chore(deps): update quay.io/argoproj/argocd docker tag to v3

[vshn-renovate]

This PR contains the following updates:

Package	Update	Change
quay.io/argoproj/argocd	major	v2.13.7 -> v3.0.0

---

Release Notes

argoproj/argo-cd (quay.io/argoproj/argocd)

v3.0.0

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.0/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.0/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Features

• 402802b: feat!: Logs rbac enforce by default (#​21678) (@​reggie-k)
• cca7485: feat!: update compareoptions default values (#​22230) (@​agaudreault)
• 029927b: feat(appcontroller): store application health status in redis by default (#​10312) (#​21532) (@​rumstead)
• f775e7b: feat(appset): Add values to PR generator (#​21557) (@​dudo)
• b9131c1: feat(cmp): pass empty env vars to plugins (#​18720) (#​22096) (@​crenshaw-dev)
• ac50d8e: feat(config)!: exclude known interim resources by default (#​20013) (#​21635) (@​agaudreault)
• 910b951: feat(controller): enable batch event processing by default (#​22338) (@​crenshaw-dev)
• 7edaef5: feat(helm): upgrading helm to 3.17.0 (#​21722) (@​rumstead)
• 3d2c010: feat(hydrator): handle sourceHydrator fields from webhook (#​19397) (cherry-pick #​22485) (#​22753) (@​gcp-cherry-pick-bot[bot])
• 88e43cb: feat(kubectl): upgrading kubectl to 1.32.1 (#​21724) (@​rumstead)
• c675757: feat(kustomize): support --include-templates for labels (#​15283) (#​22069) (@​crenshaw-dev)
• 6f9389c: feat(log): support match case in pod log search (#​21919) (@​linghaoSu)
• feb7097: feat(metrics): add more kubectl metrics (#​21720) (@​crenshaw-dev)
• 606bd5b: feat(rbac)!: disable fine-grained inheritance by default (#​19988) (#​20671) (@​fffinkel)
• e3bd569: feat(server): make deep copies of objects returned by informers (#​22173) (#​22179) (@​rumstead)
• 7296201: feat(ui): Added link to start page in argo logo (#​21461) (@​surajyadav1108)
• 6d27928: feat(ui): highlight log lines by pod name (#​21001) (@​aali309)
• b8508f2: feat(ui): rename filter message status on SYNC STATUS view (#​21061) (@​aali309)
• 55f8a43: feat(ui): split arrays in yaml to fix ambiguous collapse when array items have nested objects (#​21064) (@​aali309)
• 0fab3cf: feat(ui): support display sync wave (#​20614) (@​linghaoSu)
• 922c9e9: feat(ui): support filter repo when input (#​21451) (@​linghaoSu)
• 89c4817: feat: Add support for Azure workload identity for Git and OCI repositories. (#​21118) (@​jagpreetstamber)
• f9ffb6a: feat: Added env reference objects to manifests for otlp.attrs (#​21563) (@​almoelda)
• 0973409: feat: Kustomize ignore missing components (#​18634) (#​21674) (@​bradkwadsworth)
• 74b3532: feat: Make certain Status panel items look more 'clickable' (#​19698) (#​22232) (@​keithchong)
• c0b2787: feat: Support kube 1.32 (#​21805) (@​sivchari)
• d301b40: feat: Upgrade notifications engine (#​22273) (@​sivchari)
• c9c4068: feat: add AND operator opt-in option for sync windows matches (#​16846) (@​adriananeci)
• f258c45: feat: add ARGOCD_APP_PROJECT_NAME to the build environment (#​15185) (#​21586) (@​MacroPower)
• c71dd1a: feat: add a check for user defined role referential integrity (#​21065) (@​devopsjedi)
• 8044d68: feat: add bearer token auth (#​21462) (@​reggie-k)
• fa0b5f5: feat: add force promote actions for Numaplane rollouts (#​22141) (@​dpadhiar)
• e4311d8: feat: add name and labels in cluster metrics (#​17870) (#​18453) (@​flbla)
• ecb9dba: feat: add support for azure workload identity in Microsoft Entra SSO (#​21433) (@​jagpreetstamber)
• 951d9d3: feat: add the --redis-compress as the global flag to set redis compression. (#​21786) (@​nitishfy)
• 561cbef: feat: checking user defined roles and policies for referential integrity (#​20825) (#​22132) (@​devopsjedi)
• d23e6ac: feat: configurable log timestamp format (#​21478) (@​crenshaw-dev)
• c09e6fa: feat: improve StatefulSet immutable field error messages (#​21209) (@​aali309)
• 1698370: feat: replace spdy with websocket for portforward and pod exec #​21517 (#​21518) (@​maoqide)
• 3e09f94: feat: resource customization for CustomResourceDefinition (#​21416) (@​almoelda)
• 6b002a5: feat: upgrade to v1.32.2 (#​22168) (@​sivchari)
• fbd7f29: feat: use errors.Join for debuggable (#​22235) (@​sivchari)
• dbdc1e7: feat: use log format config for klog (#​5715) (#​21458) (@​crenshaw-dev)

