You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Targets the cluster running k8s 1.35.6 / Argo CD 3.4.6.
Scope note: this branch is stacked on k8s-1.34-argocd-v3, so the PR carries
the argo-cd v2→v3 + k8s 1.34 migration (5d2362369) as well as the Dependabot
round. It is current with main.
Dependency bumps
from
to
argo-cd/v3
3.3.12
3.4.7 — matches the cluster's 3.4.6 server
kin-openapi⚠️critical
0.132.0
0.144.0
google.golang.org/grpc
1.79.3
1.82.1
cel-go
0.26.0
0.29.0
go-git/v5
5.19.1
5.19.2
oras-go/v2
2.6.1
2.6.2
oapi-codegen/v2
2.4.2
2.7.1
common-lib / authenticator point at devtron-services v0.0.0-20260819081723-33e7db5be0e5 (head of devtron-labs/devtron-services#401),
so the two PRs are meant to land together.
argo-cd v3.4 required two non-obvious changes
1. gitops-engine moved in-repo to github.com/argoproj/argo-cd/gitops-engine.
Argo CD resolves it with a local replace ./gitops-engine, which does not apply
to consumers, and the version it requires does not exist at the new path — so go mod tidy fails outright. Pinned via replace to the v3.4.7 tag revision and
repointed our 7 importing files. The old standalone github.com/argoproj/gitops-engine
is dropped entirely.
2. SyncPolicyAutomated.{Prune,SelfHeal,AllowEmpty} became *bool, and Enabled *bool was added. One real code change, in client/argocdServer/helper.go. Enabled == nil still means automated sync is
on, so behaviour is preserved — verified against the live CRD rather than assumed
(see below).
3. Dropped the filepath-securejoin replace.main pins it to v0.3.6 because
argo-cd/v2 needs the old MkdirAll signature; argo-cd v3 requires v0.6.1,
so that pin is wrong on this branch. Our v0.4.1 => form was already inert (the
require is v0.6.1, so the left-hand side never matched) — removed rather than left
as dead weight.
Build fixes
Dockerfile / DockerfileEA: golang:1.25.6 → 1.26.6. gitops-engine
requires go 1.26.0, so the go directive moved and the image build failed. Both
tags resolve to the same Debian trixie base (verified by comparing per-arch
digests), so no glibc shift for the ubuntu:24.04 runtime — which matters
because that build has CGO enabled.
Dropped a stray import "C" in pkg/config/configDiff/bean/bean.go. It had no
cgo preamble and used no C symbol, but it made the package cgo-only, so any
CGO-disabled build silently excluded every file in it
(build constraints exclude all Go files). Invisible in a native macOS build;
breaks GOOS=linux.
helm 3.20.2 deliberately not taken
It requires k8s 0.35.1, and no Argo CD release builds against k8s 0.35 (3.4.x
pins 0.34, 3.5.x pins 0.36). k8s stays at 0.34.9, one minor behind the 1.35.6
cluster — a supported skew. Deferred.
Also still open, no upstream fix: go-pg/pg v8.
Verification
Vendor-mode build of all non-mock packages for darwin and GOOS=linux;
devtron binary links
Against the live k8s 1.35.6 / Argo CD 3.4.6 cluster: discovery negotiated,
core/v1 + apps/v1 + batch/v1 + networking/v1 + rbac/v1 all listed. An
Application built from the v3.4.7 Go types — using the exact shape helper.go produces — was accepted by the real CRD via server-side dry-run
and decoded back intact (automated=true prune=true). Nothing persisted.
Devtron's own code hardcodes only apps/v1 and batch/v1; both are served by
1.35.6.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Fixes #6839
Targets the cluster running k8s 1.35.6 / Argo CD 3.4.6.
Dependency bumps
argo-cd/v3kin-openapigoogle.golang.org/grpccel-gogo-git/v5oras-go/v2oapi-codegen/v2common-lib/authenticatorpoint at devtron-servicesv0.0.0-20260819081723-33e7db5be0e5(head of devtron-labs/devtron-services#401),so the two PRs are meant to land together.
argo-cd v3.4 required two non-obvious changes
1. gitops-engine moved in-repo to
github.com/argoproj/argo-cd/gitops-engine.Argo CD resolves it with a local
replace ./gitops-engine, which does not applyto consumers, and the version it requires does not exist at the new path — so
go mod tidyfails outright. Pinned viareplaceto the v3.4.7 tag revision andrepointed our 7 importing files. The old standalone
github.com/argoproj/gitops-engineis dropped entirely.
2.
SyncPolicyAutomated.{Prune,SelfHeal,AllowEmpty}became*bool, andEnabled *boolwas added. One real code change, inclient/argocdServer/helper.go.Enabled == nilstill means automated sync ison, so behaviour is preserved — verified against the live CRD rather than assumed
(see below).
3. Dropped the
filepath-securejoinreplace.mainpins it to v0.3.6 becauseargo-cd/v2 needs the old
MkdirAllsignature; argo-cd v3 requires v0.6.1,so that pin is wrong on this branch. Our
v0.4.1 =>form was already inert (therequire is v0.6.1, so the left-hand side never matched) — removed rather than left
as dead weight.
Build fixes
Dockerfile/DockerfileEA:golang:1.25.6→1.26.6. gitops-enginerequires go 1.26.0, so the go directive moved and the image build failed. Both
tags resolve to the same Debian trixie base (verified by comparing per-arch
digests), so no glibc shift for the
ubuntu:24.04runtime — which mattersbecause that build has CGO enabled.
import "C"inpkg/config/configDiff/bean/bean.go. It had nocgo preamble and used no C symbol, but it made the package cgo-only, so any
CGO-disabled build silently excluded every file in it
(
build constraints exclude all Go files). Invisible in a native macOS build;breaks
GOOS=linux.helm 3.20.2 deliberately not taken
It requires k8s 0.35.1, and no Argo CD release builds against k8s 0.35 (3.4.x
pins 0.34, 3.5.x pins 0.36). k8s stays at 0.34.9, one minor behind the 1.35.6
cluster — a supported skew. Deferred.
Also still open, no upstream fix:
go-pg/pgv8.Verification
GOOS=linux;devtron binary links
core/v1 + apps/v1 + batch/v1 + networking/v1 + rbac/v1 all listed. An
Application built from the v3.4.7 Go types — using the exact shape
helper.goproduces — was accepted by the real CRD via server-side dry-runand decoded back intact (
automated=true prune=true). Nothing persisted.apps/v1andbatch/v1; both are served by1.35.6.
🤖 Generated with Claude Code