--- schema_version: 1 route: /t/argocd.md tool: "argocd" --- # sincecutoff.com /t/argocd — Argo CD - name: Argo CD - kind: service - children: none - homepage: Changes to the tools coding agents drive, since a model's training cutoff, each linked to its first-party source. Check installed versions and limitations before acting; a cutoff date does not establish what a model knows. Original editorial content: [Apache 2.0](https://sincecutoff.com/v1/data-license.txt), by [0xPatrick](https://0xpatrick.dev). Preserve applicable license and [NOTICE](https://sincecutoff.com/notice.txt) attribution when redistributing. Third-party source text and examples retain their own rights. [License scope and attribution](https://sincecutoff.com/v1/license.json). To stay current, read the changes feed: [`/v1/changes.md?tool=argocd`](https://sincecutoff.com/v1/changes.md?tool=argocd) (or `.json`), adding `since=YYYY-MM-DD` for your training cutoff. Entries for registered children are included; the registry itself is `/v1/tools.json`. How to page and save your place: [llms.txt](https://sincecutoff.com/llms.txt). ### Application toggle-auto-sync resource action (2026-08-04) - slug: application-toggle-auto-sync-resource-action-036002c5012a - score: 0.97 How to use it: When a role needs to toggle an Application's auto-sync without broad update access, grant the dedicated action permission and run `toggle-auto-sync` on the Application. Disabling saves the documented auto-sync settings, while enabling restores saved settings when present. Examples: ``` p, role:dev, applications, action/argoproj.io/Application/toggle-auto-sync, */*, allow ``` ``` argocd app actions run toggle-auto-sync --kind Application --group argoproj.io ``` - why_it_matters: Grant a role permission to toggle autosync on an Application without granting broad application update permission. - before: Toggling auto-sync required the broad `application update` permission. - sources: , , , - gotchas: "Version: v3.5.0"; "applications (required): RBAC resource on which the action permission applies."; "action/argoproj.io/Application/toggle-auto-sync (required): Action path; format is `action///`."; " (required): Application name."; "toggle-auto-sync (required): Action name to run."; "--kind Application (required): Selects the resource kind; `--kind` is the required filter."; "--group argoproj.io: Selects the resource API group."; "--resource-name : Filters by resource name."; "--namespace : Filters by resource namespace."; "--all: Runs the action on all matching resources when more than one matches."; "Prerequisite: Resource actions are controlled with the RBAC `action` action; the permission path uses `action///`."; "Prerequisite: The CLI command requires `--kind`; other resource filters are optional. Actions run only on resources represented in Git and cannot run on child resources." ### ApplicationSet controller SCM proxy flags (2026-08-04) - slug: applicationset-controller-scm-proxy-flags-d7b3600fecd0 - score: 0.98 How to use it: When the ApplicationSet controller must reach GitHub, GitLab, Gitea, or Bitbucket Server APIs through a proxy, set `--scm-proxy-url` and optionally `--scm-no-proxy` (or their documented environment variables). These settings route outbound SCM API requests; use `--proxy-url` for Kubernetes API traffic. Examples: ``` argocd-applicationset-controller \ --scm-proxy-url=http://: \ --scm-no-proxy=[,...] ``` ``` ARGOCD_APPLICATIONSET_CONTROLLER_SCM_PROXY_URL=http://: ARGOCD_APPLICATIONSET_CONTROLLER_SCM_NO_PROXY=[,...] ``` - why_it_matters: Generate ApplicationSets from SCM provider APIs through a proxy while keeping Kubernetes API traffic on its existing route. - before: Use `--proxy-url` to route the controller's traffic through a proxy, including Kubernetes API requests. - sources: , , , - gotchas: "Version: v3.5.0"; "--scm-proxy-url / ARGOCD_APPLICATIONSET_CONTROLLER_SCM_PROXY_URL (required): HTTP/HTTPS proxy URL for outbound SCM provider API requests; does not affect Kubernetes API connectivity."; "--scm-no-proxy / ARGOCD_APPLICATIONSET_CONTROLLER_SCM_NO_PROXY: Comma-separated hosts that bypass the SCM proxy."; "--proxy-url: Use this standard kubectl flag to proxy Kubernetes API traffic."; "Prerequisite: Use an HTTP/HTTPS proxy; documented provider coverage is GitHub, GitLab, Gitea, and Bitbucket Server."; "`--scm-proxy-url` affects outbound SCM API requests and does not affect Kubernetes API server connectivity."; "Proxy support is stated for GitHub, GitLab, Gitea, and Bitbucket Server." ### ApplicationSet SCM generators filter archived repositories (2026-08-04) - slug: applicationset-scm-generators-filter-archived-repositories-190a2a88c705 - score: 0.98 How to use it: When configuring an ApplicationSet SCM generator for GitHub or Gitea, set `excludeArchivedRepos: true` to exclude archived repositories; for GitLab, set `includeArchivedRepos: true` to include them. Both fields default to false. Examples: ``` apiVersion: argoproj.io/v1alpha1 kind: ApplicationSet metadata: name: spec: generators: - scmProvider: github: organization: excludeArchivedRepos: true ``` ``` apiVersion: argoproj.io/v1alpha1 kind: ApplicationSet metadata: name: spec: generators: - scmProvider: gitlab: group: includeArchivedRepos: true ``` ``` apiVersion: argoproj.io/v1alpha1 kind: ApplicationSet metadata: name: spec: generators: - scmProvider: gitea: owner: excludeArchivedRepos: true ``` - why_it_matters: Configure an ApplicationSet SCM generator to include or exclude archived repositories. - sources: , , - gotchas: "Version: v3.5.0"; "excludeArchivedRepos: Exclude archived repositories; defaults to false. Documented for GitHub and Gitea."; "includeArchivedRepos: Include archived repositories; defaults to false. Documented for GitLab."; "github.organization (required): Name of the GitHub organization to scan."; "gitlab.group (required): Name of the base GitLab group to scan; may be a group ID or full namespaced path."; "gitea.owner (required): Name of the Gitea organization to scan."; "The filter currently supports GitHub, GitLab, and Gitea."; "GitLab excludes archived repositories by default; its option allows archived repositories to be included." ### Argo CD Git tag path prefixes (2026-08-04) - slug: argo-cd-git-tag-path-prefixes-11b55db5aa36 - score: 0.98 How to use it: When resolving a Git semver target within a tag path, set `tagPrefix` with `targetRevision`. Argo CD filters tags by that prefix, strips it for constraint evaluation, then restores it on the resolved version; semver constraints match tags, not branches. Examples: ``` argocd app set --revision '1.0.*' --tag-prefix 'component-b/' ``` ``` spec: source: targetRevision: 1.0.* tagPrefix: component-b/ ``` - why_it_matters: Resolve a semver target revision against tags scoped to a component or environment prefix. - sources: , , , - gotchas: "Version: v3.5.0"; "APPNAME (required): Application name."; "--revision: Tracking source branch, tag, commit, or Helm chart version; use a semver constraint for Git tag resolution."; "--tag-prefix: Filters Git tags by this prefix before evaluating `targetRevision` as a semver constraint."; "targetRevision (required): For this task, the semver constraint used to resolve a Git tag; constraints match tags, never branches."; "tagPrefix: Filters tags to those with the prefix, strips it before comparing against `targetRevision`, and re-adds it to the resolved version. No mutually exclusive values are documented."; "Semver constraints are matched against tags, never branches."; "The source describes basic support for Git tag path prefixes." ### Argo CD health check for karpenter.sh/NodeClaim (2026-08-04) - slug: argo-cd-health-check-for-karpenter-sh-nodeclaim-1724f2eebfea - score: 0.92 How to use it: When reviewing a Karpenter v1 `karpenter.sh/NodeClaim` in Argo CD, use the bundled v3.5.0 health check: it reports Progressing while status is absent or Launched, Registered, or Initialized is reached; Healthy for `Ready=True`, Degraded for `Ready=False`, and Suspended for `Disrupting=True`. Examples: ``` kubectl get nodeclaims.karpenter.sh -o yaml ``` - why_it_matters: Review the health of a Karpenter v1 NodeClaim in an Argo CD application. - before: NodeClaim had no bundled Argo CD health check; the release note says NodePool and EC2NodeClass had checks, but NodeClaim was missing one. - sources: , , - gotchas: "Version: v3.5.0"; " (required): Name of the NodeClaim to fetch."; "-o yaml: Output the resource as YAML; the health script evaluates the manifest's status and conditions."; "Prerequisite: Argo CD v3.5.0 includes the bundled health check at `resource_customizations/karpenter.sh/NodeClaim/health.lua`."; "Prerequisite: The resource must be a Karpenter v1 `karpenter.sh/NodeClaim`."; "Applies to Karpenter v1." ### Argo CD UI auto-sync toggle uses resource action (2026-08-04) - slug: argo-cd-ui-auto-sync-toggle-uses-resource-action-ef04ba132adc - score: 0.98 How to use it: When a role needs to toggle auto-sync from the application details page without broad application update permission, grant the `toggle-auto-sync` action and application `get` access for the target application. Examples: ``` p, role:oncall, applications, action/argoproj.io/Application/toggle-auto-sync, */*, allow p, role:oncall, applications, get, */*, allow ``` - why_it_matters: Allow a role to toggle application auto-sync without granting broad application update permission. - before: The auto-sync checkbox called `updateApp`, requiring broad `application update` permission. - sources: , , - gotchas: "Version: v3.5.0"; "applications (required): RBAC resource for Application-specific policies."; "action/argoproj.io/Application/toggle-auto-sync (required): Action policy path, in `action///` form."; "get (required): Allows reading the target application."; "*/* (required): Application object pattern used in the example policy; application policy objects use `/`."; "Prerequisite: Configure SSO or one or more local users before defining additional RBAC roles."; "The `toggle-auto-sync` resource action was added earlier and is wired into the application details page by this change." ### Argo CD webhook support for GHCR (2026-08-04) - slug: argo-cd-webhook-support-for-ghcr-ef462a2053c7 - score: 0.97 How to use it: When GHCR artifacts are published, configure a GitHub repository webhook to POST package events to `https:///api/webhook` with content type `application/json` and Packages enabled. Set the same webhook secret in GitHub and `argocd-secret` as `webhook.github.secret`; only published container package events trigger refreshes for matching Applications. Examples: ``` GitHub repository → Settings → Webhooks → Add webhook; Payload URL: `https:///api/webhook`; Content type: `application/json`; Secret: ``; Events: select individual events and enable Packages. ``` ``` apiVersion: v1 kind: Secret metadata: name: argocd-secret namespace: argocd type: Opaque stringData: webhook.github.secret: ``` ``` apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: spec: source: repoURL: oci://ghcr.io// targetRevision: destination: server: https://kubernetes.default.svc namespace: ``` - why_it_matters: Use a GHCR image update event to trigger an Argo CD webhook workflow. - sources: , - gotchas: "Version: v3.5.0"; "Payload URL (required): GitHub webhook endpoint: `https:///api/webhook`."; "Content type (required): Set to `application/json`."; "Packages event (required): Enable Packages under individual webhook events; only `published` events for `container` packages trigger refresh."; "webhook.github.secret: Shared GitHub webhook secret in `argocd-secret`; use the same value configured on the webhook. Secret configuration is optional; recommended if Argo CD is publicly accessible."; "spec.source.repoURL (required): OCI repository URL that matches the GHCR image, for example `oci://ghcr.io//`."; "spec.source.targetRevision (required): Exact tag or supported semver constraint used to match pushed artifacts."; "Prerequisite: GHCR image repository must be linked to an associated GitHub repository; webhook events are registered on that GitHub repository, not directly on GHCR."; "Prerequisite: Artifacts with