Kustomize to bundle the manifests together then just remove references to https   github com argoproj labs argocd notifications and https   github com argoproj labs applicationset   If you are using  the argocd notifications helm chart  https   github com argoproj argo helm tree argocd notifications 1 8 1 charts argocd notifications   you can move the chart  values  https   github com argoproj argo helm blob argocd notifications 1 8 1 charts argocd notifications values yaml  to the  notifications  section of the argo cd chart  values  https   github com argoproj argo helm blob main charts argo cd values yaml L2152   Although most values remain as is  for details please look up the values that are relevant to you   No action is required if you are using  kubectl apply       Configure Additional Argo CD Binaries  We have removed non Linux Argo CD binaries  Darwin amd64 and Windows amd64  from the image    7668  https   github com argoproj argo cd pull 7668   and the associated download buttons in the help page in the UI   Those removed binaries will still be included in the release assets and we made those configurable in   7755  https   github com argoproj argo cd pull 7755   You can add download buttons for other OS architectures by adding the following to your  argocd cm  ConfigMap      yaml apiVersion  v1 kind  ConfigMap metadata    name  argocd cm   namespace  argocd   labels      app kubernetes io name  argocd cm     app kubernetes io part of  argocd data    help download linux arm64   path or url to download    help download darwin amd64   path or url to download    help download darwin arm64   path or url to download    help download windows amd64   path or url to download          Removed Python from the base image  If you are using a  Config Management Plugin     config management plugins md  that relies on Python  you will need to build a custom image on the Argo CD base to install Python      Upgraded Kustomize Version  Note that bundled Kustomize version has been upgraded from 4 2 0 to 4 4 1      Upgraded Helm Version  Note that bundled Helm version has been upgraded from 3 7 1 to 3 8 0      Support for private repo SSH keys using the SHA 1 signature hash algorithm is removed in 2 3 7  Argo CD 2 3 7 upgraded its base image from Ubuntu 21 04 to Ubuntu 22 04  which upgraded OpenSSH to 8 9  OpenSSH starting with 8 8  dropped support for the  ssh rsa  SHA 1 key signature algorithm  https   www openssh com txt release 8 8    The signature algorithm is  not  the same as the algorithm used when generating the key  There is no need to update keys   The signature algorithm is negotiated with the SSH server when the connection is being set up  The client offers its list of accepted signature algorithms  and if the server has a match  the connection proceeds  For most SSH servers on up to date git providers  acceptable algorithms other than  ssh rsa  should be available   Before upgrading to Argo CD 2 3 7  check whether your git provider s  using SSH authentication support algorithms newer than  rsa ssh    1  Make sure your version of SSH    8 9  the version used by Argo CD   If not  upgrade it before proceeding         shell    ssh  V            Example output   OpenSSH 8 9p1 Ubuntu 3  OpenSSL 3 0 2 15 Mar 2022   2  Once you have a recent version of OpenSSH  follow the directions from the  OpenSSH 8 8 release notes  https   www openssh com txt release 8 7         To check whether a server is using the weak ssh rsa public key      algorithm  for host authentication  try to connect to it after      removing the ssh rsa algorithm from ssh 1  s allowed list               shell      ssh  oHostKeyAlgorithms  ssh rsa user host                    If the host key verification fails and no other supported host key      types are available  the server software on that host should be      upgraded      If the server does not support an acceptable version  you will get an error similar to this               ssh  oHostKeyAlgorithms  ssh rsa vs ssh visualstudio com    Unable to negotiate with 20 42 134 1 port 22  no matching host key type found  Their offer  ssh rsa            This indicates that the server needs to update its supported key signature algorithms  and Argo CD will not connect    to it       Workaround  The  OpenSSH 8 8 release notes  https   www openssh com txt release 8 8  describe a workaround if you cannot change the server s key signature algorithms configuration     Incompatibility is more likely when connecting to older SSH   implementations that have not been upgraded or have not closely tracked   improvements in the SSH protocol  For these cases  it may be necessary   to selectively re enable RSA SHA1 to allow connection and or user   authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms   options  For example  the following stanza in    ssh config will enable   RSA SHA1 for host and user authentication for a single destination host            Host old host       HostkeyAlgorithms  ssh rsa       PubkeyAcceptedAlgorithms  ssh rsa           We recommend enabling RSA SHA1 only as a stopgap measure until legacy   implementations can be upgraded or reconfigured with another key type    such as ECDSA or Ed25519    To apply this to Argo CD  you could create a ConfigMap with the desired ssh config file and then mount it at   home argocd  ssh config


