chore(deps): argo-cd v2->v3 + k8s 1.34 migration and Dependabot patches - #7011
Open
prkhrkat wants to merge 8 commits into
Open
chore(deps): argo-cd v2->v3 + k8s 1.34 migration and Dependabot patches#7011prkhrkat wants to merge 8 commits into
prkhrkat wants to merge 8 commits into
Conversation
Major dependency migration (Path A: stable landing zone). Builds green via `make build`; only the pre-existing broken mock packages remain (unchanged from before, not part of the binary). Dependency changes: - github.com/argoproj/argo-cd/v2 v2.14.20 -> argo-cd/v3 v3.3.12 (module-path change; v2 line ends at 2.14.x and cannot compile against k8s 0.34+ after the gogo-protobuf removal) - k8s.io/* 0.33.x -> 0.34.9, k8s.io/kubernetes -> 1.34.9 - helm.sh/helm/v3 3.18.6 -> 3.19.5 (k8s 0.34 compatible) - github.com/argoproj/gitops-engine -> v0.7.1-0.20250908182407-97ad5b59a627 (smd/v6 + k8s 0.34; kept standalone, matching argo-cd v3.3.12's own pin) Code changes: - Rewrite all `argoproj/argo-cd/v2/...` imports to `.../v3/...` (43 files) - Modernize 3 gRPC dial sites to the current otelgrpc API (NewClientHandler via WithStatsHandler) since otelgrpc v0.63.0 removed UnaryClientInterceptor/StreamClientInterceptor; drop the now-dead otelgrpc v0.61.0 => v0.46.1 replace - Regenerate wire_gen.go Deliberately NOT included (require argo-cd v3.5-rc / k8s 0.35, deferred): - helm 3.20.2 CVE fix (needs k8s >= 0.35.1, which needs argo-cd v3.5 RC) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bumps (all verified with a clean vendor-mode build):
argo-cd/v3 3.3.12 -> 3.4.7 (matches cluster Argo CD 3.4.6)
grpc 1.79.3 -> 1.82.1
kin-openapi 0.132.0 -> 0.144.0 (CRITICAL)
cel-go 0.26.0 -> 0.29.0
go-git/v5 5.19.1 -> 5.19.2
oras-go/v2 2.6.1 -> 2.6.2
oapi-codegen/v2 2.4.2 -> 2.7.1
argo-cd v3.4 moved gitops-engine in-repo to
github.com/argoproj/argo-cd/gitops-engine. Its own go.mod resolves that
via a local `replace ./gitops-engine`, which does not apply to consumers,
and the version it requires (v0.7.1-0.2025...) does not exist at the new
path. Pinned it here with a replace to the revision of the v3.4.7 tag,
and repointed our 7 importing files at the new module path. The old
standalone github.com/argoproj/gitops-engine is now dropped entirely.
argo-cd v3.4 also changed SyncPolicyAutomated.{Prune,SelfHeal,AllowEmpty}
from bool to *bool and added Enabled *bool. Enabled == nil still means
automated sync is on, so leaving it nil preserves existing behaviour.
helm 3.20.2 is deliberately NOT taken: it requires k8s 0.35.1, and no
Argo CD release builds against k8s 0.35 (3.4.x pins 0.34, 3.5.x pins
0.36). Deferred to a stacked branch. k8s stays at 0.34.9.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
argo-cd v3.4.7 pulls in gitops-engine, which requires go 1.26.0, so the module's go directive moved 1.25.5 -> 1.26.0 and the image build failed against golang:1.25.6. Both golang:1.25.6 and golang:1.26.6 resolve to the same Debian trixie base (verified by comparing per-arch digests), so this is a Go patch bump only — no glibc change for the ubuntu:24.04 runtime stage, which matters because the build runs with CGO enabled. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
pkg/config/configDiff/bean/bean.go carries a bare `import "C"` with no cgo preamble and no C symbol used anywhere in the file. It came in with the infra-config refactor (822fa30) and is absent from main. Importing "C" makes the package cgo-only, so any build with CGO disabled excludes every file in it: package .../pkg/config/configDiff/bean: build constraints exclude all Go files That is invisible in a native macOS build (cgo on) but breaks `GOOS=linux go build` from darwin, which is how the release image is verified before it is built. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Conflicts resolved in favour of this branch (-X ours), which is correct for
the argo-cd migration: main still imports argo-cd/v2 in
ArgoClientWrapperService.go and GitOpsConfigService.go, and taking main's
side there would have regressed the v2 -> v3 work.
Three things needed hand-resolution on top of -X ours, because "ours" alone
did not produce a building tree:
* go.mod / vendor: -X ours kept our go.mod while vendor/modules.txt
auto-merged to main's, leaving the tree inconsistent ("inconsistent
vendoring"). Adopted main's newer common-lib / authenticator
(20260709 -> 20260803-66fcb35e4b0e) to match the vendored code that came
in with the merge, and carried over main's otelgrpc v0.61.0 => v0.46.1
replace, then re-vendored.
* Dropped the filepath-securejoin replace entirely. Main pins it
unversioned to v0.3.6 because argo-cd/v2 needs the old MkdirAll
signature; argo-cd v3.3.12 requires v0.6.1, so adopting main's pin would
break this branch. Our side's `v0.4.1 =>` form was already inert (the
require is v0.6.1, so the LHS never matched) - removed rather than left
as dead weight.
* Restored stdlib imports dropped by -X ours. Main added net/http, strings,
time and strconv to the two conflicted files; the code using them arrived
through non-conflicting hunks, so keeping our import block alone left
them undefined.
Verified: vendor-mode build of all non-mock packages for both darwin and
GOOS=linux, and the devtron binary links.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Brings in main (via the merge on k8s-1.34-argocd-v3) plus the services-sync commit, so this branch is current with main before opening a PR. Only go.mod / go.sum / vendor/modules.txt conflicted; all source merged cleanly. Resolved as the union: * argo-cd/v3 v3.4.7 and the argo-cd/gitops-engine replace kept from this branch (the whole point of it). * common-lib / authenticator taken from the base branch's services-sync (v0.0.0-20260819081723-33e7db5be0e5). * main's otelgrpc v0.61.0 => v0.46.1 replace carried over. * filepath-securejoin replace dropped: argo-cd v3.4.7 requires v0.6.1, and the `v0.4.1 =>` form was already inert since the require is v0.6.1. go.sum and vendor/modules.txt regenerated with tidy + vendor rather than hand-merged. Verified: vendor-mode build of all non-mock packages for darwin and GOOS=linux, and the binary links. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Bito Automatic Review Skipped - PR Too Large |
github.com/argoproj/argo-cd/gitops-engine sorts before github.com/argoproj/argo-cd/v3, so repointing the import left these blocks out of order. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1' | ||
| ) | ||
|
|
||
| resource sa 'Microsoft.Storage/storageAccounts@2021-08-01' = if (deployResources) { |
| } | ||
| } | ||
|
|
||
| resource saUserAssigned 'Microsoft.Storage/storageAccounts@2021-08-01' = if (deployResources) { |
| '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1' | ||
| ) | ||
|
|
||
| resource sa 'Microsoft.Storage/storageAccounts@2021-08-01' = if (deployResources) { |
| '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1' | ||
| ) | ||
|
|
||
| resource sa 'Microsoft.Storage/storageAccounts@2021-08-01' = if (deployResources) { |
| '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1' | ||
| ) | ||
|
|
||
| resource sa 'Microsoft.Storage/storageAccounts@2021-08-01' = if (deployResources) { |
| location: location | ||
| name: uniqueString(resourceGroup().id) | ||
| properties: { | ||
| adminUserEnabled: true |
| } | ||
| } | ||
|
|
||
| resource azfunc 'Microsoft.Web/sites@2021-03-01' = if (deployResources) { |
| } | ||
| } | ||
|
|
||
| resource aks 'Microsoft.ContainerService/managedClusters@2023-06-01' = if (deployResources) { |
Comment on lines
+204
to
+216
| { | ||
| count: 1 | ||
| enableAutoScaling: false | ||
| kubeletDiskType: 'OS' | ||
| mode: 'System' | ||
| name: 'agentpool' | ||
| osDiskSizeGB: 128 | ||
| osDiskType: 'Managed' | ||
| osSKU: 'Ubuntu' | ||
| osType: 'Linux' | ||
| type: 'VirtualMachineScaleSets' | ||
| vmSize: 'Standard_D2s_v3' | ||
| } |
Comment on lines
+371
to
+373
| osDisk: { | ||
| createOption: 'FromImage' | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #6839
Targets the cluster running k8s 1.35.6 / Argo CD 3.4.6.
