Red Hat OpenShift GitOps release notes

Before this update, when using the dynamic scaling feature, application controller pods consumed high memory and clusters were not distributed properly across shards. This update ensures that clusters are distributed across shards. GITOPS-5811

Before this update, Argo CD could not obtain the appropriate transport layer security (TLS) certificate for Helm Open Container Initiative (OCI) registries when the URL included a path or port number. With this update, a fix is introduced in upstream Argo CD to correctly parse the URL and return a valid certificate. GITOPS-5081

Before this update, you could not log in to the Argo CD web console UI after a Red Hat OpenShift Service on an Amazon Web Services (AWS) cluster, that includes a GitOps Operator and an Argo CD instance configured with Dex-based SSO, resumed from hibernation. The login screen would display an error indicating an invalid redirect Uniform Resource Identifier (URI) in the Dex configuration. This update fixes the issue by ensuring that the correct Dex redirect URL is updated in the Argo CD configuration whenever a Argo CD server route is modified. GITOPS-4358

Before this update, the sync trigger for a webhook enabled on Bitbucket was not working, resulting in an application failing to refresh after a change. This update fixes the issue by modifying the functionality of the Red Hat OpenShift GitOps Operator to ensure that the sync trigger on webhooks automatically refreshes an application after a change. GITOPS-5045

With this update, you can configure Argo CD to disable the automatic scraping of metrics for your instance. Before this update, there was no option to disable this feature, resulting in excessive storage usage when multiple Argo CD instances were available on the cluster. GITOPS-4519

apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
 name: argocd-sample
 namespace: default
spec:
 monitoring:
   disableMetrics: true

$ oc patch argocd argocd-sample -n default --type='json' -p='[{"op": "replace", "path": "/spec/monitoring/disableMetrics", "value": true}]'

With this update, the Argo Rollouts functionality in Red Hat OpenShift GitOps is promoted from Technology Preview (TP) to General Availability (GA). GITOPS-3848

With this update, you can perform canary-based Argo Rollouts deployments by using OpenShift Routes-based traffic management. Argo Rollouts supports traffic splitting by modifying the percentage of traffic that reaches the canary or stable application version during a deployment. GITOPS-2400

With this update, the Argo CD applications in non-control plane namespaces feature is promoted from Technology Preview (TP) to General Availability (GA). GITOPS-3796

With this update, the following new commands are introduced for the Argo CD applications in non-control plane namespaces feature:

With this update, you can customize permissions for a cluster-scoped Argo CD instance by creating user-defined ClusterRoles and ClusterRoleBindings for the Argo CD Application Controller and server components. GITOPS-2614

With this update, you can customize the Keycloak route name in the Red Hat OpenShift GitOps Operator. This update also enables support for complex routing scenarios, such as dividing routes among various ingress controller shards. GITOPS-4451

With this update, the route TLS termination is set as default to the reencrypt mode for both the default and user-defined Argo CD instances. TLS connections to the Argo CD instances now receive the default ingress certificate that is set in OpenShift Container Platform, instead of the self-signed Argo CD certificate generated by the Red Hat OpenShift GitOps Operator. You can modify the route TLS termination policy by configuring the .spec.server.route.tls field of the Argo CD CR. GITOPS-3918

With this update, Argo CD upstream is enhanced to ensure that resource deletion is managed properly when using sync-waves. Now, Argo CD waits for resources to be entirely deleted before advancing to the next sync-wave in the deletion process. This approach ensures a controlled and predictable workflow, enhancing the user experience and preventing potential issues that might arise from not waiting for resources to be fully recycled before proceeding to the next sync-wave. GITOPS-2642

With this update, Argo CD CLI has been enhanced by enabling the --app-namespace flag for various application-related commands. GITOPS-3834

Before this update, if the DeploymentConfig [apps.openshift.io/v1] API was disabled in the OpenShift Container Platform cluster, the GitOps Operator would enter the CrashLoopBackoff error state and would not function properly. This update fixes the issue by modifying the functionality of the GitOps Operator to ensure that it does not enter the CrashLoopBackoff error state when the API is unavailable in the cluster. GITOPS-4489

