Chapter 1. Red Hat OpenShift GitOps release notes

Issued: 2026-06-24

The enhancements included in this release are documented in the following advisory:

With this update, Argo CD Image Updater is generally available. It updates container images automatically for Kubernetes workloads managed by Argo CD. It tracks image versions in applications. You can define these versions in ImageUpdater custom resources (CR). It updates images using parameter overrides through the Argo CD API or the Git write-back method. The Image Updater supports applications built with Kustomize or Helm.

GITOPS-9754

With this update, the Argo CD CLI is generally available. It provides a stable command-line interface for managing Argo CD applications and related resources. Use the CLI to perform common GitOps operations.

GITOPS-9379

With this update, the GitOps Console Plugin adds Technology Preview support for Argo CD and Argo Rollouts. You can view Applications, ApplicationSets, AppProjects, and Rollouts directly from the OpenShift Container Platform. This feature requires OpenShift Container Platform 4.19 or later.

This feature includes:

With this update, you can run Argo CD Agent with your existing Argo CD deployment. This enables gradual adoption of the agent pull model without replacing the existing push-based architecture. Traditional applications continue to use the Application Controller on the control plane. Agent applications are synced to the workload clusters via the agent pull model. Both appear in the same UI. Label selectors and the argocd.argoproj.io/skip-reconcile annotation enforce isolation between them.

GITOPS-9022

With this update, the Argo CD Operator supports declarative management of Git webhook secrets through the spec.webhookSecrets field in the Argo CD custom resource (CR). You can configure webhook secrets for GitHub, GitLab, Bitbucket Cloud, Bitbucket Server, Gogs, and Azure DevOps directly within the CR. This feature allows you to reference external Kubernetes secrets containing webhook credentials rather than manually editing the operator-managed argocd-secret configuration.

This enhancement enables full integration with external secret management tools, such as the External Secrets Operator or Sealed Secrets, allowing webhook secrets to be managed alongside Argo CD configurations in a version-controlled, declarative workflow. This prevents the storage of sensitive tokens in GitOps repositories and eliminates manual updates to operator-managed resources, reducing reconciliation conflicts. This feature is fully backward compatible, and existing manual configurations continue to function without modification.

GITOPS-8222

With this update, Argo CD Image Updater adds a Pull Request workflow for the Git write-back method. Before this update, image update commits were pushed directly to the tracking branch, which did not work with protected branches and skipped review processes. The Image Updater can now open a pull request to the base branch instead of pushing directly, allowing image updates to go through a review and approval workflow.

GITOPS-9143

With this update, Argo CD Image Updater defaults to namespace-scoped operation. Before this update, the Image Updater required cluster-wide RBAC permissions by default. This was restrictive in multitenant environments where cluster-scoped access is limited. By default, the controller watches only the namespace where it is installed and includes namespace-scoped Role and RoleBinding manifests. This default behavior is configurable. You can configure the controller to watch a specific set of namespaces or the entire cluster by adjusting the RBAC configuration.

GITOPS-9134

With this update, the Argo CD Image Updater webhook server runs with TLS enabled by default. Before this update, the webhook server accepted registry notifications over plain HTTP. It had no TLS encryption or configuration options. This allowed webhook payloads to transmit in cleartext. This included shared secrets used for payload validation. The webhook server now uses TLS 1.3 for both the minimum and maximum protocol versions by default. These TLS options are configurable. This ensures secure transmission of webhook notifications from container registries.

GITOPS-9133

With this update, Argo CD Image Updater adds native webhook support for Alibaba Cloud Container Registry (ACR). Before this update, the Image Updater had no webhook support for ACR and required polling to detect new image versions. A dedicated Aliyun ACR webhook handler enables the controller to respond to push events in real time.

GITOPS-9701

With this update, each ImageUpdater CR maintains a status subresource that reflects the overall state of the resource. This includes the number of matched applications, managed images, timestamps, conditions, and a list of image updates from the most recent update cycle. You can check the state of your ImageUpdater resources with CLI commands:

$ oc get imageupdater -n openshift-gitops

You can also view the complete status by examining the ImageUpdater CR in the cluster.

GITOPS-7316

With this update, ServiceMonitor resources are available for Argo CD Agent Principal and Agent components. This enables Prometheus to scrape metrics through Monitoring. Metrics now appear in Console dashboards.

GITOPS-9595

With this update, the Argo CD Agent and Principal components support end-to-end TLS encryption for Redis traffic. The Redis proxy accepts TLS connections from Argo CD components like argocd-server and argocd-repo-server. It uses TLS when connecting to the local argocd-redis instance. Configure this feature using new CLI flags and environment variables. These include --redis-tls-enabled, proxy server certificate, and key paths, or related Kubernetes secrets. You can configure the upstream CA using a file path, a Kubernetes secret, or an insecure mode for testing only. The Kubernetes and Helm installation manifests include optional Redis TLS settings. TLS is disabled by default. The principal.redis.tls.enabled and agent.redis.tls.enabled fields default to false. This ensures that existing deployments continue to work until you enable the feature and provide certificates.

