chore: update argocd v3.5.2

[vitalii-codefresh]

Changelog

Breaking changes

Warning

This release bumps the bundled ArgoCD to v3.5.2.

1. Increased minimal supported version of BYOA up from 3.3.X to 3.5.X

2. ArgoCD 3.5 introduces the following breaking changes: More about changes in Argo CD here.

• Helm upgraded to v4.2.1: OCI handling is now strict — plain HTTP (non-TLS) OCI registries must be explicitly marked.
  Two actions may be required:
  • For existing OCI repositories that use plain HTTP, add --insecure-oci-force-http via argocd repo add ... --insecure-oci-force-http --upsert, or set insecureOCIForceHttp: "true" directly in the repository Secret.
  • If your Helm charts declare OCI dependencies (Chart.yaml dependencies with repository: oci://...) hosted on plain HTTP registries, those dependency repos must now also be explicitly registered with --insecure-oci-force-http — this was not required under Helm v3.
  • Known limitation: combining --insecure-skip-server-verification and --insecure-oci-force-http on the same repo chain causes Helm v4 to silently drop --plain-http, breaking plain-HTTP OCI pulls. There is currently no workaround when both are legitimately required.
• UI extensions must externalize react/jsx-runtime: the Argo CD UI moved from React 16 to React 19. Extensions built against an older UI may fail to load (TypeError: Cannot read properties of undefined) until rebuilt. No action needed if you don't install UI extensions.
• Event-listing gRPC response type changed: ListResourceEvents/ListEvents gRPC methods now return an Argo CD-defined EventList type instead of the Kubernetes k8s.io.api.core.v1.EventList. Any custom/generated gRPC client calling these methods directly must be regenerated against Argo CD 3.5. REST endpoints, their JSON payloads, and the Argo CD CLI/UI are unaffected; the generated OpenAPI schema for these endpoints does change, so regenerate REST clients built from it.

Deprecated:

• --repo-server-strict-tls (boolean flag is deprecated across all components argocd-application-controller, argocd-applicationset-controller, argocd-notification)
  is deprecated in favor of --repo-server-ca-cert-path / ARGOCD_SERVER_REPO_SERVER_CA_CERT_PATH. Still functional in 3.5 with a warning; may be removed in 3.6+.
• argocd proj add-signature-key / remove-signature-key and .spec.signatureKeys on AppProject are deprecated in favor of sourceIntegrity.
• The verifyResult field in the REST API is deprecated in favor of sourceIntegrityResult.

Features and enhancements

• mTLS support for repo-server (opt-in, disabled by default): create the argocd-repo-server-mtls Secret (client-ca.crt, client.crt, client.key) and mTLS is enabled automatically across repo-server and its clients — no further configuration needed.

More about changes in Argo CD here.

Related tickets

• Closes CF-2175

[vitalii-codefresh]

/e2e