Argo CD Reference¶

Scope

Look-up facts for Argo CD 3.x: release and support matrix, breaking default changes per minor, security advisories, components and ports, configuration keys, RBAC matrix, ApplicationSet generators, sync hooks, feature maturity, metrics, sizing figures, and the hardening checklist. For the reasons behind these facts see Explanation; for step-by-step tasks see How-to Guides.

Release and Support Matrix¶

Argo CD ships a minor release every quarter (first Tuesday of February, May, August, November) after a seven-week release-candidate feature freeze. Only the three most recent minor versions receive patch releases (bug and security fixes); older minors are EOL. Source: release process and cadence, SECURITY.md.

Minor	RC1 (planned)	GA (planned)	Latest patch (2026-09-25)	Support status (2026-09-25)
3.6	2026-09-15	2026-11-03	`3.6.0-rc1` (pre-release)	Release candidate
3.5	2026-06-16	2026-08-04	`3.5.3` (2026-09-14), the `stable` branch	Supported (current stable)
3.4	2026-03-16	2026-05-05	`3.4.9` (date TBD)	Supported
3.3	2025-12-15	2026-02-02	`3.3.14` (date TBD)	Supported until 3.6 GA
3.2	2025-09-15	2025-11-03	n/a	EOL since 3.5 GA
3.1	2025-06-16	2025-08-04	n/a	EOL
3.0	2025-03-17	2025-05-06	n/a	EOL
2.14	2024-12-16	2025-02-03	n/a	EOL (last 2.x minor)

How these values were verified

RC/GA dates are the project's published schedule ("actual release dates might differ from the plan by a few days"). Latest patch numbers come from the VERSION file on each release-3.x branch and on the stable branch (2026-09-25). The 3.5.3 date comes from the v3.5.3 GitHub release. Patch dates for 3.4.9 and 3.3.14 are TBD because GitHub release pages could not be fetched from the research environment.

Planned Future Releases¶

Minor	RC1	GA
3.7	2026-12-15	2027-02-02
3.8	2027-03-16	2027-05-04
3.9	2027-06-15	2027-08-03
4.0	2027-09-14	2027-11-02

Tested Kubernetes Versions¶

Argo CD	Kubernetes versions tested
3.5	1.36, 1.35, 1.34, 1.33
3.4	1.35, 1.34, 1.33, 1.32
3.3	1.35, 1.34, 1.33, 1.32

Source: tested-kubernetes-versions.md (release-3.5).

Bundled Tool Versions¶

Within a supported minor, Argo CD only takes patch upgrades of Helm, Kustomize and git (dependency upgrade policy).

Argo CD	Helm	Kustomize	Notes
3.5	4.2.1	5.8.1	First line on Helm 4; `spec.source.helm.version: v3` is ignored
3.3	3.19.2	5.8.0	Per 3.2 to 3.3 upgrade notes
3.1	3.18.4	5.7.0	Per 3.0 to 3.1 upgrade notes
3.0	3.17.1	n/a	Helm 3.17.1 changed `null` handling in subchart values

Breaking and Default Changes by Minor¶

3.0 (May 2025): New Defaults¶

Argo CD 3.0 was billed as a "low-risk upgrade containing only minor breaking changes", but it flipped several long-standing defaults. Source: v2.14 to 3.0 upgrade notes.

Change	2.x behaviour	3.0+ behaviour	Opt-out / remediation
Resource tracking	Label-based (`app.kubernetes.io/instance`)	Annotation-based (`argocd.argoproj.io/tracking-id`)	`application.resourceTrackingMethod: label` in `argocd-cm`
Fine-grained RBAC on `update`/`delete`	Also applied to the app's managed resources	Only applies to the Application itself; grant `update/`, `delete/` explicitly	`server.rbac.disableApplicationFineGrainedRBACInheritance: "false"`
Logs RBAC	Opt-in via `server.rbac.log.enforce.enable`	Always enforced; the flag is removed	Grant `p, <role>, logs, get, /, allow`
Default `resource.exclusions`	None	High-churn kinds excluded (`Endpoints`, `EndpointSlice`, `Lease`, access-review kinds, `CertificateSigningRequest`, Kyverno reports, Cilium identities/endpoints, cert-manager `CertificateRequest`)	Override `resource.exclusions` in `argocd-cm`
Dex RBAC subject	Dex `sub` claim	`federated_claims.user_id`	Rewrite policies that used the `sub` value
Legacy repo config in `argocd-cm`	`repositories`, `repository.credentials`, `helm.repositories` keys	Removed; use Secrets labelled `repository` / `repo-creds`	Migrate to Secrets before upgrading
Health in Application CR	Persisted per resource under `/status`	Stored externally (less controller churn)	`controller.resource.health.persist: "true"`
`ignoreDifferences`	Diff only	Also ignores resource updates for those fields	`ignoreDifferencesOnResourceUpdates: false`
Status field in diffs	Ignored for CRDs only	Ignored for all resources	`ignoreResourceStatusField` setting
ApplicationSet `applyNestedSelectors`	Honoured	Ignored (nested selectors always applied)	Review nested matrix/merge generators
Legacy metrics	`argocd_app_sync_status`, `argocd_app_health_status`, `argocd_app_created_time` (opt-in)	Removed; use labels on `argocd_app_info`	Update dashboards/alerts