argocd Redis Upgraded to v6 2 1 However if you are running Argo CD in production with multiple users it is recommended to upgrade during off peak hours to avoid user visible failures The Redis itself should be able to upgrade with no downtime as well as Argo CD does not use it as a persistent store The bundled Redis version has been upgraded to v6 2 1 v1 8 to 2 0

Answer:
# v1.8 to 2.0

## Redis Upgraded to v6.2.1

The bundled Redis version has been upgraded to v6.2.1.

The Redis itself should be able to upgrade with no downtime, as well as Argo CD does not use it as a persistent store.
However, if you are running Argo CD in production with multiple users it is recommended to upgrade during off-peak
hours to avoid user-visible failures.

## Environment variables expansion

Argo CD supports using [environment variables](../../../user-guide/build-environment/) in
config management tools parameters. The expansion logic has been improved and now expands missing environment variables
into an empty string.

## Docker image migrated to use Ubuntu as base

The official Docker image has been migrated to use `ubuntu:20.10` instead of
`debian:10-slim` as base image. While this should not affect user experience,
you might be affected if you use custom-built images and/or include third party
tools in custom-built images.

Please make sure that your custom tools are still working with the update to
v2.0 before deploying it onto production.

## Container registry switched to quay.io and sundown of Docker Hub repository

Due to Docker Hub's new rate-limiting and retention policies, the Argo project
has decided to switch to the
[quay.io](https://quay.io)
registry as a new home for all images published by its sub-projects.

As of Argo CD version 2.0, the installation manifests are configured to pull the
container images from `quay.io` and we announce the **sundown** of the existing
Docker Hub repositories. For the 2.0 release this means, we will still push to
both registries, but we will stop pushing images to Docker Hub once Argo CD 2.1
has been released.

Please make sure that your clusters can pull from the `quay.io` registry.
If you aren't able to do so timely, you can change the container image slugs in
the installation manually to Docker Hub as a workaround to install Argo CD 2.0.
This workaround will not be possible anymore with 2.1, however.

## Dex tool migrated from argocd-util to argocd-dex

The dex commands `rundex` and `gendexcfg` have been migrated from `argocd-util` to `argocd-dex`.
It means that you need to update `argocd-dex-server` deployment's commands to install `argocd-dex`
binary instead of `argocd-util` in init container and run dex command from `argocd-dex` instead of `argocd-util`:

```bash
initContainers:
- command:
  - cp
  - -n
  - /usr/local/bin/argocd
  - /shared/argocd-dex
```

```bash
containers:
- command:
  - /shared/argocd-dex
  - rundex
```
Note that starting from v2.0 argocd binary behaviour has changed.
It will have all argocd binaries such `argocd-dex`, `argocd-server`, `argocd-repo-server`,
`argocd-application-controller`, `argocd-util`, `argocd` baked inside.
The binary will change behaviour based on its name.

## Updated retry params type from String to Duration for app sync

App Sync command exposes certain retry options, which allows the users to parameterize the sync retries.
Two of those params, `retry-backoff-duration` and `retry-backoff-max-duration` were declared as type `string` rather than `duration`.
This allowed users to provide the values to these flags without time unit (seconds, minutes, hours ...) or any random string as well,
but since we have migrated from `string` to `duration`, it is now mandatory for users to provide a unit (valid duration).

```bash
EXAMPLE:
argocd app sync <app-name> --retry-backoff-duration=10 -> invalid
argocd app sync <app-name> --retry-backoff-duration=10s -> valid
```

## Switch to Golang 1.16

The official Argo CD binaries are now being build using Go 1.16, making a jump
from the previous 1.14.x. Users should note that Go 1.15 introduced deprecation
of validating server names against the `CommonName` property of a certificate
when performing TLS connections.

If you have repository servers with an incompatible certificate, connections to
those servers might break. You will have to issue correct certificates to
unbreak such a situation.

## Migration of CRDs from apiextensions/v1beta1 to apiextensions/v1

Our CRDs (`Application` and `AppProject`) have been moved from the
deprecated `apiextensions/v1beta1` to the `apiextensions/v1` API group.

This does **not** affect the version of the CRDs themselves.

We do not expect that changes to existing CRs for `Application` and `AppProject`
are required from users, or that this change requires otherwise actions and this
note is just included for completeness.

## Helm v3 is now the default when rendering Charts

With this release, we made Helm v3 being the default version for rendering any
Helm charts through Argo CD. We also disabled the Helm version auto-detection
depending on the `apiVersion` field of the `Chart.yaml`, so the charts will
be rendered using Helm v3 regardless of what's in the Chart's `apiVersion`
field.

This can result in minor out-of-sync conditions on your Applications that were
previously rendered using Helm v2 (e.g. a change in one of the annotations that
Helm adds). You can fix this by syncing the Application.

If you have existing Charts that require to be rendered using Helm v2, you will
need to explicitly configure your Application to use Helm v2 for rendering the
chart, as described
[here](../../user-guide/helm.md#helm-version).

Please also note that Helm v2 is now being considered deprecated in Argo CD, as
it will not receive any updates from the upstream Helm project anymore. We will
still ship the Helm v2 binary for the next two releases, but it will be subject
to removal after that grace period.

Users are encouraged to upgrade any Charts that still require Helm v2 to be
compatible with Helm v3.

## Kustomize version updated to v3.9.4

Argo CD now ships with Kustomize v3.9.4 by default. Please make sure that your
manifests will render correctly with this Kustomize version.

If you need backwards compatibility to a previous version of Kustomize, please
consider setting up a custom Kustomize version and configure your Applications
to be rendered using that specific version.

v1 8 to 2 0     Redis Upgraded to v6 2 1  The bundled Redis version has been upgraded to v6 2 1   The Redis itself should be able to upgrade with no downtime  as well as Argo CD does not use it as a persistent store  However  if you are running Argo CD in production with multiple users it is recommended to upgrade during off peak hours to avoid user visible failures      Environment variables expansion  Argo CD supports using  environment variables           user guide build environment   in config management tools parameters  The expansion logic has been improved and now expands missing environment variables into an empty string      Docker image migrated to use Ubuntu as base  The official Docker image has been migrated to use  ubuntu 20 10  instead of  debian 10 slim  as base image  While this should not affect user experience  you might be affected if you use custom built images and or include third party tools in custom built images   Please make sure that your custom tools are still working with the update to v2 0 before deploying it onto production      Container registry switched to quay io and sundown of Docker Hub repository  Due to Docker Hub s new rate limiting and retention policies  the Argo project has decided to switch to the  quay io  https   quay io  registry as a new home for all images published by its sub projects   As of Argo CD version 2 0  the installation manifests are configured to pull the container images from  quay io  and we announce the   sundown   of the existing Docker Hub repositories  For the 2 0 release this means  we will still push to both registries  but we will stop pushing images to Docker Hub once Argo CD 2 1 has been released   Please make sure that your clusters can pull from the  quay io  registry  If you aren t able to do so timely  you can change the container image slugs in the installation manually to Docker Hub as a workaround to install Argo CD 2 0  This workaround will not be possible anymore with 2 1  however      Dex tool migrated from argocd util to argocd dex  The dex commands  rundex  and  gendexcfg  have been migrated from  argocd util  to  argocd dex   It means that you need to update  argocd dex server  deployment s commands to install  argocd dex   binary instead of  argocd util  in init container and run dex command from  argocd dex  instead of  argocd util       bash initContainers    command      cp      n      usr local bin argocd      shared argocd dex         bash containers    command       shared argocd dex     rundex     Note that starting from v2 0 argocd binary behaviour has changed   It will have all argocd binaries such  argocd dex    argocd server    argocd repo server     argocd application controller    argocd util    argocd  baked inside   The binary will change behaviour based on its name       Updated retry params type from String to Duration for app sync  App Sync command exposes certain retry options  which allows the users to parameterize the sync retries   Two of those params   retry backoff duration  and  retry backoff max duration  were declared as type  string  rather than  duration    This allowed users to provide the values to these flags without time unit  seconds  minutes  hours      or any random string as well   but since we have migrated from  string  to  duration   it is now mandatory for users to provide a unit  valid duration       bash EXAMPLE   argocd app sync  app name    retry backoff duration 10    invalid argocd app sync  app name    retry backoff duration 10s    valid         Switch to Golang 1 16  The official Argo CD binaries are now being build using Go 1 16  making a jump from the previous 1 14 x  Users should note that Go 1 15 introduced deprecation of validating server names against the  CommonName  property of a certificate when performing TLS connections   If you have repository servers with an incompatible certificate  connections to those servers might break  You will have to issue correct certificates to  unbreak such a situation      Migration of CRDs from apiextensions v1beta1 to apiextensions v1  Our CRDs   Application  and  AppProject   have been moved from the deprecated  apiextensions v1beta1  to the  apiextensions v1  API group   This does   not   affect the version of the CRDs themselves   We do not expect that changes to existing CRs for  Application  and  AppProject  are required from users  or that this change requires otherwise actions and this note is just included for completeness      Helm v3 is now the default when rendering Charts  With this release  we made Helm v3 being the default version for rendering any Helm charts through Argo CD  We also disabled the Helm version auto detection depending on the  apiVersion  field of the  Chart yaml   so the charts will be rendered using Helm v3 regardless of what s in the Chart s  apiVersion  field   This can result in minor out of sync conditions on your Applications that were previously rendered using Helm v2  e g  a change in one of the annotations that Helm adds   You can fix this by syncing the Application   If you have existing Charts that require to be rendered using Helm v2  you will need to explicitly configure your Application to use Helm v2 for rendering the chart  as described   here        user guide helm md helm version    Please also note that Helm v2 is now being considered deprecated in Argo CD  as it will not receive any updates from the upstream Helm project anymore  We will still ship the Helm v2 binary for the next two releases  but it will be subject to removal after that grace period   Users are encouraged to upgrade any Charts that still require Helm v2 to be compatible with Helm v3      Kustomize version updated to v3 9 4  Argo CD now ships with Kustomize v3 9 4 by default  Please make sure that your manifests will render correctly with this Kustomize version   If you need backwards compatibility to a previous version of Kustomize  please consider setting up a custom Kustomize version and configure your Applications to be rendered using that specific version