Bug fixes

• 46bfc10: Revert "fix: Graceful shutdown for the API server (#​18642) (#​20981)" (#​21221) (@​pasha-codefresh)
• c6b0000: fix(actions): don't run empty Lua scripts (#​22084) (#​22161) (@​crenshaw-dev)
• e6f94f2: fix(appcontroller): selfhealattemptscount needs to be reset at times (#​22095) (@​blakepettersson)
• 079341c: fix(applicationset): ApplicationSets with rolling sync stuck in Pending (#​20230) (@​Fsero)
• f6a84a4: fix(appset): Reconcile appset only once when appset is refreshed (fix 21171) (#​21172) (@​dacofr)
• f3509d2: fix(appset): dont requeue appsets on status change (#​21364) (@​rumstead)
• e852142: fix(appset): events not honouring configured namespaces (#​21219) (#​21241) (@​eadred)
• e44ae96: fix(appset): generated app errors should use the default requeue (#​21887) (#​21936) (@​rumstead)
• 922dd77: fix(appset): improve git generator repo credential fallback (#​21167) (@​blakepettersson)
• 55aab6e: fix(appset): reverted Gitlab SCM HasPath search and consider 404 errors as file not found (#​16253) (#​21597) (@​prune998)
• 37a7231: fix(appset): update gitlab SCM provider to search on parent folder (#​16253) (#​21491) (@​prune998)
• 06bd2ad: fix(ci): all version bump changes go in the PR (#​21409) (@​crenshaw-dev)
• 2933154: fix(ci): get correct previous version, fail workflow if not (cherry-pick #​22376) (#​22377) (@​gcp-cherry-pick-bot[bot])
• 15046b9: fix(ci): handle major versions in compatibility table generator (cherry-pick #​22370) (#​22371) (@​gcp-cherry-pick-bot[bot])
• 43d2a3d: fix(ci): proto references bump (#​21391) (@​crenshaw-dev)
• 05c7625: fix(ci): updating action-gh-release after upstream fix (#​21407) (@​rumstead)
• eb6732e: fix(ci): use pinned Helm version for init-release (#​22164) (#​22165) (@​crenshaw-dev)
• 6e4c8fd: fix(ci): use tags instead of branches (cherry-pick #​22372) (#​22373) (@​gcp-cherry-pick-bot[bot])
• 99cd3c7: fix(cli): add flags to admin import for retrying updates on conflicts and skipping resources with specific labels. (#​21694) (@​ashutosh16)
• 85684a8: fix(cli): application cannot be refreshed when invalid and hangs (#​21615) (@​agaudreault)
• eb6dd46: fix(cli): ignored resources should not be pruned during restore (#​21894) (@​agaudreault)
• 9c443b6: fix(cli): improve performance for admin export/import cmd (#​22322) (@​agaudreault)
• 546383a: fix(cli): log correct error message when updating a cluster that is not present (#​22190) (@​nitishfy)
• 613d06d: fix(cli): use correct CA when adding kube-public clusters (#​21326) (#​21327) (@​aminarefzadeh)
• f2ee9a6: fix(cli): wrong variable to store --no-proxy value (#​21226) (@​the-technat)
• a8ce677: fix(controller): always set health.status.lastTransitionTime (#​22665) (cherry-pick #​22666) (#​22667) (@​gcp-cherry-pick-bot[bot])
• 1a9f226: fix(controller): rename cluster batch param and add to argocd-cmd-params-cm (#​21402) (@​crenshaw-dev)
• d54ae98: fix(controller): wrong tracking annotation for malformed resources (#​22325) (@​crenshaw-dev)
• b4a63ae: fix(dex): always request federated:id scope (#​17908) (#​21726) (@​agaudreault)
• ad09b9c: fix(docs): 2.14 upgrading docs (#​21756) (@​rumstead)
• 4382281: fix(docs): Fix syntax in e2e test docs (#​21796) (@​pjiang-dev)
• 8545d21: fix(docs): update --auth-token description in argocd_appset_update.md to account for environment variable (#​22350) (@​chengfang)
• 68d60cd: fix(docs): update mkdocs for upgrade guide (#​21768) (@​rumstead)
• 7c7dda0: fix(grafanadashboard): add memory units to panels showing memory usage (#​22078) (@​BWagenerGenerali)
• 9429275: fix(hydrator): UI nil checks (#​21598) (@​crenshaw-dev)
