github.com/argoproj-labs/argocd-agent

0.9.0 - 2026-06-04

After 2 months, v0.9.0 is finally here.

This release's major focus is on bringing the hybrid architecture, which lets users move gradually from the push model to the agent based pull model within the same Argo CD instance, and eliminates the need to have an agent for the control plane to manage it using GitOps. Most of the work related to the hybrid architecture has been done by @chetan-rns, thanks a lot!

Furthermore, there is now a Helm chart for installing the principal (thanks @enbiyagoral), changes to logging, some minor performance related changes, bug fixes and a ton more.

Thanks to all the people who contributed to this release!

⛰️ Features

• (helm) Add Principal component Helm chart (#947) - (aafcbda) by @enbiyagoral
• (helm) Improve agent helm (#911) - (d5296cc) by @C4tWithShell
• (helm) Add missing params to agent helm chart (#888) - (83f3243) by @C4tWithShell
• Improve ha snapshot cleanup safety (#960) - (bcbd0c5) by @drewbailey
• Track dropped EventWriter events in metrics (#969) - (bafc148) by @jparsai
• Add additional logging/detail granularity to logging (#914) - (d50982a) by @jparsai
• Agent informer sync timeout configurable (#955) - (bcf0519) by @muzcategui1106
• Add metrics for worker queues (#931) - (6fc59b3) by @jannfis
• Source uid mismatch policy (#927) - (0556aff) by @drewbailey
• Allow sizing recv and send queues independently (#916) - (dcdc499) by @jannfis
• Sync credential templates to managed agents (#878) - (b7453bd) by @jparsai
• Allow setting the event queue size (#882) - (bc73cb0) by @jannfis
• Extend label selectors to other agent resources (#875) - (7bf3298) by @chetan-rns

🐛 Bug Fixes

• (build) Add BuildKit cache mounts and pin alpine version (#901) - (9aedb77) by @enbiyagoral
• (ci) Harden GitHub Actions workflow security (#898) - (48b8edc) by @enbiyagoral
• (ctl) Allow certificate chains in TLS secret validation (#907) - (fc3481f) by @EvannDev
• (e2e) Flaky GPG key and self-registration e2e tests (#932) - (7c3709d) by @jparsai
• (helm) Use appVersion as default image tag instead of latest (#895) - (e589ae1) by @enbiyagoral
• (informer) Check the correct underlying implementation for being synced (#910) - (1226ee0) by @jannfis
• (principal) Reconnect Subscribe on EventWriter send failures (#943) - (baa7be1) by @drewbailey
• (principal) Only accept agent connections after initialization is complete (#908) - (09a3d18) by @jannfis
• (redis-proxy) Fallback to principal redis for local apps in namespace-based mapping mode and hybrid architecture (#956) - (8765d38) by @lvkins
• Managed app shows outofsync/missing after re-create from unauthorized delete (#959) - (1e5e58b) by @jparsai
• Destination mapping shouldn't require agent name in AppProject sourceNamespaces (#966) - (c1a0da3) by @chetan-rns
• Detect if unmanaged app exists on agent before principal creates one (#964) - (aedf084) by @cjcocokrisp
• UI navigation to child apps fails in autonomous app-of-apps (#962) - (caaf2e6) by @jparsai
• Check if resource being patched is managed (#957) - (90cf3d9) by @cjcocokrisp
• Agent should remap apps from the principal namespace to the agent namespace (#892) - (c4c7ff2) by @chetan-rns
• Principal should allow apps from its namespace in the app filter chain (#945) - (3f057ff) by @chetan-rns
• Prevent lingering connections on connect failures (#944) - (5b5674c) by @jannfis
• Optional Redis TLS secret mounts on vcluster (#930) - (9860734) by @Rizwana777
• Obey informer options (#925) - (5114fe9) by @jannfis
• Respect managed app finalizer updates (#926) - (086ac24) by @drewbailey
• Send sync operation in a separate event to prevent overwriting (#834) - (675e0fe) by @chetan-rns
• Memory leak at agent component (#890) - (63a79be) by @C4tWithShell
• Respect Argo CD custom resource tracking labels (#886) - (8293967) by @drewbailey

📦 Dependency updates

• (deps) Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.43.0 to 1.44.0 (#974) - (15ad3e7) by @dependabot[bot]
• (deps) Bump github.com/redis/go-redis/v9 from 9.18.0 to 9.20.0 (#972) - (0b07449) by @dependabot[bot]
• (deps) Bump google.golang.org/grpc from 1.81.0 to 1.81.1 (#971) - (adda7d9) by @dependabot[bot]
• (deps) Bump Argo CD from v3.3.9 to v3.4.3 (#970) - (d5d7903) by @chetan-rns
• (deps) Bump google.golang.org/grpc from 1.80.0 to 1.81.0 (#936) - (0c64964) by @dependabot[bot]
• (deps) Bump github.com/argoproj/argo-cd/v3 from 3.3.8 to 3.3.9 (#934) - (f8f4160) by @dependabot[bot]
• (deps) Bump github.com/argoproj/argo-cd/v3 from 3.3.7 to 3.3.8 (#923) - (5dfc8b5) by @dependabot[bot]
• (deps) Bump github.com/argoproj/argo-cd/v3 from 3.3.6 to 3.3.7 (#909) - (2331cd0) by @dependabot[bot]
• (deps) Bump golang.org/x/net from 0.52.0 to 0.53.0 (#893) - (d253a47) by @dependabot[bot]
• (deps) Bump golang.org/x/crypto from 0.49.0 to 0.50.0 (#884) - (d7ac642) by @dependabot[bot]

🚜 Refactor

• Use %w instead of %v for error wrapping in fmt.Errorf calls (#965) - (605fa30) by @immanuwell

📚 Documentation

• Support for hybrid architecture (#946) - (5fd1a48) by @chetan-rns
• Fix typo (occured -> occurred) in CONTRIBUTING (#948) - (e9e4078) by @SAY-5
• Add doc for web-based terminal (#891) - (f37e7e0) by @jparsai

🧪 Testing

• Separate E2E namespace names to detect translation bugs (#939) - (b2aabf0) by @Rizwana777

⚙️ Miscellaneous Tasks

• (build) Use helm-docs from a container (#896) - (6bbfea2) by @jannfis
• (ci) Helm Chart Add CI check to make sure chart version is bumped whenever agent chart is updated (#952) - (b71d4cc) by @anandrkskd
• Add unit-tests flag to Codecov coverage upload (#967) - (08f35e0) by @AdamSaleh
• Add @jparsai as maintainer (#935) - (2f8cd99) by @jannfis
• Harden Helm chart validation pipeline (#928) - (5230ede) by @C4tWithShell
• Improve event writer logging (#906) - (f190566) by @jannfis
• Add @drewbailey as maintainer (#897) - (9b36370) by @jannfis

◀️ Revert

• (ci) Revert slsa generators to be referenced by tag on release pipeline (#900) - (790c7bc) by @cjcocokrisp

Build

• Update build configs (#874) - (a2c99e2) by @jparsai

Release

• Init 0.9.0 release on branch release-0.9 (#976) - (8b3b9d4) by @github-actions[bot]

New Contributors ❤️

• @github-actions[bot] made their first contribution in #976
• @enbiyagoral made their first contribution in #947
• @AdamSaleh made their first contribution in #967
• @lvkins made their first contribution in #956
• @immanuwell made their first contribution in #965
• @muzcategui1106 made their first contribution in #955
• @SAY-5 made their first contribution in #948
• @EvannDev made their first contribution in #907

0.8.1 - 2026-04-08

Although this is a patch release, it contains a new feature as an exception.

It adds a feature (label selector for all resources) that was originally intended to ship with 0.8.0, but we forgot to merge before cutting the 0.8.0 release. Since it extends, but breaks, a mechanism (label selector for Application resources only) that was first shipped with 0.8.0 we decided to make an exception and ship a feature with a patch release - before people start using the feature 😄

⛰️ Features

• Extend label selectors to other agent resources (#875) - (3a42642) by @chetan-rns

Release

• Init 0.8.1 release on branch release-0.8 (#881) - (2fabfa5) by @github-actions[bot]

0.8.0 - 2026-04-08

This release brings a couple of new exciting features and bug fixes:

• Most notably, argocd-agent now supports principal-to-principal replication for failover purposes. This big feature has been contributed by @drewbailey, thanks a lot! Please note that this feature is currently in beta, and we expect some changes going forward. But please feel free to give it a spin and provide us with feedback, we'd be extremely grateful!

• Starting with this release, we provide provenance for our release assets - including SBOMs and verifiable container images and CLI binaries. Thanks a lot to @cjcocokrisp for contributing this features along with release automation through GitHub actions.

• This release also contains a few important performance and scalability enhancements.

For the full list of changes, please read on.

Thanks to all the wonderful people that have contributed to this release! You rock!

⛰️ Features

• (cli) Add support for local configuration file to argocd-agentctl (#797) - (fff4237) by @cjcocokrisp
• (cli) Additional checks to check config cmd (#775) - (f187412) by @cjcocokrisp
• (helm) Add ServiceMonitor and security enhancements to argocd-agent (#776) - (b41a6d7) by @C4tWithShell
• (redis) Permit reading credentials from a volume mount (#771) - (d3ca8d2) by @olivergondza
• Allow setting number of event processors (#869) - (178147e) by @jannfis
• Multi-principal uid handling (#833) - (8b490ef) by @drewbailey
• Expose k8s client metrics (#845) - (7b21c00) by @drewbailey
• Sync gpg keys to managed agents (#807) - (5096e31) by @jparsai
• Add active/passive HA support to argocd-agent principal (#768) - (d226a32) by @drewbailey
• Add chaos testing utility and instructions (#817) - (bb104f2) by @jgwest
• Redis TLS encryption enabled by default for all connections (#664) - (c65aed8) by @Rizwana777
• Measure agent event propagation latency (#808) - (21765d2) by @drewbailey
• Filter in-cluster apps in destination-based mapping mode (#804) - (7f4eaa7) by @drewbailey
• Add a label selector to the principal (#795) - (e7e9276) by @chetan-rns
• Add --ignore-unmanaged-apps flag for managed mode (#791) - (ace55fc) by @drewbailey
• Make agent and principal handshake upon connection (#757) - (33793fe) by @Rizwana777

🐛 Bug Fixes

• (install) Remove applicationsets CRD to fix kubectl apply annotation size limit (#789) - (840b849) by @atilsensalduz
• (resource-proxy) Use list options for listing resources (#765) - (0c703db) by @jannfis
• Data race between 'sendCurrentStateToAgent' and 'syncRepositoriesForProject' (#867) - (09b7384) by @cjcocokrisp
• Fall back to SPDY when WebSocket exec is rejected for web-terminal (#848) - (8d3a3d4) by @jparsai
• Filter repositories and gpg cm with the ignore-sync label (#861) - (c2f995b) by @chetan-rns
• Data race between Server.Start() and informer goroutines in principal (#863) - (88b89e7) by @jparsai
• Prevent stale onDisconnect from overwriting active connection status (#857) - (9fefbfa) by @jparsai
• Resync request handler does not support GPG Key (#855) - (2d793b4) by @jparsai
• Refresh JWT access token before expiry to prevent terminal/log stream failure (#853) - (6a3df34) by @jparsai
• Data race between WaitForCompletion and closeChannels in log streaming (#856) - (e12024e) by @jparsai
• Use active gRPC streams instead of queues for agent connectivity checks (#836) - (ee7306e) by @chetan-rns
• Logger fix ACK routing mapping to agent queue (#843) - (a17c975) by @drewbailey
• Set a more sane kube-client QPS limit (#844) - (3e7bb73) by @jannfis
• AppProject is deleted on principal restart for autonomous agents (#822) - (3a0ccb0) by @jparsai
• Add known good redis prefixes to forward-to-principal list (#816) - (0de5796) by @jgwest
• SkipSync label not respected on AppProjects if connection is lost (#790) - (b4cb776) by @jgwest