argocd Known Issues v2 3 to 2 4 Argo CD 2 4 0 introduced a breaking API change renaming the filter to Impact to API clients Broken filter before 2 4 27

Answer:
# v2.3 to 2.4

## Known Issues

### Broken `project` filter before 2.4.27

Argo CD 2.4.0 introduced a breaking API change, renaming the `project` filter to `projects`.

#### Impact to API clients

A similar issue applies to other API clients which communicate with the Argo CD API server via its REST API. If the
client uses the `project` field to filter projects, the filter will not be applied. **The failing project filter could
have detrimental consequences if, for example, you rely on it to list Applications to be deleted.**

#### Impact to CLI clients

CLI clients older that v2.4.0 rely on client-side filtering and are not impacted by this bug.

#### How to fix the problem

Upgrade to Argo CD >=2.4.27, >=2.5.15, or >=2.6.6. This version of Argo CD will accept both `project` and `projects` as
valid filters.

## KSonnet support is removed

Ksonnet was deprecated in [2019](https://github.com/ksonnet/ksonnet/pull/914/files) and is no longer maintained.
The time has come to remove it from the Argo CD.

## Helm 2 support is removed

Helm 2 has not been officially supported since [Nov 2020](https://helm.sh/blog/helm-2-becomes-unsupported/). In order to ensure a smooth transition,
Helm 2 support was preserved in the Argo CD. We feel that Helm 3 is stable, and it is time to drop Helm 2 support.

## Support for private repo SSH keys using the SHA-1 signature hash algorithm is removed

Note: this change was back-ported to 2.3.7 and 2.2.12.

Argo CD 2.4 upgraded its base image from Ubuntu 20.04 to Ubuntu 22.04, which upgraded OpenSSH to 8.9. OpenSSH starting
with 8.8 [dropped support for the `ssh-rsa` SHA-1 key signature algorithm](https://www.openssh.com/txt/release-8.8).