• 3baca9b: fix(hydrator): don't get cluster or API versions for hydrator (#​21985) (@​crenshaw-dev)
• 35009a7: fix(hydrator): don't use manifest-generate-paths (#​22039) (#​22015) (@​crenshaw-dev)
• 8a97c1d: fix(hydrator): refresh by annotation instead of work queue (#​22016) (@​crenshaw-dev)
• d1574c2: fix(rbac): Add rights on applicationsets for the application controller (#​20352) (@​OpenGuidou)
• 13b7b09: fix(settings): race condition on settings configMap (#​21225) (@​agaudreault)
• 416b7d0: fix(test): Use t.Fatal instead of os.Exit in tests (part 1) (#​21003) (#​22114) (@​andrii-korotkov-verkada)
• 2afcb6f: fix(test): delete CRD between tests, install CRD before syncing CRs (#​22299) (@​crenshaw-dev)
• fa747f9: fix(tests): Improved the e2e tests for app sync with impersonation feature (#​21792) (@​anandf)
• b88ad57: fix(ui): Added SSV option to helm type repos (#​22006) (@​surajyadav1108)
• 544aea1: fix(ui): Cannot add an app that has both name and server destination (#​21440) (@​rpelczar)
• 1ce0123: fix(ui): Group Nodes breaks Kinds counts / views (#​21337) (@​surajyadav1108)
• 71c7700: fix(ui): Show error message when max pods to view logs are reached (#​21725) (@​pjiang-dev)
• 854c62f: fix(ui): Solve issue with navigating with dropdown from an application's page (#​21737) (@​amit-o)
• b6e6104: fix(ui): avoid spurious error on hydration (#​22506) (cherry-pick #​22711) (#​22715) (@​gcp-cherry-pick-bot[bot])
• 38b0fd5: fix(ui): columns-adjusted for kind and Namespace in sync details. (#​21038) (@​surajyadav1108)
• ebeae20: fix(ui): fix bearerToken validate in helm connect page (cherry-pick #​22791) (#​22798) (@​gcp-cherry-pick-bot[bot])
• bfb04dd: fix(ui): parameter tab null ref w/ hydrator (#​22097) (#​22131) (@​crenshaw-dev)
• e2e6faa: fix(ui): prevent parameter editor from resetting when props update (fixes #​14351) (#​21625) (@​k4r1)
• 4202168: fix(ui): reduce rerender in pod log view (#​22241) (@​linghaoSu)
• 0d34340: fix: 21062 Support GitLab "System Hook" webhooks for ApplicationSets (#​21243) (@​eadred)
• 911a9c6: fix: Add proxy registry key by dest server + name (#​21791) (@​leoluz)
• a444a05: fix: AppSet PullRequest and SCM generators get 401 from GitHub without tokenRef (cherry-pick #​22737) (#​22744) (@​gcp-cherry-pick-bot[bot])
• ffbf9d5: fix: AppSet PullRequest and SCM generators get 401 from GitHub without tokenRef (manually signed off cherry-pick #​22737) (#​22763) (@​reggie-k)
• f39b425: fix: CVE-2024-21538 upgrading the indirect dep cross-spawn to greater than 7.0.5 (#​21259) (@​nmirasch)
• 644315a: fix: Change applicationset generate HTTP method to avoid route conflicts (#​20758) (@​amit-o)
• d6a04a3: fix: Check for semver constraint matching in application webhook handler (cherry-pick #​21648) (#​22507) (@​gcp-cherry-pick-bot[bot])
• 1905d12: fix: Check placement exists before length check (#​22060) (#​22057) (@​dhaiducek)
• 0d2471b: fix: Enable service account token automount for haproxy (#​22226) (cherry-pick #​22353) (#​22406) (@​gcp-cherry-pick-bot[bot])
• 8841b0d: fix: Fix calculating SelfHealBackOff delay when exceeding maximum (#​20976) (#​20978) (@​mrysavy)
• 4dcabb9: fix: Fix link about http middlewear and add adopter hetao101 (#​21802) (@​wanghonglei5181)
• e3b333a: fix: JSON format (#​22237) (@​sivchari)
• 5b79c34: fix: New kube applier for server side diff dry run with refactoring (#​21488) (#​21749) (@​andrii-korotkov-verkada)
• a8f646e: fix: Notifications on-deployed would now be delivered if sync didn't change the health status of the app in a process (#​22203) (#​22204) (@​andrii-korotkov-verkada)
• 7b1ed52: fix: On deployed trigger must consider race between last transition time and sync finished time (#​9070) (#​21944) (@​andrii-korotkov-verkada)
• f075c5a: fix: Only port-forward to ready pods (#​10610) (cherry-pick #​22794) (#​22825) (@​gcp-cherry-pick-bot[bot])
• ed3cc48: fix: Policy/policy.open-cluster-management.io stuck in progressing status when no clusters match the policy (#​21296) (#​21297) (@​mbaldessari)
• 43e5941: fix: Race condition occurs during initial sharding (#​22264) (@​kahou82)
• 7424432: fix: Rephrased sentence to a meaningfull one (#​22113) (@​babugeet)
• bfd72b4: fix: Revert "fix: Race condition occurs during initial sharding (#​22264)" (#​22354) (@​andrii-korotkov-verkada)
• f542ae5: fix: Revert "split arrays in yaml to fix ambiguous collapse when array items have nested objects (#​21064)" (#​22099) (#​22128) (@​andrii-korotkov-verkada)
• 4a1d0f3: fix: Switch default logging to JSON (issue: 20897) (#​21656) (@​teddy-wahle)
• 0ed7c56: fix: Unable to edit http repo credentials from ArgoCD UI (#​22065) (@​aali309)
• e8a3f7a: fix: Update argo-ui dependency to pull in OCI icon (#​18646) (#​21698) (@​keithchong)
• 376e8d5: fix: Update haproxy version to match the chart (#​22226) (#​22236) (@​andrii-korotkov-verkada)
• 9f81cd4: fix: Use ARGOCD_SERVER for default value (#​21930) (@​sivchari)
• 62ec9fe: fix: Use t.Fatal instead of os.Exit in tests (part 2) (#​21003) (#​22187) (@​andrii-korotkov-verkada)
• c93924b: fix: Wait for Subscription resources to reach AtLatestKnown (#​21425) (@​vinzent)
• e6e9255: fix: correct lookup for the kustomization file when applying patches (#​22024) (@​nitishfy)
• f548fd7: fix: correctly set compareWith when requesting app refresh with delay (fixes #​18998) (#​21298) (@​shenxn)
• 5d131c5: fix: do not exclude APIService resources (cherry-pick #​22586) (#​22587) (@​gcp-cherry-pick-bot[bot])
• b2e8753: fix: do not normalize resource tracking on live crds (cherry-pick #​22722) - cherry-pick 3.0 (#​22735) (@​gcp-cherry-pick-bot[bot])
• d183d9c: fix: dynamic cluster distribution issue 20965, update the shard… (#​21042) (@​ivan-cai)
• 49a4b7f: fix: fetch syncedRevision in UpdateRevisionForPaths (#​21014) (#​21015) (@​toyamagu-2021)
• 563ccb2: fix: fix KustomizeImage Match function to pass added unit tests (#​21872) (@​chengfang)
• 6959e54: fix: have argocd server pass the appLabelKey for proper caching (#​22186) (@​gdsoumya)
• 87671f5: fix: ignore prune=false resources from PruningRequired count (#​21941) (@​gdsoumya)
• 75cb7fc: fix: issue 22206 - fixes overlapping lines in logs by increasing line height (#​22207) (@​GP3-RS)
• eed70ee: fix: login return_url doesn't work with custom server paths (#​21588) (@​alexmt)
• b600c5e: fix: make codegen permissions (#​21667) (@​dudo)
• c7e02ee: fix: make test fails with exec format error (#​21630) (@​reggie-k)
• 85c6d26: fix: override sub with federated_claims.user_id when dex is used (#​20683) (@​aali309)
• 11b8665: fix: remove kustomize binary from git (#​21526) (@​rumstead)
• 6fea008: fix: remove project from cache key for project scoped credentials (cherry-pick #​22712) (#​22817) (@​gcp-cherry-pick-bot[bot])
• 686964d: fix: removed null security context from redis-ha values.yaml to placate helm 3.17.1 (#​22035) (@​reggie-k)
• 6f38327: fix: resolve the failing e2e appset tests for ksonnet applications (#​21580) (@​reggie-k)
• 806c5f6: fix: return cluster URL in error message, not full cluster object (#​22094) (@​crenshaw-dev)
• 94b34f8: fix: upgrade x/crypto to v0.35.0 to solve CVE-2025-22869 (#​22048) (@​gergelyfabian)

