Skip to content

v3.6 to 3.7

Breaking Changes

Behavioral Improvements / Fixes

ApplicationSet webhook responses now match the API server webhook

The ApplicationSet controller's webhook endpoint now handles requests the same way as the API server's /api/webhook endpoint:

  • Payloads larger than the webhook.maxPayloadSizeMB value in the argocd-cm ConfigMap (default 50MB) are rejected with 400 Bad Request. Previously, the ApplicationSet webhook had no payload size limit.
  • A GHCR event that fails signature verification is rejected with 401 Unauthorized instead of 400 Bad Request.
  • When a payload cannot be parsed, the response body is a generic Webhook processing failed message. The parser error is logged by the ApplicationSet controller instead of being returned to the caller.

If you monitor the ApplicationSet webhook's response codes or bodies, update any checks that relied on the previous behavior.

Other Changes

Revoked token resync interval

argocd-server now reloads revoked tokens from Redis every 5 minutes instead of every 15 seconds. The interval is configurable with ARGOCD_SESSION_REVOKED_TOKEN_RESYNC_DURATION. See Revoked token resync.