Major Argo CD version upgrades and the breaking changes the official upgrade notes say teams must handle before moving.
A plan for the move from Argo CD 2.x to 3.0: RBAC policy rewrites for update, delete and logs, annotation-based tracking, repositories moved to Secrets, Dex RBAC subjects, removed metrics and dashboards, and testing before cutover.
Moving from Argo CD 3.0 to 3.1: the server-side OIDC authorization code flow and its new callback redirect URI, the deprecated v1 resource actions API, symlink checks on static assets and sanitized project API responses.
Moving from Argo CD 3.1 to 3.2: non-root Source Hydrator paths, CronJob health changes that can turn applications Degraded, the Kustomize version in .argocd-source.yaml, and deprecated repo-server gRPC fields.
Moving from Argo CD 3.2 to 3.3: the ApplicationSet CRD that now requires server-side apply, Source Hydrator git notes, fewer fields for anonymous settings calls, and new Kubernetes timeout and self-heal flags.
Moving from Argo CD 3.3 to 3.4: the full cluster version format, Missing health only when all resources are missing, Dex 2.45.0 defaults, gRPC DNS TXT config off by default and stricter OIDC token verification order.
Moving from Argo CD 3.4 to 3.5: Helm 4 and plain-HTTP OCI registries, impersonation that now covers every server operation, rebuilt UI extensions for React 19, and the deprecation of GnuPG keys and --repo-server-strict-tls.
Planning a jump of several minor releases, for example from an unsupported 2.x line: which upgrade notes to read, backing up before a major version, applying full manifests with server-side apply, and testing on a non-production instance first.
Upgrading the HA manifests without losing reconciliation: applying ha/install.yaml with server-side apply, controller shard and Redis HA behavior during rollout, backups first, and checking replicas and node anti-affinity afterwards.
Upgrading when Argo CD deploys its own manifests from Git: bumping the version in the Kustomize base, the required ServerSideApply sync option, ordering CRD changes, and recovering if the new controller fails to start.
Replacing the deprecated signatureKeys setting with Source Integrity Verification before it is removed: what the new sourceIntegrity field checks, per-source rules for multi-source apps, and the limits on local syncs and templated ApplicationSets.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.