GitOps is now the definitive standard for managing Kubernetes cluster configuration and applications. Red Hat continues to see the widespread adoption of the GitOps methodology across our portfolio as customers look for ways to increase efficiency in their operations and development teams.
Red Hat is pleased to announce that version 1.22 of OpenShift GitOps has been released, bringing with it some exciting new capabilities.
New in version 1.22
GitOps Promoter 0.35 (Technical Preview)
A challenge organizations face when adopting a GitOps methodology is how to effectively manage environment promotions of manifests. In this release GitOps Promoter 0.35 is included, it enables organizations to manage the promotion process using a simple PromotionStrategy CR to define the environments and any required gating.
Note that you will need to provide a certificate for the promoter-apiservice otherwise the pod will not start. The easiest way to do so is to leverage the OpenShift serving service to provide a certificate. To do so, after enabling the promoter run the following command:
oc annotate service argocd-promoter-apiserver service.beta.openshift.io/serving-cert-secret-name=argocd-promoter-apiserver-tlsNext update the ArgoCD.spec.promoter configuration to specify the certificate that is created by the service as per this example:
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
name: argocd
namespace: argocd
spec:
promoter:
apiserver:
enabled: true
tls:
caSecretKey: tls.key
caSecretName: argocd-promoter-apiserver-tls
certSecretName: argocd-promoter-apiserver-tls
argoCDUIExtensionEnabled: true
enabled: true
webhook:
enabled: trueArgo CD Source Hydrator (Technical Preview)
The Argo CD Source Hydrator implements the Rendered Manifest pattern by automating the rendering template-based "DRY" sources (e.g. Helm or Kustomize) into fully hydrated YAML manifests and commits them back to Git prior to cluster deployment. Benefits include:
- Full Diff Auditability: Provides complete visibility into exact, pre-rendered YAML changes directly in Git prior to sync.
- Deterministic Deployments: Eliminates sync failures caused by tool version mismatches or dynamic rendering issues.
- Image Updater Integration: Seamlessly triggers hydration workflows when Argo CD Image Updater updates image tags in DRY source repos.
Additionally the GitOps Promoter operates on distinct environment branches where changes in the DRY branch must be copied into the environment preview branches. The Argo CD Source Hydrator automates this process simplifying the adoption of the GitOps Promoter.
Impersonation Support in Application Syncs (Technical Preview)
In multi-tenant Argo CD, the application-controller Kubernetes ServiceAccount requires the highest permissions of the most privileged tenant. While the access provided by this Account can be mitigated via Argo CD Projects, Impersonation enables organizations to provide tailored ServiceAccounts with the exact Kubernetes RBAC permissions required by each tenant to enhance isolation.
In previous releases Impersonation only applied to the Sync operation, however in Argo CD 3.5 the scope of this feature has been expanded to include other operations as per the migration notes.
Important: Argo CD Projects remain an important part of the overall Argo CD security landscape and is not replaced by Impersonation. Users must continue to configure resource restrictions.
ApplicationSets-In-Any-Namespace
ApplicationSets-In-Any-Namespace have entered General Availability. This feature joins Applications-In-Any-Namespace in enabling tenants to fully manage their own Argo CD resources outside of the Argo CD installation namespace. This enables tenants to fully manage these resources declaratively and not be bound to managing them imperatively via the Argo CD UI or CLI.
OpenShift Console Plugin for OpenShift GitOps
In this release, the OpenShift Console Plugin for OpenShift GitOps enters General Availability. This plugin provides a user interface within the OpenShift Console to manage various GitOps resources including:
- Applications
- ApplicationSets
- AppProjects
- ImageUpdater
- Rollouts
Source Integrity Verification
The Source Integrity Verification enters General Availability, this enables validating and restricting Application syncs based on configured source integrity criteria.
- Cryptographic Signing: Enforce Git commits and tags use valid GnuPG signatures before syncing.
- Block Unverified Changes: Prevents unauthorized or untampered code from deploying by validating against trusted Key IDs.
- Per-Source Controls: Configurable via AppProject definitions, allowing distinct verification rules for multi-source applications.
This feature will replace the previous GnuPG Signature Verification feature as per the migration notes. While the GnuPG Signature Verification will continue to function as a legacy feature in this release, users are encouraged to upgrade to the Source Integrity Verification feature.
Argo CD 3.5
This version upgrades Argo CD to 3.5 from 3.4 that was used in the previous version OpenShift GitOps 1.21. Some of the changes in Argo CD 3.5 to be aware of include:
Support for Helm 4 has been included
A new UI for ApplicationSets in the Argo CD UI is now available as a Technical Preview feature.
The upstream release blog for Argo CD 3.5 is available here and changes to be aware of between 3.4 and 3.5 can be found here.
Conclusion
OpenShift GitOps 1.22 is a significant update with many new features, to learn more about this update please review the official documentation and release notes.