Before this update, users were unable to connect to remote Git repositories through a SOCKS5 proxy server because it was only compatible with HTTPS URLs. With this update, users can access remote Git repositories by using a SOCKS5 proxy server that supports the SSH protocol. GITOPS-3710

Before this update, the forceHttpBasicAuth repository configuration was not initialized properly during repository updates from Argo CD UI. As a result, the value was reset to default, leading to connection errors, particularly for Azure DevOps repositories. This update fixes the issue by adding a change in the upstream to ensure that the forceHttpBasicAuth configuration is correctly initialized during repository update operations. GITOPS-3706

Before this update, the Argo CD CLI would designate the initial source as the main source for multi-source applications. With this update, the Argo CD CLI supports multi-source applications by considering all sources during processing. GITOPS-2623

Before this update, the Argo Rollouts controller CR did not create ServiceMonitor. With this update, the Argo Rollouts controller CR is improved to include support for ServiceMonitor creation. As a result, you can gather metrics from Rollouts using the enhanced Argo Rollouts controller CR, and these metrics are visible in monitoring. GITOPS-3271

There is currently a known issue that prevents the Red Hat OpenShift GitOps Operator from updating the default TLS termination policy of the Argo CD server route from Passthrough to Reencrypt. This is a race condition that occurs when upgrading from an older version. GITOPS-4947

In Red Hat OpenShift GitOps 1.13, the Red Hat OpenShift GitOps Application Manager CLI, kam, is deprecated and is planned to be removed in the future release. Red Hat will provide bug fixes and support for this feature during the current release lifecycle, but this feature will no longer receive enhancements and will be removed. As an alternative to the Red Hat OpenShift GitOps Application Manager CLI, kam, you can use the Argo CD CLI that is available from Red Hat OpenShift GitOps Operator v1.12. GITOPS-4466

Before this update, the default TLS termination policy of the Argo CD server route changed from passthrough to reencrypt, leading to issues for users who previously configured the passthrough route with a custom TLS certificate. This update fixes the issue by reverting the default termination policy to passthrough. With this update, the Argo CD UI is accessible without any issues, even if the server route with a passthrough policy is configured with a custom TLS certificate. GITOPS-4758

Before this update, pods in a different namespace could access the Redis server on port 6379 to obtain read and write access to the data. This update fixes the issue by enabling secure authentication.

With this update, support has been provided for the must-gather tool in the Argo Rollouts controller. This update provides support for the following enhancements:

Before this update, users could not use the argocd-k8s-auth binary to add Google Kubernetes Engine (GKE) and Amazon Elastic Kubernetes Service (EKS) clusters because this binary was not available in the GitOps container. This update fixes the issue by adding the argocd-k8s-auth binary in the GitOps container. GITOPS-4226

Before this update, attempts to connect to Azure DevOps with Argo CD would result in an error due to the deprecation of the rsa-ssh host key algorithm by the Azure DevOps Repository service. This update fixes the issue by providing support for the rsa-ssh host key algorithms during the communication process between Argo CD and Azure DevOps Repository service. GITOPS-4543

Before this update, GitOps console plugin workloads did not schedule on infrastructure nodes when the runOnInfra field was enabled in the GitOpsService custom resource (CR). This update fixes the issue by adding the infrastructure node-selector on the GitOps console plugin workloads. This enables users to configure custom node-selectors and tolerations on the gitops-console pod. As a result, when the runOnInfra field is enabled, the GitOps console plugin pod is placed on the infrastructure nodes like the other default workloads. GITOPS-4496

Before this update, the ignoreDifferences sync option in Argo CD did not work for array fields. This update fixes the issue by modifying the merge strategy of the ignoreDifferences sync option used in the upstream project to handle array fields. As a result, the sync option now functions correctly by allowing users to ignore specific elements in the array during sync. GITOPS-2962

Before this update, users were unable to include context for notifications in the NotificationsConfiguration custom resource (CR). With this update, users can now add context for notifications by using the context field in the NotificationsConfiguration CR. This field can also be used to establish shared context across all templates defined in the NotificationsConfiguration CR. GITOPS-4303

spec:
  context:
    region: east (1)