3.1 to 3.6¶

Minor	Breaking / behavioural change	Source
3.1	v1 Actions API deprecated; OIDC PKCE authorization-code flow moved from the UI to the server; symlink protection for `--staticassets`	3.0 to 3.1
3.2	Source Hydrator paths must be non-root; Kustomize version in `.argocd-source.yaml` is respected; ApplicationSet `status.resources` capped at 5000 entries by default	3.1 to 3.2
3.3	ApplicationSet CRD exceeds the client-side apply size limit, so manifests must be applied with `kubectl apply --server-side --force-conflicts`; Source Hydrator tracks hydration state with git notes; `--self-heal-backoff-cooldown-seconds` deprecated; anonymous Settings API returns fewer fields	3.2 to 3.3
3.4	Cluster version stored as `vMajor.Minor.Patch` (also backported to 3.3.3), which affects cluster-generator selectors on `argocd.argoproj.io/kubernetes-version`; app health is `Missing` only when all resources are missing; gRPC DNS TXT service-config lookups disabled by default	3.3 to 3.4
3.5	Helm 4 (plain-HTTP OCI registries need `--insecure-oci-force-http`, including dependency registries); UI extensions must externalize `react/jsx-runtime`; event-listing gRPC methods return an `EventList`; GnuPG signature verification replaced by Source Integrity (`AppProject.spec.sourceIntegrity`); `--repo-server-strict-tls` deprecated in favour of `--repo-server-ca-cert-path`	3.4 to 3.5
3.6 (RC)	Repo-server OTLP env var renamed to `ARGOCD_REPO_SERVER_OTLP_HEADERS`; `ServerSideApply=true` now implies Server-Side Diff (Structured-Merge diff removed); `argocd app diff --local-include` defaults add `*.tpl`, `Chart.lock`	3.5 to 3.6 (master docs)

Feature Maturity (3.5)¶

Feature	Status	Since	Source
Source Hydrator (rendered-manifest pattern, commit-server)	Beta, disabled by default	Alpha in 2.14, Beta in 3.5	Source Hydrator docs
Sync impersonation (per-destination service accounts)	Beta	Beta in 3.5	Impersonation docs
ApplicationSet Progressive Syncs (`RollingSync`)	Beta	Beta in 3.3	Progressive Syncs
Repo-server mTLS	GA, opt-in (enabled when the `argocd-repo-server-mtls` Secret exists)	3.5	3.4 to 3.5 notes
Source Integrity (git GnuPG commit verification per AppProject)	Available; no UI	3.5	source-integrity.md
Controller sharding: `round-robin`, `consistent-hashing`	Alpha / experimental (`legacy` is default)	n/a	High availability
Applications in any namespace	Available, must be explicitly enabled	2.5	App in any namespace
Cluster reconciliation pause (`argocd.argoproj.io/skip-reconcile` on cluster Secret)	Available	3.4	Cluster management (release-3.4)
Argo CD Agent (`argoproj-labs/argocd-agent`)	Pre-GA (0.x), separate project	n/a	argocd-agent README