The signature algorithm is _not_ the same as the algorithm used when generating the key. There is no need to update
keys.

The signature algorithm is negotiated with the SSH server when the connection is being set up. The client offers its
list of accepted signature algorithms, and if the server has a match, the connection proceeds. For most SSH servers on
up-to-date git providers, acceptable algorithms other than `ssh-rsa` should be available.

Before upgrading to Argo CD 2.4, check whether your git provider(s) using SSH authentication support algorithms newer
than `rsa-ssh`.

1. Make sure your version of SSH >= 8.9 (the version used by Argo CD). If not, upgrade it before proceeding.

   ```shell
   ssh -V
   ```

   Example output: `OpenSSH_8.9p1 Ubuntu-3, OpenSSL 3.0.2 15 Mar 2022`

2. Once you have a recent version of OpenSSH, follow the directions from the [OpenSSH 8.8 release notes](https://www.openssh.com/txt/release-8.7):

   > To check whether a server is using the weak ssh-rsa public key
   > algorithm, for host authentication, try to connect to it after
   > removing the ssh-rsa algorithm from ssh(1)'s allowed list:
   >
   > ```shell
   > ssh -oHostKeyAlgorithms=-ssh-rsa user@host
   > ```
   >
   > If the host key verification fails and no other supported host key
   > types are available, the server software on that host should be
   > upgraded.

   If the server does not support an acceptable version, you will get an error similar to this;

   ```
   $ ssh -oHostKeyAlgorithms=-ssh-rsa vs-ssh.visualstudio.com
   Unable to negotiate with 20.42.134.1 port 22: no matching host key type found. Their offer: ssh-rsa
   ```

   This indicates that the server needs to update its supported key signature algorithms, and Argo CD will not connect
   to it.

### Workaround

The [OpenSSH 8.8 release notes](https://www.openssh.com/txt/release-8.8) describe a workaround if you cannot change the
server's key signature algorithms configuration.

> Incompatibility is more likely when connecting to older SSH
> implementations that have not been upgraded or have not closely tracked
> improvements in the SSH protocol. For these cases, it may be necessary
> to selectively re-enable RSA/SHA1 to allow connection and/or user
> authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
> options. For example, the following stanza in ~/.ssh/config will enable
> RSA/SHA1 for host and user authentication for a single destination host:
>
> ```
> Host old-host
>     HostkeyAlgorithms +ssh-rsa
>     PubkeyAcceptedAlgorithms +ssh-rsa
> ```
>
> We recommend enabling RSA/SHA1 only as a stopgap measure until legacy
> implementations can be upgraded or reconfigured with another key type
> (such as ECDSA or Ed25519).

To apply this to Argo CD, you could create a ConfigMap with the desired ssh config file and then mount it at
`/home/argocd/.ssh/config`.

## Configure RBAC to account for new `exec` resource

2.4 introduces a new `exec` [RBAC resource](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-resources-and-actions).

When you upgrade to 2.4, RBAC policies with `*` in the resource field and `create` or `*` in the action field will automatically grant the `exec` privilege.

To avoid granting the new privilege, replace the existing policy with a list of new policies explicitly listing the old resources.

The exec feature is [disabled by default](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#exec-resource),
but it is still a good idea to double-check your RBAC configuration to enforce least necessary privileges.

### Example

Old:

```csv
p, role:org-admin, *, create, my-proj/*, allow
```

New:

```csv
p, role:org-admin, clusters, create, my-proj/*, allow
p, role:org-admin, projects, create, my-proj/*, allow
p, role:org-admin, applications, create, my-proj/*, allow
p, role:org-admin, repositories, create, my-proj/*, allow
p, role:org-admin, certificates, create, my-proj/*, allow
p, role:org-admin, accounts, create, my-proj/*, allow
p, role:org-admin, gpgkeys, create, my-proj/*, allow
```

## Enable logs RBAC enforcement

2.4 introduced `logs` as a new RBAC resource. In 2.3, users with `applications, get` access automatically get logs
access. <del>In 2.5, you will have to explicitly grant `logs, get` access. Logs RBAC enforcement can be enabled with a flag
in 2.4. We recommend enabling the flag now for an easier upgrade experience in 2.5.</del>

!!! important
    Logs RBAC enforcement **will not** be enabled by default in 2.5. This decision
    [was made](https://github.com/argoproj/argo-cd/issues/10551#issuecomment-1242303457) to avoid breaking logs access
    under [Project Roles](../../user-guide/projects.md#project-roles), which do not provide a mechanism to grant `logs`
    resource access.