unknown media types do not produce GitHub package webhook events; only `published` container package events are handled." ### argocd-applicationset-controller concurrent application operations (2026-08-04) - slug: argocd-applicationset-controller-concurrent-application-operations-cf428bc11ce2 - score: 0.94 How to use it: When an ApplicationSet manages many Applications and reconciliation is slow, start the v3.5.0 ApplicationSet controller with `--concurrent-application-updates` set to the desired concurrency. Examples: ``` argocd-applicationset-controller --concurrent-application-updates ``` - why_it_matters: Shorten reconciliation time for an ApplicationSet that manages many applications. - before: The controller updated Applications sequentially. - sources: , , - gotchas: "Version: v3.5.0"; "--concurrent-application-updates : Number of concurrent Application create, update, and delete operations per ApplicationSet reconcile; defaults to 1."; "Prerequisite: Use Argo CD v3.5.0 or later for this flag."; "The flag defaults to `1`." ### argocd appset commands accept --appset-namespace (2026-08-04) - slug: argocd-appset-commands-accept-appset-namespace-3d67779f01e9 - score: 0.95 How to use it: When creating or generating an ApplicationSet, use `-N` / `--appset-namespace` only if its manifest omits `metadata.namespace`; the manifest namespace takes precedence. For get or delete, use the flag to select a namespace, unless the name is qualified as `namespace/name`, which takes precedence. Examples: ``` argocd appset create --appset-namespace=

[...] ``` ``` argocd appset generate --appset-namespace=

``` ``` argocd appset get --appset-namespace= argocd appset delete --appset-namespace= argocd appset get / argocd appset delete / ``` - why_it_matters: Create, get, generate, or delete an ApplicationSet in a selected namespace. - before: Specify the namespace in a file or use the `appset-namespace/appset-name` qualified-name format. - sources: , , , , , - gotchas: "Version: v3.5.0"; "-N, --appset-namespace : Namespace where the ApplicationSet is created or generated, or namespace to query/delete from. For create/generate, ignored when YAML metadata contains namespace; for get/delete, ignored when the name is qualified."; " (required): File or URL containing the ApplicationSet manifest for create; manifest input for generate."; " (required): ApplicationSet name; accepts `namespace/name` to specify the namespace directly."; "The flag is ignored for get and delete when a qualified name is provided."; "For create and generate, the flag applies only when the manifest omits `metadata.namespace`." ### argocd proj source-integrity Git policy commands (2026-08-04) - slug: argocd-proj-source-integrity-git-policy-commands-f3e44dba65bb - score: 0.94 How to use it: When managing an Argo CD project’s Git source integrity policies, use the `argocd proj source-integrity git policies` subcommands to list, add, update, or delete policies. The v3.5 command reference gives full invocations only for listing and deleting; it leaves add and update arguments unspecified. Examples: ``` argocd proj source-integrity git policies list ``` ``` argocd proj source-integrity git policies delete ``` - why_it_matters: Manage Git source integrity policies for an Argo CD project from a coding workflow. - sources: , , - gotchas: "Version: v3.5.0"; "PROJECT (required): Project name; used by the documented list, add, update, and delete examples."; "POLICY_ID (required): Policy identifier; used by the documented update and delete examples."; "--auth-token / ARGOCD_AUTH_TOKEN: Authentication token; set the flag or the environment variable." ### argocd project sync windows sync overrun (2026-08-04) - slug: argocd-project-sync-windows-sync-overrun-dc78eb7e1a40 - score: 0.97 How to use it: When a sync window should let an in-progress sync continue across its boundary, enable sync overrun for that project window. The sync window ID is required; list the project's windows to find it. Examples: ``` argocd proj windows enable-sync-overrun ``` ``` argocd