Skip to main content
HashnodeDevOps

Command Palette

Search for a command to run...

ArgoCD v3.2.5: Critical Patch Release with Stability Improvements

Published
•6 min read
ArgoCD v3.2.5: Critical Patch Release with Stability Improvements
R
Rui Coelho

Introduction

The ArgoCD community recently released version v3.2.5 on January 14, 2026, replacing v3.2.4 which was marked as invalid. This patch release brings critical fixes that improve the stability and security of the most popular GitOps platform in the Kubernetes ecosystem.

If you’re running ArgoCD in production, especially on 2.x versions (which have reached End of Life), this article explains why you should consider this update and what has changed.

🎯 Why ArgoCD v3.2.5 Matters

The v3.2 Context

ArgoCD v3.2 represents a significant evolution in the 3.x line:

  • v3.0 (early 2025): Fundamental architectural improvements

  • v3.1 (August 2025): Native OCI registry support and CLI plugins

  • v3.2 (November 2025): Advanced features and security fixes

  • v3.2.5 (January 2026): Critical stabilization

⚠️ Support Warning

ArgoCD 2.14 reached End of Life on November 4, 2025. According to the project’s support policy, only the three most recent minor versions receive security updates:

  • ✅ v3.2.x (current)

  • ✅ v3.1.x

  • ✅ v3.0.x

  • ❌ v2.14 and earlier (unsupported)

🔧 Key Changes in v3.2.5

1. Notifications Engine Update

Commit: fafbd44

feat: Cherry-pick to 3.2 update notifications engine to v0.5.1

The update to notifications engine v0.5.1 brings improvements in notification delivery for:

  • Slack

  • Microsoft Teams

  • Email

  • Custom webhooks

  • PagerDuty and others

Practical benefit: Greater reliability in sync notifications, health status, and deployment events.

2. ApplicationSet Reconciliation Fix

Commit: d7d9674

fix(appset): do not trigger reconciliation on appsets not part of 
allowed namespaces when updating a cluster secret

Problem solved: ApplicationSets in non-allowed namespaces no longer trigger unnecessary reconciliations when updating cluster secrets.

Impact:

  • Reduced computational load

  • Lower Kubernetes API consumption

  • More predictable behavior in multi-tenant environments

3. Error Message Improvements

Commit: e6f5403

fix: Only show 'please update resource specification' message when spec is outdated

More precise and contextual error messages, reducing confusion for operators.

4. Dependency Updates

Important commits:

# Go update to version 1.25.5
chore(deps): bump go to 1.25.5 

# expr update to v1.17.7 (security)
chore(cherry-pick-3.2): bump expr to v1.17.7
# Tests against Kubernetes 1.34.2
ci: test against k8s 1.34.2

Guaranteed compatibility with:

  • ✅ Kubernetes 1.32.x

  • ✅ Kubernetes 1.33.x

  • ✅ Kubernetes 1.34.x

🚀 How to Upgrade to v3.2.5

Option 1: Non-HA Installation (Single Instance)

# Create namespace (if needed)
kubectl create namespace argocd

# Apply v3.2.5 manifest
kubectl apply -n argocd -f \
  https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.5/manifests/install.yaml

Option 2: HA Installation (High Availability)

kubectl create namespace argocd

kubectl apply -n argocd -f \
  https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.5/manifests/ha/install.yaml

Option 3: Via Helm Chart

# Add repository
helm repo add argo https://argoproj.github.io/argo-helm
helm repo update

# Upgrade to latest version
helm upgrade argocd argo/argo-cd \
  --namespace argocd \
  --version 9.3.2 \
  --reuse-values

Note: Helm chart 9.3.2 includes ArgoCD v3.2.5.

🔐 Security Verification

All ArgoCD images are signed with Cosign and include SLSA Level 3 Provenance:

# Verify image signature
cosign verify \
  --certificate-identity-regexp "https://github.com/argoproj/argo-cd" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  quay.io/argoproj/argocd:v3.2.5

# Verify provenance
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp "https://github.com/argoproj/argo-cd" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  quay.io/argoproj/argocd:v3.2.5

📊 Compatibility and Support

Supported Architectures

  • amd64 (x86_64)

  • arm64 (Apple Silicon, AWS Graviton)

  • ppc64le (IBM Power)

  • s390x (IBM Z)

Kubernetes Platforms

  • Google GKE

  • Amazon EKS

  • Azure AKS

  • Red Hat OpenShift

  • Rancher

  • K3s / K0s

  • Vanilla Kubernetes

🎓 Migrating from v2.x to v3.x

If you’re still on ArgoCD v2.14 or earlier, migration to v3.2.5 is critical for security reasons.