Before this update, users accessing a Red Hat OpenShift on AWS (ROSA) cluster after hibernation were unable to log in to the Argo CD web console due to an error indicating an invalid redirect URI in the Dex configuration. With this update, users can now log in to the Argo CD web console without facing any errors when the ROSA cluster is operational post-hibernation. GITOPS-4358

Before this update, users were unable to log in to the Argo CD web console if the availability of the openshift-gitops route was delayed while the Red Hat OpenShift GitOps Operator processed an Argo CD custom resource instance. An error message was displayed indicating an invalid redirect URI in the Dex configuration. With this update, users can now log in to the Argo CD web console without facing any errors. GITOPS-3736

Before this update, users could not create custom resources for Argo CD from the Add page on the Developer perspective of the Red Hat OpenShift GitOps web console. This issue has been observed from Red Hat OpenShift GitOps 1.10 and later releases. This update fixes the issue because Operator-backed resources with the correct versions are included in the ClusterServiceVersion manifest file. GITOPS-4513

With this update, the GitOps argocd CLI is supported and accessible as a productized component of Red Hat OpenShift GitOps. The GitOps argocd CLI tool is available through RPMs in RHEL. You can download it through the OpenShift mirror registry.

With this update, NotificationsConfiguration custom resource (CR) is now supported. Before this update, you had to update the argocd-notifications-cm configmap to manage templates, triggers, services and subscriptions. With this release, you cannot modify the argocd-notifications-cm configmap. A new Custom Resource definition NotificationsConfiguration is introduced to manage the argocd-notifications-cm configmap. GITOPS-4130

With this update, two new fields .spec.applicationSet.sourceNamespaces and .spec.applicationSet.scmProviders are introduced in the ArgoCD CRD to support ApplicationSet in any non-control plane namespaces. Administrators can use these fields to define certain namespaces that manage ApplicationSet resources. GITOPS-3754

With this update, Argo CD server has the required permissions to manage ApplicationSet resources. GITOPS-3762

With this update, you can configure log levels, such as debug, info, warn, error, panic and fatal. The default log level set for the output is info. To change the log level, add the environment variable LOG_LEVEL in the .spec.config.env field of the Subscription CR. GITOPS-4016

apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: gitops-operator
  namespace: openshift-gitops-operator
spec:
  ...
  config:
    env:
    - name: LOG_LEVEL
      value: "error"

With this update, Argo CD accepts the wildcard values in the sourceNamespaces field so that you can specify multiple namespaces or patterns for namespaces. To use this feature, specify the namespaces where Argo CD can manage applications in the .spec.sourceNamespaces field of the ArgoCD CR. GITOPS-3935

apiVersion: argoproj.io/v1alpha1
kind: ArgoCD
metadata:
  name: example-argocd-wildcard-pattern
spec:
  sourceNamespaces:
    - app-team-*
   - namespace-2

apiVersion: argoproj.io/v1alpha1
kind: ArgoCD
metadata:
  name: example-argocd-all-namespaces
spec:
  sourceNamespaces:
    - '*'

Before this update, the notifications controller could not use built-in functions in notification templates to obtain information about applications because of an incorrect repository server address. This update fixes the issue by initializing the notification controller to use the correct repository server address. GITOPS-2867

Before this update, when a user created a Job from a CronJob resource, an error is displayed. With this update, users can create Job executions from a CronJob resource defined in a deployed Argo CD application. GITOPS-3617

Before this update, in some instance when applications are deleted, their application environment card would remain in a half-deleted state until the page was refreshed. With this update, the application environment card is removed from the UI automatically after the Argo CD application is deleted. GITOPS-2677

Before this update, when a user deleted apps and namespaces in Argo CD, in some cases, the Red Hat OpenShift GitOps plugin would display an error message. This update fixes the issue by updating some components from the dynamic plugin SDK and provides better error handling. As a result, the error message is not displayed after deleting apps or namespaces. GITOPS-2746

Before this update, the password for the admin role was used to reset to the default password when it was updated by the GitOps argocd CLI or the Argo CD UI. This update fixes the issue and the user can now update the admin password and the password is no longer set to default. GITOPS-3581