Security Advisories of Note¶

CVE	Severity	Issue	Affected	Fixed in
CVE-2026-42880	Critical, CVSS 3.1 9.6	ServerSideDiff lets a user with read-only Argo CD access extract plaintext Kubernetes Secret data through the SSA dry-run path	3.2.0 to 3.2.10, 3.3.0 to 3.3.8	3.2.11, 3.3.9
CVE-2026-43824	High, CVSS 3.1 7.7	Related ServerSideDiff issue that exposes cleartext Secret data to authenticated users	3.2.0 to 3.2.10, 3.3.0 to 3.3.8	3.2.11, 3.3.9
CVE-2025-55190	Critical (9.8 or 10.0 depending on source)	Project API tokens with `projects, get` could read repository usernames/passwords via `/api/v1/projects/{project}/detailed`	2.13.0 to 2.13.8, 2.14.0 to 2.14.15, 3.0.0 to 3.0.12, 3.1.0-rc1 to 3.1.1	2.13.9, 2.14.16, 3.0.14, 3.1.2

Sources: GitLab advisory CVE-2026-42880, Red Hat Bugzilla 2467882, SentinelOne CVE-2026-43824, GHSA-786q-9hcg-v9ff, Argo CD security advisories.

Advisory data caveats

CVE-2026-42880 and CVE-2026-43824 describe overlapping ServerSideDiff secret-exposure issues with the same affected ranges. Public trackers give different publication dates (2026-05-02 and 2026-05-07). Check the GitHub advisory list for the authoritative mapping. Separately, CVE-2026-82456 (CVSS 10, disclosed 2026-08-29) affects the community argocd-mcp 0.8.0 MCP server, not Argo CD itself. That information comes from a single source (TheHackerWire).

Components, Workloads and Ports¶

Ports are from the v3.5.3 install-with-hydrator.yaml manifest.

Component	Workload kind	Service port(s)	Purpose
`argocd-server`	Deployment	80/443 (container 8080), metrics 8083	API (gRPC + REST via grpc-gateway), web UI, SSO callbacks, webhooks
`argocd-repo-server`	Deployment	8081 (gRPC), metrics 8084	Clones Git/Helm/OCI sources, renders manifests
`argocd-application-controller`	StatefulSet	metrics 8082 (`argocd-metrics`)	Reconciliation, diff, sync, health
`argocd-applicationset-controller`	Deployment	webhook 7000, metrics 8080	Generates `Application` CRs from `ApplicationSet`
`argocd-notifications-controller`	Deployment	metrics 9001	Triggers and templates for Slack, Teams Workflows, email, webhooks
`argocd-dex-server`	Deployment	5556 (HTTP), 5557 (gRPC), 5558 (metrics)	Optional OIDC broker for SAML, LDAP, GitHub and other connectors
`argocd-redis` / `redis-ha` + HAProxy	Deployment / StatefulSet (HA)	6379	Cache; password auth via Secret `argocd-redis` key `auth`
`argocd-commit-server`	Deployment	8086, metrics 8087	Pushes hydrated manifests (only with the Source Hydrator)

CRDs: applications.argoproj.io, applicationsets.argoproj.io, appprojects.argoproj.io.

Configuration Objects¶

Object	Holds
`argocd-cm` (ConfigMap)	`url`, `oidc.config`, `dex.config`, `accounts.`, `admin.enabled`, `users.anonymous.enabled`, `timeout.reconciliation`, `resource.exclusions`, `resource.customizations.`, `application.resourceTrackingMethod`
`argocd-rbac-cm`	`policy.csv`, `policy.default`, `scopes`, `policy.matchMode`
`argocd-cmd-params-cm`	Component flags: `controller.`, `server.`, `reposerver.`, `applicationsetcontroller.`, `hydrator.enabled`, `redis.*`
`argocd-secret`	Admin bcrypt hash, server signing key, webhook secrets, SSO client secrets referenced as `$key`
`argocd-redis`	Redis password (`auth`)
`argocd-repo-server-mtls`	Optional repo-server mTLS material (`client-ca.crt`, `client.crt`, `client.key`), 3.5+
Secrets labelled `argocd.argoproj.io/secret-type`	`cluster`, `repository`, `repo-creds` (credential templates), `repository-write` (hydrator push credentials)