📦 Dependency updates

• (deps) Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.42.0 to 1.43.0 (#872) - (962af8f) by @dependabot[bot]
• (deps) Bump go.opentelemetry.io/otel from 1.42.0 to 1.43.0 (#870) - (f6fb3f2) by @dependabot[bot]
• (deps) Bump google.golang.org/grpc from 1.79.3 to 1.80.0 (#865) - (b0a27f5) by @dependabot[bot]
• (deps) Bump github.com/rs/zerolog from 1.34.0 to 1.35.0 (#859) - (9c8237e) by @dependabot[bot]
• (deps) Bump github.com/argoproj/argo-cd/v3 from 3.3.5 to 3.3.6 (#854) - (964ed8d) by @dependabot[bot]
• (deps) Bump github.com/argoproj/argo-cd/v3 from 3.3.4 to 3.3.5 (#835) - (7e2d8ed) by @dependabot[bot]
• (deps) Bump google.golang.org/grpc from 1.79.2 to 1.79.3 (#821) - (043b2cf) by @dependabot[bot]
• (deps) Bump github.com/argoproj/argo-cd/v3 from 3.3.3 to 3.3.4 (#815) - (c94e6bb) by @dependabot[bot]
• (deps) Bump golang.org/x/net from 0.51.0 to 0.52.0 (#811) - (b85f4a3) by @dependabot[bot]
• (deps) Bump github.com/argoproj/argo-cd/v3 from 3.3.2 to 3.3.3 (#802) - (feee694) by @dependabot[bot]
• (deps) Bump golang.org/x/sync from 0.19.0 to 0.20.0 (#801) - (eba1f86) by @dependabot[bot]
• (deps) Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.41.0 to 1.42.0 (#800) - (e310eaa) by @dependabot[bot]
• (deps) Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.41.0 to 1.42.0 (#799) - (d7dcd04) by @dependabot[bot]
• (deps) Bump google.golang.org/grpc from 1.79.1 to 1.79.2 (#794) - (93c5252) by @dependabot[bot]
• (deps) Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.40.0 to 1.41.0 (#786) - (964a888) by @dependabot[bot]
• (deps) Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.41.0 (#785) - (5ac9047) by @dependabot[bot]
• (deps) Bump golang.org/x/net from 0.50.0 to 0.51.0 (#774) - (869f409) by @dependabot[bot]
• (deps) Bump github.com/alicebob/miniredis/v2 from 2.36.1 to 2.37.0 (#773) - (3891e6a) by @dependabot[bot]
• (deps) Replace k8s deps that have version 0.0.0 (#770) - (5991957) by @olivergondza

🚜 Refactor

• Rename check-config command to validate (#824) - (924774a) by @jannfis

📚 Documentation

• Wire up HA docs into the navigation (#825) - (b839853) by @jannfis
• Contribute early 'application sync' design doc from September 2024 (#823) - (cca25ff) by @jgwest
• Document ApplicationSet support (#810) - (cee1a41) by @jannfis
• Note ApplicationSet conditional availability (#780) - (4c20c7e) by @johnstonmatt
• Document ApplicationSet support - (5eb053c) by @jannfis
• Update features page to reflect reality (#777) - (3c41502) by @jannfis

⚙️ Miscellaneous Tasks

• (ci) Update checkout action version to v6.0.2 (#837) - (2024aeb) by @cjcocokrisp
• (ci) Run the CI on release branches, too (#829) - (f276dfd) by @jannfis
• (dev-env) Allow specific Argo CD versions to be installed (#763) - (ca73656) by @jannfis
• (release) Add cliff.toml configuration (#819) - (4f19776) by @jannfis
• (release-notes) Fine-tune release notes generator config (#828) - (b2c37f3) by @jannfis
• Add a log message when the destination based mapping is enabled (#862) - (b1180f7) by @chetan-rns
• Improve logging in the resync package (#860) - (5ebedca) by @jannfis
• Extract service mesh docs from networking into their own doc page (#849) - (8b49ded) by @jgwest
• Fix incorrect list whitespace in docs/ markdown (#851) - (e1ea6e0) by @jgwest
• Fix doc whitespace and bullets (#850) - (1bc255d) by @jgwest
• Remove unused 'Update' event in 'internal/event' (#818) - (8c9e80f) by @jgwest

Build

• (release) Automate releases (#830) - (8751e99) by @cjcocokrisp

New Contributors ❤️

• @johnstonmatt made their first contribution in #780
• @C4tWithShell made their first contribution in #776
• @atilsensalduz made their first contribution in #789
• @olivergondza made their first contribution in #771

Signed-off-by: jannfis jann@mistrust.net

Signed-off-by: jannfis jann@mistrust.net

Signed-off-by: jannfis jann@mistrust.net

0.7.4 - 2026-03-27

v0.7.4 is a small patch releases that fixes a critical performance bug (thanks @drewbailey for discovering this).

🐛 Bug Fixes

• Set a more sane kube-client QPS limit (#844) - (9a444c5) by @jannfis

0.7.3 - 2026-03-23

🐛 Bug Fixes

• AppProject is deleted on principal restart for autonomous agents (#822) - (9d68a54) by @jparsai

Release

• Publish release 0.7.3 - (454fa5b) by @jannfis

0.7.2 - 2026-03-23

A quick patch release that bumps gRPC to v1.79.3 to mitigate CVE-2026-33186. We do not believe argocd-agent is vulnerable to this at this point in time, but decided to bump the version anyway.

Chore

• (deps) Bump google.golang.org/grpc to v1.79.3 (#827) - (a0bde08) by @jannfis

Release

• Publish release 0.7.2 - (5b30ac0) by @jannfis

Signed-off-by: jannfis jann@mistrust.net