There is currently a known issue that changes the functionality of routing in the OpenShift Console Dynamic plugin, dynamic-console-sdk, that is used by the Red Hat OpenShift GitOps Dynamic Plugin. This issue causes the horizontal navigation bar, which is used to switch between the Application Overview page and the Deployment History page for an application, on the Application Overview page to not function correctly. GITOPS-4232

There is currently a known issue on the OpenShift Container Platform cluster for the console Red Hat OpenShift GitOps Dynamic Plugin where users can experience some delay when fetching application data. GITOPS-4234

There is currently a known issue that causes the Red Hat OpenShift GitOps Dynamic Plugin to be disabled on the OpenShift Container Platform 4.15 cluster. GITOPS-4231

Before this update, pods in a different namespace could access the Redis server on port 6379 to obtain read and write access to the data. This issue has been fixed in this release by enabling secure authentication.

Before this update, users could not use the argocd-k8s-auth binary to add Google Kubernetes Engine (GKE) and Amazon Elastic Kubernetes Service (EKS) clusters because this binary was not available in the GitOps container. This update fixes the issue by adding the argocd-k8s-auth binary in the GitOps container. GITOPS-4226

Before this update, attempts to connect to Azure DevOps with Argo CD would result in an error due to the deprecation of the rsa-ssh host key algorithm by the Azure DevOps Repository service. This update fixes the issue by providing support for the rsa-ssh host key algorithms during the communication process between Argo CD and Azure DevOps Repository service. GITOPS-4543

Before this update, the ignoreDifferences sync option in Argo CD did not work for array fields. This update fixes the issue by modifying the merge strategy of the ignoreDifferences sync option used in the upstream project to handle array fields. As a result, the sync option now functions correctly by allowing users to ignore specific elements in the array during sync. GITOPS-2962

Before this update, users accessing a Red Hat OpenShift on AWS (ROSA) cluster after hibernation were unable to log in to the Argo CD web console due to an error indicating an invalid redirect URI in the Dex configuration. With this update, users can now log in to the Argo CD web console without facing any errors when the ROSA cluster is operational post-hibernation. GITOPS-4358

Before this update, users were unable to log in to the Argo CD web console if the availability of the openshift-gitops route was delayed while the Red Hat OpenShift GitOps Operator processed an Argo CD custom resource instance. An error message was displayed indicating an invalid redirect URI in the Dex configuration. With this update, users can now log in to the Argo CD web console without facing any errors. GITOPS-3736

Before this update, users could not create custom resources for Argo CD from the Add page on the Developer perspective of the Red Hat OpenShift GitOps web console. This issue has been observed from Red Hat OpenShift GitOps 1.10 and later releases. This update fixes the issue because Operator-backed resources with the correct versions are included in the ClusterServiceVersion manifest file. GITOPS-4513

With this update, you can selectively disable the redis and application-controller components for an Argo CD instance in a specified namespace. These components are enabled by default. To disable a component, set the enabled flag to false in the .spec.<component>.enabled field of the Argo CD Custom Resource (CR). GITOPS-3723

apiVersion: argoproj.io/v1alpha1
kind: ArgoCD
metadata:
  name: example-argocd
spec:
  controller:
    enabled: false
  redis:
    enabled: false

Before this update, the Argo CD Notifications Controller did not support custom certificates added to the argocd-tls-certs-cm config map. As a result, notification services with custom certificates did not receive notifications due to the x509: certificate signed by unknown authority error message. This update fixes the issue by correctly initializing the cert resolver function in the Argo CD Notifications Controller to load all certificates stored in the argocd-tls-certs-cm config map. Now, notification services with custom certificates can successfully receive notifications. GITOPS-2809

Before this update, users would face PrometheusOperatorRejectedResources alerts when the Red Hat OpenShift GitOps Operator was not installed in the openshift-gitops-operator namespace. The problem affected users who upgraded from earlier versions of the Red Hat OpenShift GitOps Operator to v1.10. This update fixes the issue by updating the Operator’s serverName metrics service to reflect the correct installation namespace. Now, users who upgrade or install the Red Hat OpenShift GitOps Operator in namespaces other than openshift-gitops-operator should not see these alerts. GITOPS-3424