Tuning Parameters¶

Setting	Where	Default	Effect
`timeout.reconciliation` / `timeout.reconciliation.jitter`	`argocd-cm`	180s (3m)	Git polling interval for all apps
`controller.status.processors`	`argocd-cmd-params-cm`	20	Parallel app status refreshes
`controller.operation.processors`	`argocd-cmd-params-cm`	10	Parallel sync operations
`controller.kubectl.parallelism.limit`	`argocd-cmd-params-cm`	20	Concurrent kubectl/apply calls
`controller.sharding.algorithm`	`argocd-cmd-params-cm`	`legacy`	`legacy`, `round-robin` (alpha), `consistent-hashing` (alpha)
`ARGOCD_CONTROLLER_REPLICAS`	controller StatefulSet env	1	Must equal StatefulSet replicas when sharding
`controller.diff.server.side`	`argocd-cmd-params-cm`	`false`	Server-Side Diff for all apps
`controller.repo.server.timeout.seconds` / `server.repo.server.timeout.seconds`	`argocd-cmd-params-cm`	60	Timeout for manifest generation requests
`reposerver.parallelism.limit` (`--parallelismlimit`)	`argocd-cmd-params-cm`	0 (no limit)	Concurrent manifest generations; bounds memory
`reposerver.git.lsremote.parallelism.limit`	`argocd-cmd-params-cm`	0 (no limit)	Concurrent `git ls-remote` calls
`reposerver.git.request.timeout`	`argocd-cmd-params-cm`	15s	Git request timeout
`ARGOCD_EXEC_TIMEOUT`	repo-server env	90s	Timeout for `helm`/`kustomize`/plugin execution
`ARGOCD_GIT_ATTEMPTS_COUNT`	repo-server env	1	Retries for `git ls-remote`
`--repo-cache-expiration`	repo-server flag	24h	Rendered-manifest cache TTL in Redis
`redis.compression`	`argocd-cmd-params-cm`	`gzip`	Compression of cached data sent to Redis
`argocd.argoproj.io/manifest-generate-paths`	Application annotation	unset	Limits which repo paths trigger refresh (monorepos)

Sources: argocd-cmd-params-cm.yaml, High availability.

RBAC Resources and Actions¶

Policy syntax: p, <role/user/group>, <resource>, <action>, <object>, <effect> and g, <user/group>, <role>. Built-in roles: role:readonly, role:admin. policy.default applies to authenticated users; anonymous users only get it if users.anonymous.enabled: "true".

Resource	get	create	update	delete	sync	action	override	invoke
`applications`	yes	yes	yes	yes	yes	yes	yes	no
`applicationsets`	yes	yes	yes	yes	no	no	no	no
`clusters`, `projects`, `repositories`	yes	yes	yes	yes	no	no	no	no
`accounts`	yes	no	yes	no	no	no	no	no
`certificates`, `gpgkeys`	yes	yes	no	yes	no	no	no	no
`logs`	yes	no	no	no	no	no	no	no
`exec`	no	yes	no	no	no	no	no	no
`extensions`	no	no	no	no	no	no	no	yes

Source: RBAC configuration.

ApplicationSet Generators¶

Generator	Parameter source	Typical use
List	Literal key/value list	Fixed set of environments
Cluster	Argo CD cluster Secrets (label selectors)	Same add-on to every cluster
Git (directories / files)	Repo directory layout or JSON/YAML files	Monorepo: one app per folder or per config file
Matrix	Cartesian product of two generators	Clusters × apps
Merge	Base generator plus overriding generators	Per-cluster overrides
SCM Provider	Repos in a GitHub/GitLab/Bitbucket/Gitea/Azure DevOps org	Repo auto-discovery
Pull Request	Open PRs in a repo	Preview environments
Cluster Decision Resource	A custom resource's decision list (e.g. Open Cluster Management `PlacementDecision`)	External placement engines
Plugin	RPC to an HTTP service	Custom parameter sources

Source: Generators.

Sync Hooks and Annotations¶

Hook (`argocd.argoproj.io/hook`)	Runs
`PreSync`	Before manifests are applied
`Sync`	With the manifests, after all `PreSync` hooks succeed
`PostSync`	After a successful sync when all resources are `Healthy`
`SyncFail`	Only when the sync operation fails
`PreDelete`	Before an Application's resources are deleted (whole-app deletion only; a failing hook blocks deletion), 3.3+
`PostDelete`	After all Application resources are deleted, 2.10+
`Skip`	Never applied

Annotation	Purpose
`argocd.argoproj.io/sync-wave: "<int>"`	Ordering within a phase (lower first, default 0, may be negative)
`argocd.argoproj.io/hook-delete-policy`	`HookSucceeded`, `HookFailed`, `BeforeHookCreation`
`argocd.argoproj.io/sync-options`	e.g. `ServerSideApply=true`, `Prune=false`, `Replace=true`, `SkipDryRunOnMissingResource=true`
`argocd.argoproj.io/compare-options`	e.g. `ServerSideDiff=true`, `IgnoreExtraneous`
`argocd.argoproj.io/skip-reconcile: "true"`	On an Application (or, since 3.4, a cluster Secret): pause reconciliation

Source: Sync phases and waves.

