argo-cd-appslisted

Author and maintain Argo CD `Application` and `ApplicationSet` manifests as a GitOps consumer (publisher), targeting Argo CD v3.4 / v3.5 (Sept 2026). Covers source types (Helm, Kustomize, OCI, multi-source, plugin), sync policies + options + waves + hooks, ApplicationSet generators (List, Cluster, Git, Matrix, Merge, SCMProvider, PullRequest, Plugin, ClusterDecisionResource), Progressive Sync (Beta), Source Hydrator (Beta since v3.5), AppProjects, RBAC, sync impersonation (`destinationServiceAccounts`), GPG/cosign signature verification, GitOps repo layout (mono vs poly, app-of-apps vs ApplicationSet — Argo recommends ApplicationSet first), troubleshooting drift / OutOfSync / sync loops / stuck-deletion / hook failures, and v3.0→v3.5 changes (annotation tracking default, SSA-migration regression, CVE-2026-42880 Secret leak). NOT for installing or operating the Argo CD control plane (HA, Dex, repo-server tuning, UI customization).
air-gapped/skills · ★ 5 · DevOps & Infrastructure · score 80

Install: claude install-skill air-gapped/skills

# Argo CD application authoring For developers and platform teams who **publish** Argo CD `Application` and `ApplicationSet` manifests in git. **v3.5 shipped** (v3.5.0 on 2026-08-04; latest **v3.5.3**, 2026-09-14) and the v3.4 line continues in parallel (latest **v3.4.9**, also 2026-09-14). Note there is no `v3.4.0` tag — that line's first stable release is **v3.4.1**, as its own notes say. **Before upgrading to 3.5, read these three.** All verified 2026-09-15: - **A Secret data-loss regression is open.** `RespectIgnoreDifferences=true` plus a key-level `ignoreDifferences` rule on a Secret that renders `stringData` now drops the **entire `data` map** on sync ([#29644](https://github.com/argoproj/argo-cd/issues/29644), OPEN, filed 2026-09-09). It is a regression from #27136, cherry-picked into both the 3.4 and 3.5 lines, and the reporter has a unit test passing on v3.4.4 and failing on v3.5.2. Self-heal then re-applies the key-less manifest forever. If you ignore individual Secret keys, check this before you sync. - **Helm 4 can change your rendered manifests with no chart or values edit.** v3.5.0 bundles Helm 4.2.x, whose null/nil coalescing differs, so a chart may start emitting explicit `null` fields ([#29068](https://github.com/argoproj/argo-cd/issues/29068)). Diff a render across the bump rather than assuming parity. - **Plain-HTTP OCI registries need an explicit flag** under Helm 4: `--insecure-oci-force-http`, or `insecureOCIForceHttp: "true"`