v2.9 to 2.10

managedNamespaceMetadata no longer preserves client-side-applied labels or annotations

Argo CD 2.10 upgraded kubectl from 1.24 to 1.26. This upgrade introduced a change where client-side-applied labels and annotations are no longer preserved when using a server-side kubectl apply. This change affects the managedNamespaceMetadata field of the Application CRD. Previously, labels and annotations applied via a client-side apply would be preserved when managedNamespaceMetadata was enabled. Now, those existing labels and annotation will be removed.

To avoid unexpected behavior, follow the client-side to server-side resource upgrade guide before enabling managedNamespaceMetadata on an existing namespace.

Upgraded Helm Version

Note that bundled Helm version has been upgraded from 3.13.2 to 3.14.3.

Egress NetworkPolicy for argocd-redis and argocd-redis-ha-haproxy

Starting with Argo CD 2.10.11, the NetworkPolicy for the argocd-redis and argocd-redis-ha-haproxy dropped Egress restrictions. This change was made to allow access to the Kubernetes API to create a secret to secure Redis access.

To retain similar networking restrictions as before 2.10.11, you can add an Egress rule to allow access only to the Kubernetes API and access needed by Redis itself. The Egress rule for Kubernetes access will depend entirely on your Kubernetes setup. The access for Redis itself can be allowed by adding the following to the argocd-redis-network-policy NetworkPolicy:

  1. kind: NetworkPolicy
  2. apiVersion: networking.k8s.io/v1
  3. metadata:
  4.   name: argocd-redis-network-policy
  5. spec:
  6.   policyTypes:
  7.   - Ingress
  8. +  - Egress
  9. +  egress:
  10. +  - ports:
  11. +    - port: 53
  12. +      protocol: UDP
  13. +    - port: 53
  14. +      protocol: TCP
  1. kind: NetworkPolicy
  2. apiVersion: networking.k8s.io/v1
  3. metadata:
  4.   name: argocd-redis-ha-haproxy
  5. spec:
  6.   policyTypes:
  7.   - Ingress
  8. +  - Egress
  9. +  egress:
  10. +  - ports:
  11. +    - port: 6379
  12. +      protocol: TCP
  13. +    - port: 26379
  14. +      protocol: TCP
  15. +    to:
  16. +    - podSelector:
  17. +        matchLabels:
  18. +          app.kubernetes.io/name: argocd-redis-ha
  19. +  - ports:
  20. +    - port: 53
  21. +      protocol: UDP
  22. +    - port: 53
  23. +      protocol: TCP