Key Behavioral Changes in v3.x

1. Fine-Grained RBAC by Default

# v2.x: Update permission applied to sub-resources
p, dev-team, applications, update, default/*, allow
# v3.x: Explicit permissions needed for resources
p, dev-team, applications, update, default/*, allow
p, dev-team, applications, update/*/Pod/*, default/*, allow
p, dev-team, applications, update/*/Deployment/*, default/*, allow

2. Tracking by Annotations (Default)

# New default configuration in v3.x
application.resourceTrackingMethod: annotation

3. RBAC on Logs Enabled

# Explicit permissions needed
p, role:developers, logs, get, */*, allow

Detailed Upgrade Guide

Official documentation:

1. Kustomize Version Selection via Git

# .argocd-source.yaml
kustomize:
  version: v5.3.0

You can now specify the Kustomize version directly in your Git repository!

2. Server-Side Diff

# CLI with server-side diff
argocd app diff my-app --server-side-diff

Differences calculated by the Kubernetes API Server = greater accuracy.

3. Pull Request Title Matching

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
spec:
  generators:
  - pullRequest:
      github:
        owner: myorg
        repo: myrepo
      filters:
      - title: "Release/.*"  # Filter by title!

4. Health Checks for GitOps Promoter

Full support for resources:

  • CommitStatus

  • PullRequest

  • PromotionStrategy

  • ChangeTransferPolicy

📈 Performance and Observability

ApplicationSet Resource Limits

To prevent status bloat and etcd limits:

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cmd-params-cm
data:
  # Default limit: 5000 resources
  applicationsetcontroller.status.max.resources.count: "5000"

# Important metrics to monitor
argocd_app_sync_total
argocd_app_health_status
argocd_app_reconcile_count
argocd_applicationset_status_resources

🔮 ArgoCD Roadmap

v3.3 (Expected February 2026)

Target date: February 2, 2026 (GA)

Expected features:

  • Additional performance improvements

  • New notification integrations

  • UX enhancements in the dashboard

Community Events

ArgoCon Amsterdam 2026

  • 📅 Date: March 23–26, 2026

  • 📍 Location: Co-located with KubeCon EU

  • 🎫 Register: ArgoCon 2026

✅ Upgrade Checklist

Before upgrading to v3.2.5:

  • Review official release notes

  • Backup configurations (ConfigMaps, Secrets, CRDs)

  • Test in staging environment

  • Validate RBAC policies (if migrating from v2.x)

  • Verify plugin compatibility

  • Update internal documentation

  • Communicate changes to team

Post-upgrade:

  • Verify health of all applications

  • Test manual synchronization

  • Validate notifications

  • Monitor logs for 24–48h

  • Review metrics dashboards

🛠️ Common Troubleshooting

Problem: ApplicationSets Reconciling Excessively

Symptom: High CPU load, many Kubernetes API requests

Solution: Upgrading to v3.2.5 fixes this specific bug!

Problem: Notifications Not Arriving

Symptom: Sync events don’t trigger notifications

Solution:

# Check notifications controller version
kubectl get deployment argocd-notifications-controller \
  -n argocd -o yaml | grep image

# Should be v3.2.5

Problem: RBAC Denying Log Access

Symptom: Users cannot see pod logs

Solution: Add explicit RBAC policy:

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
data:
  policy.csv: |
    p, role:developer, logs, get, */*, allow

📚 Additional Resources

Official Documentation

Complementary Tools

  • Argo Rollouts: Progressive delivery

  • Argo Workflows: Workflow orchestration

  • Argo Events: Event-driven automation

  • ApplicationSet Controller: Multi-cluster app deployment

💡 Conclusion

ArgoCD v3.2.5 represents a critical stability update that all production users should consider. With important fixes in the ApplicationSet controller, dependency updates, and better notification handling, this version solidifies ArgoCD’s position as the reference GitOps solution for Kubernetes.

Recommended action:

  • If you’re on v3.2.4 → upgrade immediately

  • If you’re on v3.0–3.1 → plan upgrade in the coming weeks

  • If you’re on v2.x → urgent upgrade needed (EOL)

The GitOps ecosystem continues to evolve rapidly, and staying up-to-date is not just about features, but about security and supportability.

#argocd#devops#sre#gitops#platform-engineering#sre-devops

Comments

Join the discussion

No comments yet. Be the first to comment.

More from this blog

DevOps

16 posts