Key Prometheus Metrics¶

Metric	Type	Exposed by	Use
`argocd_app_info`	gauge	controller	Labels `sync_status`, `health_status` per app
`argocd_app_reconcile`	histogram	controller	Reconciliation latency (`_bucket`, `_count`, `_sum`)
`argocd_app_sync_total`	counter	controller	Sync operations by `phase`
`argocd_app_k8s_request_total`	counter	controller	K8s API calls during reconciliation
`argocd_cluster_connection_status`	gauge	controller	Cluster reachability
`argocd_cluster_api_resource_objects`	gauge	controller	Objects in the cluster cache (memory driver)
`argocd_kubectl_exec_pending`	gauge	controller	Pending kubectl executions (saturation)
`argocd_git_request_total` / `argocd_git_request_duration_seconds`	counter / histogram	repo-server	Git fetch/ls-remote load and latency
`argocd_repo_pending_request_total`	gauge	repo-server	Requests waiting on a repository lock
`argocd_redis_request_duration`	histogram	several	Redis latency
`argocd_appset_reconcile`	histogram	ApplicationSet controller	Generator/reconcile latency

Source: Metrics.

Sizing and Benchmark Figures¶

Unsourced performance data

The tables below are rough, community-derived estimates with no documented test conditions (hardware, versions, methodology). Use them for order-of-magnitude planning only and benchmark your own workload. The best public benchmark with documented conditions is the CNOE study of controller sharding algorithms (CNOE blog).

Resource Requirements (estimates)¶

Deployment size	Apps	Clusters	Controller CPU / memory	Repo server CPU / memory
Small	< 50	1-3	500m / 512Mi	500m / 512Mi
Medium	50-200	3-10	2 / 2Gi	2 / 2Gi
Large	200-1000	10-50	4 / 4Gi (sharded)	4 / 4Gi (3 replicas)
Enterprise	1000+	50+	8 / 8Gi (multi-shard)	8 / 8Gi (5+ replicas)

Sync Performance (estimates)¶

Scenario	Apps	Clusters	Avg sync time	P95 sync time	Notes
Small deployment	50	3	2-5s	8s	Single controller
Medium deployment	200	10	5-15s	30s	Controller sharded x2
Large deployment	1000	50	10-30s	60s	Controller sharded x4
Monorepo (10k files)	100	5	30-60s	120s	Use `manifest-generate-paths` and webhooks

Controller Memory Scaling (estimates)¶

Controller memory tracks the number of objects in the cluster caches (argocd_cluster_api_resource_objects), not the number of Applications.

Managed resources	Controller memory	Controller CPU
1,000	~256Mi	~200m
5,000	~1Gi	~500m
20,000	~4Gi	~2000m
50,000	~8Gi	~4000m

Repo Server Operation Latency (estimates)¶

Operation	Small chart	Large chart (500+ templates)	Monorepo
Helm template	< 1s	5-15s	n/a
Kustomize build	< 1s	2-5s	10-30s
Git clone (cold)	1-3s	1-3s	30-120s
Git fetch (warm)	< 1s	< 1s	2-5s

Scaling Limits (estimates)¶

Dimension	Reported upper range	Conservative target	Bottleneck
Applications per controller shard	~5,000	2,000	Memory and reconciliation queue
Clusters per instance (classic hub)	~200	100	Watches and cache memory per cluster
Concurrent sync operations	n/a	`controller.operation.processors` (default 10)	Repo-server CPU, kube-apiserver
ApplicationSets	~500	200	Generator evaluation time, SCM API rate limits

Community figures not re-verified

Earlier versions of this page cited "Intuit manages 3,000+ applications", "the official scalability testing targets 1,000 apps / 100 clusters", and "Red Hat recommends max 300 apps per non-sharded instance". None of these could be traced to a primary source on 2026-09-25. Treat them as anecdotal.