Skip to content

feat(deps): migrate argo-cd v2->v3 and upgrade to k8s 1.34#6985

Draft
prkhrkat wants to merge 1 commit into
dependabot-fixesfrom
k8s-1.34-argocd-v3
Draft

feat(deps): migrate argo-cd v2->v3 and upgrade to k8s 1.34#6985
prkhrkat wants to merge 1 commit into
dependabot-fixesfrom
k8s-1.34-argocd-v3

Conversation

@prkhrkat

Copy link
Copy Markdown
Contributor

Draft — do not merge before regression testing. This is the major dependency migration, meant to ship after the security-patch PR #6983 is released. Based on dependabot-fixes so the diff shows only the migration; GitHub will auto-retarget to main once #6983 merges.

Summary

Migrates the Argo CD integration from argo-cd/v2 → argo-cd/v3 and upgrades the Kubernetes stack to 1.34. This is the stable landing zone ("Path A") chosen to avoid depending on an argo-cd release candidate. make build produces the binary; the only remaining build failures are the pre-existing broken mock packages (pkg/*/mocks, mock_pipeline), unchanged from before this branch and not part of the binary.

Why the major version bump was unavoidable

k8s 0.35 completed the gogo-protobuf removal (API types lost ProtoMessage()), which breaks argo-cd v2's generated gRPC-gateway code. The argo-cd v2 line ends at 2.14.x and never supports k8s 0.34+. So moving off the vulnerable/old stack requires argo-cd v3 (module path argoproj/argo-cd/v3).

Dependency changes

Package From To
github.com/argoproj/argo-cd/v2/v3 v2.14.20 v3.3.12
k8s.io/* 0.33.x 0.34.9
k8s.io/kubernetes 1.33.x 1.34.9
helm.sh/helm/v3 3.18.6 3.19.5 (k8s 0.34 compatible)
github.com/argoproj/gitops-engine (May-2025 pin) v0.7.1-0.20250908182407-97ad5b59a627 (smd/v6, matches argo-cd v3.3.12)

argo-cd v3.3.12 deliberately chosen over v3.4/v3.5 because it still uses the standalone argoproj/gitops-engine (same module path devtron already imports) — v3.4+ re-bundle it, which would force rewriting 35 more files.

Code changes

  • Rewrote all argoproj/argo-cd/v2/... imports → .../v3/... (43 files)
  • Modernized 3 gRPC dial sites to the current otelgrpc API (NewClientHandler via WithStatsHandler) — otelgrpc v0.63.0 (pinned by argo-cd v3.3.12) removed UnaryClientInterceptor/StreamClientInterceptor; dropped the now-dead otelgrpc v0.61.0 => v0.46.1 replace
  • Regenerated wire_gen.go

Deferred (needs a separate effort)

The helm 3.20.2 CVE fix (Dependabot #135, medium) requires k8s ≥ 0.35.1, which requires argo-cd v3.5.0-rc2 (a release candidate) plus the re-bundled gitops-engine (+35 files). Deferred until argo-cd v3.5 is stable to avoid an RC dependency in production.

Verification

  • make build → binary produced, wire codegen succeeds
  • go build ./... → only pre-existing mock packages fail (identical to baseline)

Testing needed before merge

Full regression testing of the GitOps / Argo CD integration (app sync, cluster/repo management, resource tree, deployment status) — this is a major-version bump of the core Argo CD client.

🤖 Generated with Claude Code

Major dependency migration (Path A: stable landing zone). Builds green
via `make build`; only the pre-existing broken mock packages remain
(unchanged from before, not part of the binary).

Dependency changes:
- github.com/argoproj/argo-cd/v2 v2.14.20 -> argo-cd/v3 v3.3.12
  (module-path change; v2 line ends at 2.14.x and cannot compile against
   k8s 0.34+ after the gogo-protobuf removal)
- k8s.io/* 0.33.x -> 0.34.9, k8s.io/kubernetes -> 1.34.9
- helm.sh/helm/v3 3.18.6 -> 3.19.5 (k8s 0.34 compatible)
- github.com/argoproj/gitops-engine -> v0.7.1-0.20250908182407-97ad5b59a627
  (smd/v6 + k8s 0.34; kept standalone, matching argo-cd v3.3.12's own pin)

Code changes:
- Rewrite all `argoproj/argo-cd/v2/...` imports to `.../v3/...` (43 files)
- Modernize 3 gRPC dial sites to the current otelgrpc API
  (NewClientHandler via WithStatsHandler) since otelgrpc v0.63.0 removed
  UnaryClientInterceptor/StreamClientInterceptor; drop the now-dead
  otelgrpc v0.61.0 => v0.46.1 replace
- Regenerate wire_gen.go

Deliberately NOT included (require argo-cd v3.5-rc / k8s 0.35, deferred):
- helm 3.20.2 CVE fix (needs k8s >= 0.35.1, which needs argo-cd v3.5 RC)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@bito-code-review

Copy link
Copy Markdown

Bito Automatic Review Skipped - Draft PR

Bito didn't auto-review because this pull request is in draft status.
No action is needed if you didn't intend for the agent to review it. Otherwise, to manually trigger a review, type /review in a comment and save.
You can change draft PR review settings here, or contact your Bito workspace admin at shivam@devtron.ai.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant