v2.6.0-rc5

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.6.0-rc5/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.6.0-rc5/manifests/ha/install.yaml

Release signatures

All Argo CD container images and CLI binaries are signed by cosign. See the documentation on how to verify the signatures.

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEesHEB7vX5Y2RxXypjMy1nI1z7iRG
JI9/gt/sYqzpsa65aaNP4npM43DDxoIy/MQBo9s/mxGxmA+8UXeDpVC9vw==
-----END PUBLIC KEY-----

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Known Issues

If you use the bundled Dex instance for SSO, a bug in 2.6.0-rc5 will prevent CLI clients from successfully authenticating with the Argo CD API. A patch for the bug is being tested as of Friday, Jan 27, and a fix will be released shortly.

Changes

This release includes 6 contributions from 6 contributors (1 of them new) with 0 features and 2 bug fixes.

A special thanks goes to the 1 new contributors:

• Mike Bryant

Security (2)

• CRITICAL: JWT audience claim is not verified (GHSA-q9hr-j4rf-8fjc)
• HIGH: Controller reconciles apps outside configured namespaces when sharding is enabled (GHSA-6p4m-hw2h-6gmw)

Bug fixes (2)

• fix: Support resource actions for apps in different Namespace (#12115)
• fix: values should always be visible, even when they are empty (#11676) (#11681)

Documentation (1)

• docs: clarify value for disabling tools (#11395)

Other (1)

• chore: disable docker sbom and attestations (#12059)