Documentation

• e3caeba: docs(hydrator): document signature verification limitation (#​21504) (@​crenshaw-dev)
• 04a1608: docs: 3.0 release date on May 06 (#​22189) (@​reggie-k)
• fdf9a30: docs: 3.0 upgrade guide (#​21457) (@​crenshaw-dev)
• c687247: docs: Add LY Corporation to list of users (#​21592) (@​Asuforce)
• 898a126: docs: Add section on how to lock down/restrict the default project (#​21757) (@​dag-andersen)
• 3f74b24: docs: Adding Argo CD CLI plugin support proposal (#​19624) (@​christianh814)
• 7ba7fc0: docs: Auto Sync toggle does not work for Applications created with an ApplicationSet (#​21577) (@​revitalbarletz)
• f275157: docs: Document Helm 3.17.1 breaking changes (#​22283) (@​reggie-k)
• c4183aa: docs: Document askpass socket sharing between reposerver and cmp sidecar (#​22083) (@​peschmae)
• d19b02d: docs: Ensure Argo CD Hydrator branch prefix consistency (#​21836) (@​dag-andersen)
• 167e122: docs: Fix typo code-gen/codegen contributors-quickstart.md (#​21922) (@​fe-ax)
• dc32867: docs: Fix typos and grammar in tls.md (#​22229) (@​todaywasawesome)
• 87539aa: docs: Surface blog with (actual) release notes better (#​21572) (@​revitalbarletz)
• 499f74d: docs: Update USERS.md (#​22093) (@​mreparaz)
• 961147d: docs: Update sync-kubectl.md - Correct kubectl command for a sample (#​22030) (@​taeyeopkim1)
• 1823d8f: docs: add applicationset controller doc to preserve annotations and labels (#​22008) (@​leoluz)
• 77ff8f0: docs: add missing word (#​21428) (@​nitishfy)
• 2d10d4e: docs: add mkdocs configuration stanza to .readthedocs.yaml (#​21475) (@​reggie-k)
• 975e966: docs: add more info on what login --core does (#​21487) (@​nitishfy)
• db8d2f0: docs: add note about comments in policy.csv files (#​21339) (@​morremeyer)
• 9fd6bee: docs: add statusbadge.url override information (#​21529) (@​tobiasehlert)
• 1645d57: docs: add wildcard globbing example to docs (#​21429) (@​LRost)
• 65664ce: docs: clarify wording on cluster secrets (#​21865) (@​todaywasawesome)
• 7327093: docs: custom resource action UI tweaks (#​22202) (@​crenshaw-dev)
• 8a752a5: docs: document bearerToken in repo example doc ([#​22195](https://redirect.github.com/argoproj/ar

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.