Dependency bumps
argo-cd/v3kin-openapigoogle.golang.org/grpccel-gogo-git/v5oras-go/v2oapi-codegen/v2common-lib/authenticatorpoint at devtron-servicesv0.0.0-20260819081723-33e7db5be0e5(head of devtron-labs/devtron-services#401),so the two PRs are meant to land together.
argo-cd v3.4 required two non-obvious changes
1. gitops-engine moved in-repo to
github.com/argoproj/argo-cd/gitops-engine.Argo CD resolves it with a local
replace ./gitops-engine, which does not applyto consumers, and the version it requires does not exist at the new path — so
go mod tidyfails outright. Pinned viareplaceto the v3.4.7 tag revision andrepointed our 7 importing files. The old standalone
github.com/argoproj/gitops-engineis dropped entirely.
2.
SyncPolicyAutomated.{Prune,SelfHeal,AllowEmpty}became*bool, andEnabled *boolwas added. One real code change, inclient/argocdServer/helper.go.Enabled == nilstill means automated sync ison, so behaviour is preserved — verified against the live CRD rather than assumed
(see below).
3. Dropped the
filepath-securejoinreplace.mainpins it to v0.3.6 becauseargo-cd/v2 needs the old
MkdirAllsignature; argo-cd v3 requires v0.6.1,so that pin is wrong on this branch. Our
v0.4.1 =>form was already inert (therequire is v0.6.1, so the left-hand side never matched) — removed rather than left
as dead weight.
Build fixes
Dockerfile/DockerfileEA:golang:1.25.6→1.26.6. gitops-enginerequires go 1.26.0, so the go directive moved and the image build failed. Both
tags resolve to the same Debian trixie base (verified by comparing per-arch
digests), so no glibc shift for the
ubuntu:24.04runtime — which mattersbecause that build has CGO enabled.
import "C"inpkg/config/configDiff/bean/bean.go. It had nocgo preamble and used no C symbol, but it made the package cgo-only, so any
CGO-disabled build silently excluded every file in it
(
build constraints exclude all Go files). Invisible in a native macOS build;breaks
GOOS=linux.helm 3.20.2 deliberately not taken
It requires k8s 0.35.1, and no Argo CD release builds against k8s 0.35 (3.4.x
pins 0.34, 3.5.x pins 0.36). k8s stays at 0.34.9, one minor behind the 1.35.6
cluster — a supported skew. Deferred.
Also still open, no upstream fix:
go-pg/pgv8.Verification
GOOS=linux;devtron binary links
core/v1 + apps/v1 + batch/v1 + networking/v1 + rbac/v1 all listed. An
Application built from the v3.4.7 Go types — using the exact shape
helper.goproduces — was accepted by the real CRD via server-side dry-runand decoded back intact (
automated=true prune=true). Nothing persisted.apps/v1andbatch/v1; both are served by1.35.6.
🤖 Generated with Claude Code