To enabled logs RBAC enforcement, add this to your argocd-cm ConfigMap:

```yaml
server.rbac.log.enforce.enable: "true"
```

If you want to allow the same users to continue to have logs access, just find every line that grants
`applications, get` access and also grant `logs, get`.

### Example

Old:

```csv
p, role:staging-db-admins, applications, get, staging-db-admins/*, allow

p, role:test-db-admins, applications, *, staging-db-admins/*, allow
```

New:

```csv
p, role:staging-db-admins, applications, get, staging-db-admins/*, allow
p, role:staging-db-admins, logs, get, staging-db-admins/*, allow

p, role:test-db-admins, applications, *, staging-db-admins/*, allow
p, role:test-db-admins, logs, get, staging-db-admins/*, allow
```

### Pod Logs UI

Since 2.4.9, the LOGS tab in pod view is visible in the UI only for users with explicit allow get logs policy.

### Known pod logs UI issue prior to 2.4.9

Upon pressing the "LOGS" tab in pod view by users who don't have an explicit allow get logs policy, the red "unable to load data: Internal error" is received in the bottom of the screen, and "Failed to load data, please try again" is displayed.

## Test repo-server with its new dedicated Service Account

As a security enhancement, the argocd-repo-server Deployment uses its own Service Account instead of `default`.

If you have a custom environment that might depend on repo-server using the `default` Service Account (such as a plugin
that uses the Service Account for auth), be sure to test before deploying the 2.4 upgrade to production.

## Plugins

### Remove the shared volume from any sidecar plugins

As a security enhancement, [sidecar plugins](../config-management-plugins.md#option-2-configure-plugin-via-sidecar)
no longer share the /tmp directory with the repo-server.

If you have one or more sidecar plugins enabled, replace the /tmp volume mount for each sidecar to use a volume specific
to each plugin.

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: argocd-repo-server
spec:
  template:
    spec:
      containers:
      - name: your-plugin-name
        volumeMounts:
        - mountPath: /tmp
          name: your-plugin-name-tmp
      volumes:
        # Add this volume.
        - name: your-plugin-name-tmp
          emptyDir: {}
```

### Update plugins to use newly-prefixed environment variables

If you use plugins that depend on user-supplied environment variables, then they must be updated to be compatible with
Argo CD 2.4. Here is an example of user-supplied environment variables in the `plugin` section of an Application spec:

```yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
spec:
  source:
    plugin:
      env:
        - name: FOO
          value: bar
```

Going forward, all user-supplied environment variables will be prefixed with `ARGOCD_ENV_` before being sent to the
plugin's `init`, `generate`, or `discover` commands. This prevents users from setting potentially-sensitive environment
variables.

If you have written a custom plugin which handles user-provided environment variables, update it to handle the new
prefix.

If you use a third-party plugin which does not explicitly advertise Argo CD 2.4 support, it might not handle the
prefixed environment variables. Open an issue with the plugin's authors and confirm support before upgrading to Argo CD
2.4.

### Confirm sidecar plugins have all necessary environment variables

A bug in < 2.4 caused `init` and `generate` commands to receive environment variables from the main repo-server
container, taking precedence over environment variables from the plugin's sidecar.

Starting in 2.4, sidecar plugins will not receive environment variables from the main repo-server container. Make sure
that any environment variables necessary for the sidecar plugin to function are set on the sidecar plugin.

argocd-cm plugins will continue to receive environment variables from the main repo-server container.

v2 3 to 2 4     Known Issues      Broken  project  filter before 2 4 27  Argo CD 2 4 0 introduced a breaking API change  renaming the  project  filter to  projects         Impact to API clients  A similar issue applies to other API clients which communicate with the Argo CD API server via its REST API  If the client uses the  project  field to filter projects  the filter will not be applied    The failing project filter could  have detrimental consequences if  for example  you rely on it to list Applications to be deleted          Impact to CLI clients  CLI clients older that v2 4 0 rely on client side filtering and are not impacted by this bug        How to fix the problem  Upgrade to Argo CD   2 4 27    2 5 15  or   2 6 6  This version of Argo CD will accept both  project  and  projects  as valid filters      KSonnet support is removed  Ksonnet was deprecated in  2019  https   github com ksonnet ksonnet pull 914 files  and is no longer maintained  The time has come to remove it from the Argo CD      Helm 2 support is removed  Helm 2 has not been officially supported since  Nov 2020  https   helm sh blog helm 2 becomes unsupported    In order to ensure a smooth transition  Helm 2 support was preserved in the Argo CD  We feel that Helm 3 is stable  and it is time to drop Helm 2 support      Support for private repo SSH keys using the SHA 1 signature hash algorithm is removed  Note  this change was back ported to 2 3 7 and 2 2 12   Argo CD 2 4 upgraded its base image from Ubuntu 20 04 to Ubuntu 22 04  which upgraded OpenSSH to 8 9  OpenSSH starting with 8 8  dropped support for the  ssh rsa  SHA 1 key signature algorithm  https   www openssh com txt release 8 8    The signature algorithm is  not  the same as the algorithm used when generating the key  There is no need to update  keys   The signature algorithm is negotiated with the SSH server when the connection is being set up  The client offers its  list of accepted signature algorithms  and if the server has a match  the connection proceeds  For most SSH servers on up to date git providers  acceptable algorithms other than  ssh rsa  should be available   Before upgrading to Argo CD 2 4  check whether your git provider s  using SSH authentication support algorithms newer than  rsa ssh    1  Make sure your version of SSH    8 9  the version used by Argo CD   If not  upgrade it before proceeding         shell    ssh  V               Example output   OpenSSH 8 9p1 Ubuntu 3  OpenSSL 3 0 2 15 Mar 2022   2  Once you have a recent version of OpenSSH  follow the directions from the  OpenSSH 8 8 release notes  https   www openssh com txt release 8 7         To check whether a server is using the weak ssh rsa public key      algorithm  for host authentication  try to connect to it after      removing the ssh rsa algorithm from ssh 1  s allowed list               shell      ssh  oHostKeyAlgorithms  ssh rsa user host                    If the host key verification fails and no other supported host key      types are available  the server software on that host should be      upgraded      If the server does not support an acceptable version  you will get an error similar to this               ssh  oHostKeyAlgorithms  ssh rsa vs ssh visualstudio com    Unable to negotiate with 20 42 134 1 port 22  no matching host key type found  Their offer  ssh rsa            This indicates that the server needs to update its supported key signature algorithms  and Argo CD will not connect    to it       Workaround  The  OpenSSH 8 8 release notes  https   www openssh com txt release 8 8  describe a workaround if you cannot change the  server s key signature algorithms configuration     Incompatibility is more likely when connecting to older SSH   implementations that have not been upgraded or have not closely tracked   improvements in the SSH protocol  For these cases  it may be necessary   to selectively re enable RSA SHA1 to allow connection and or user   authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms   options  For example  the following stanza in    ssh config will enable   RSA SHA1 for host and user authentication for a single destination host             Host old host       HostkeyAlgorithms  ssh rsa       PubkeyAcceptedAlgorithms  ssh rsa            We recommend enabling RSA SHA1 only as a stopgap measure until legacy   implementations can be upgraded or reconfigured with another key type    such as ECDSA or Ed25519    To apply this to Argo CD  you could create a ConfigMap with the desired ssh config file and then mount it at    home argocd  ssh config       Configure RBAC to account for new  exec  resource  2 4 introduces a new  exec   RBAC resource  https   argo cd readthedocs io en stable operator manual rbac  rbac resources and actions    When you upgrade to 2 4  RBAC policies with     in the resource field and  create  or     in the action field will automatically grant the  exec  privilege   To avoid granting the new privilege  replace the existing policy with a list of new policies explicitly listing the old resources   The exec feature is  disabled by default  https   argo cd readthedocs io en stable operator manual rbac  exec resource    but it is still a good idea to double check your RBAC configuration to enforce least necessary privileges       Example  Old      csv p  role org admin     create  my proj    allow      New      csv p  role org admin  clusters  create  my proj    allow p  role org admin  projects  create  my proj    allow p  role org admin  applications  create  my proj    allow p  role org admin  repositories  create  my proj    allow p  role org admin  certificates  create  my proj    allow p  role org admin  accounts  create  my proj    allow p  role org admin  gpgkeys  create  my proj    allow         Enable logs RBAC enforcement  2 4 introduced  logs  as a new RBAC resource  In 2 3  users with  applications  get  access automatically get logs access   del In 2 5  you will have to explicitly grant  logs  get  access  Logs RBAC enforcement can be enabled with a flag in 2 4  We recommend enabling the flag now for an easier upgrade experience in 2 5   del        important      Logs RBAC enforcement   will not   be enabled by default in 2 5  This decision       was made  https   github com argoproj argo cd issues 10551 issuecomment 1242303457  to avoid breaking logs access      under  Project Roles        user guide projects md project roles   which do not provide a mechanism to grant  logs      resource access   To enabled logs RBAC enforcement  add this to your argocd cm ConfigMap      yaml server rbac log enforce enable   true       If you want to allow the same users to continue to have logs access  just find every line that grants   applications  get  access and also grant  logs  get         Example  Old      csv p  role staging db admins  applications  get  staging db admins    allow  p  role test db admins  applications     staging db admins    allow      New      csv p  role staging db admins  applications  get  staging db admins    allow p  role staging db admins  logs  get  staging db admins    allow  p  role test db admins  applications     staging db admins    allow p  role test db admins  logs  get  staging db admins    allow          Pod Logs UI  Since 2 4 9  the LOGS tab in pod view is visible in the UI only for users with explicit allow get logs policy       Known pod logs UI issue prior to 2 4 9  Upon pressing the  LOGS  tab in pod view by users who don t have an explicit allow get logs policy  the red  unable to load data  Internal error  is received in the bottom of the screen  and  Failed to load data  please try again  is displayed      Test repo server with its new dedicated Service Account  As a security enhancement  the argocd repo server Deployment uses its own Service Account instead of  default    If you have a custom environment that might depend on repo server using the  default  Service Account  such as a plugin that uses the Service Account for auth   be sure to test before deploying the 2 4 upgrade to production      Plugins      Remove the shared volume from any sidecar plugins  As a security enhancement   sidecar plugins     config management plugins md option 2 configure plugin via sidecar  no longer share the  tmp directory with the repo server   If you have one or more sidecar plugins enabled  replace the  tmp volume mount for each sidecar to use a volume specific  to each plugin      yaml apiVersion  apps v1 kind  Deployment metadata    name  argocd repo server spec    template      spec        containers          name  your plugin name         volumeMounts            mountPath   tmp           name  your plugin name tmp       volumes            Add this volume            name  your plugin name tmp           emptyDir              Update plugins to use newly prefixed environment variables  If you use plugins that depend on user supplied environment variables  then they must be updated to be compatible with Argo CD 2 4  Here is an example of user supplied environment variables in the  plugin  section of an Application spec      yaml apiVersion  argoproj io v1alpha1 kind  Application spec    source      plugin        env            name  FOO           value  bar      Going forward  all user supplied environment variables will be prefixed with  ARGOCD ENV   before being sent to the  plugin s  init    generate   or  discover  commands  This prevents users from setting potentially sensitive environment variables   If you have written a custom plugin which handles user provided environment variables  update it to handle the new prefix   If you use a third party plugin which does not explicitly advertise Argo CD 2 4 support  it might not handle the  prefixed environment variables  Open an issue with the plugin s authors and confirm support before upgrading to Argo CD  2 4       Confirm sidecar plugins have all necessary environment variables  A bug in   2 4 caused  init  and  generate  commands to receive environment variables from the main repo server container  taking precedence over environment variables from the plugin s sidecar   Starting in 2 4  sidecar plugins will not receive environment variables from the main repo server container  Make sure that any environment variables necessary for the sidecar plugin to function are set on the sidecar plugin   argocd cm plugins will continue to receive environment variables from the main repo server container