GITOPS-8090

With this update, Argo CD Agent syncs credentials to managed agents. It supports per-repository secrets and URL-prefix templates. Both are scoped by AppProject.

GITOPS-9390

With this update, username and password for the operator-managed Redis or Redis HA are injected using volume mounts. This security hardening reduces the risk of accidental credential exposure.

GITOPS-7368

With this update, you can configure the interval and scrapeTimeout fields for Argo CD component ServiceMonitors. This gives you control over metric collection intervals and timeouts for each Argo CD component.

GITOPS-9633

With this update, Red Hat OpenShift GitOps cleans up old KAM (Application Manager CLI) resources automatically. Before this update, you had to remove KAM components manually when upgrading from older versions. These resources often stayed in clusters after upgrades. This caused stale deployments, wasted resources, and security scan alerts. The Red Hat OpenShift GitOps Operator removes these resources automatically.

GITOPS-9217

Before this update, the Dex service account used non-expiring security tokens. This created security risks from long-lived credentials. With this update, the service account uses expiring tokens. This improves authentication security for the Dex server in Red Hat OpenShift GitOps.

GITOPS-9426

Before this update, users with GitHub App authentication behind restrictive firewalls saw vague timeout errors. This happened because Post-Quantum Cryptography (PQC) algorithms generate larger SSH handshake packets. Some firewalls silently drop these packets. PQC algorithms are enabled by default starting in Argo CD 2.4.12. Suricata 7, which AWS Network Firewall uses, drops such large SSH packets. With this update, individual timeouts are used. Error messages now explicitly identify SSH handshake timeouts instead of generic timeout errors. This helps cluster operators quickly isolate and debug network path issues.

To avoid timeout errors when using GitHub App authentication behind network firewalls, disable the PQC algorithm for SSH handshake.

GITOPS-8739

Before this update, the principal required the agent name to match both .spec.destinations[].name and .spec.sourceNamespaces in an AppProject when using destination-based mapping. This was inconsistent with how Applications are routed in destination-based mapping. With this update, the principal checks only .spec.destinations[].name for routing when destination-based mapping is enabled. AppProjects are now correctly distributed to managed agents based solely on the destination name.

GITOPS-9790

When the web-based CLI terminal feature is enabled by setting the spec.webTerminalEnabled field, the Terminal tab appears on the application details page for a pod, but command input does not work. The openshift-gitops-argocd-server service account does not have permission to create pods/exec resources, which the web terminal requires to attach to running pods and execute commands.

To work around this issue, create a ClusterRole and ClusterRoleBinding that grants the Argo CD server service account pods/exec access.

Example:

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: terminal-tmp
rules:
  - verbs:
      - create
    apiGroups:
      - ''
    resources:
      - pods/exec
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: terminal-tmp
subjects:
  - kind: ServiceAccount
    name: openshift-gitops-argocd-server
    namespace: openshift-gitops
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: terminal-tmp

Apply the manifest with oc apply -f. If your Argo CD instance is not the default deployment in openshift-gitops, update the service account name and namespace in the ClusterRoleBinding accordingly.

GITOPS-9631

With this update, the Argo CD Image Updater might have a goroutine leak when using the git write-back method under heavy load. This happens when you have many applications and short poll intervals. The leak causes Git operations to fail with this error: error: cannot fork() for remote-https: Resource temporarily unavailable.

To mitigate this issue, apply one of the following workarounds:

With this update, the Red Hat OpenShift GitOps Operator enables ApplicationSet tokenRef strict mode by default. This happens when .spec.applicationSet.sourceNamespaces on the Argo CD custom resource includes at least one cluster namespace. This change affects ApplicationSet SCM Provider and Pull Request generators. Secrets used by these generators through tokenRef must have this label: argocd.argoproj.io/secret-type: scm-creds.

If you use SCM Provider or Pull Request generators with unlabeled secrets, do one of the following before upgrading:

With this update, the spec.namespace field has been removed from the ImageUpdater API. Any CR that includes spec.namespace will fail validation. The controller uses the ImageUpdater CR’s metadata.namespace to determine which namespace to search for applications.

GITOPS-9135

With this update, the logformat field name is now consistent across Argo CD components. Before this update, the applicationSet and notifications components used the lowercase logformat field. Components such as server, repo-server, and application-controller used the camelCase logFormat field.

Use the camelCase logFormat field for applicationSet and notifications. The lowercase logformat field is deprecated but still works for backward compatibility. The Red Hat OpenShift GitOps Operator uses the lowercase logformat field if the camelCase logFormat field is not set. You can update your custom resource specifications to use the camelCase logFormat field. The deprecated lowercase logformat field might be removed in a future release.

GITOPS-9119

With this update, the dynamic shard scaling feature in the Red Hat OpenShift GitOps Operator is deprecated. This includes the .spec.controller.sharding.dynamicScalingEnabled field in the Argo CD custom resource. For more information about sharding clusters, see the Additional resources section.

GITOPS-9478

With this update, the deprecated kube-rbac-proxy image is no longer used. The Red Hat OpenShift GitOps Operator uses the WithAuthenticationAndAuthorization function from controller-runtime for authentication and authorization. As a result, Operator deployments now run with a single container instead of two.

GITOPS-9236