proj windows disable-sync-overrun ``` ``` argocd proj windows list ``` - why_it_matters: Allow an in-progress sync to finish across a project sync window boundary. - sources: , , , , - gotchas: "Version: v3.5.0"; "PROJECT (required): Project containing the sync window."; "ID (required): Sync window ID; find it with `argocd proj windows list PROJECT`."; "Disabling sync overrun requires the window ID, which can be found by running `argocd proj windows list PROJECT`."; "Allowing deletion of applications while a sync window does not allow syncs is not in scope." ### argocd repository webhook manifest cache warming controls and metrics (2026-08-04) - slug: argocd-repository-webhook-manifest-cache-warming-controls-and-metrics-dd81f69c27b4 - score: 0.93 How to use it: For large monorepos or plain YAML repositories where webhook cache warming adds overhead, disable warming per repository with `argocd repo edit` or globally through the `argocd-server` environment variable. Inspect webhook volume and cache reuse with the two documented metrics. Examples: ``` argocd repo edit https://github.com//.git --webhook-manifest-cache-warm-disabled ``` ``` ARGOCD_WEBHOOK_MANIFEST_CACHE_WARM_DISABLED=true ``` - why_it_matters: Reduce webhook processing overhead or inspect manifest-cache warming activity for a repository. - sources: , , - gotchas: "Version: v3.5.0"; "--webhook-manifest-cache-warm-disabled: Disables manifest cache warming for the repository being edited."; "repository URL (required): Repository URL passed to `argocd repo edit`."; "webhookManifestCacheWarmDisabled: Repository resource field; set to `true` to disable warming for that repository."; "ARGOCD_WEBHOOK_MANIFEST_CACHE_WARM_DISABLED: Set to `true` on argocd-server to disable warming for all repositories."; "argocd_webhook_requests_total: Counts incoming webhook events per repository; label: `repo`."; "argocd_webhook_store_cache_attempts_total: Counts attempts to reuse cached manifests for a new commit when refresh paths have not changed; labels: `repo`, `successful`."; "The global setting affects argocd-server."; "The per-repository setting disables warming for that repository."; "Cache warming can add overhead for large monorepos with many applications or plain YAML repositories where manifest generation is fast." ### argocd webhook refresh jitter configuration (2026-08-04) - slug: argocd-webhook-refresh-jitter-configuration-f5108fccf92d - score: 0.99 How to use it: When a webhook affects many applications and refresh bursts strain repo-server, configure webhook jitter in `argocd-cm` to spread refreshes over time. Optionally raise the refresh worker count in `argocd-cmd-params-cm` to drain the queue faster after delays expire. Examples: ``` apiVersion: v1 kind: ConfigMap metadata: name: argocd-cm data: webhook.refresh.jitter: "60s" webhook.refresh.jitter.threshold: "10" ``` ``` apiVersion: v1 kind: ConfigMap metadata: name: argocd-cmd-params-cm data: server.webhook.refresh.workers: "40" ``` - why_it_matters: Reduce repo-server load when a webhook affects many applications. - before: Webhook processing enqueued all affected applications at the same instant, causing bursts of repo-server calls and cache stampedes. - sources: , , , - gotchas: "Version: v3.5.0"; "webhook.refresh.jitter (required): Maximum random delay before each webhook-triggered application refresh; `0` disables jitter and is the default. Example: `60s` means a delay from 0 to 60 seconds."; "webhook.refresh.jitter.threshold: Minimum affected application count before jitter applies; jitter applies only when the event affects more than the threshold. Default: `10`."; "server.webhook.refresh.workers: Concurrent workers processing webhook-triggered application refresh requests. Default: `20`."; "--webhook-refresh-workers: `argocd-server` flag for the number of webhook refresh requests processed concurrently; default: `20`."; "Jitter is disabled when `webhook.refresh.jitter` is `0` (default)."; "The default `webhook.refresh.jitter.threshold` is `10`; jitter applies only when more than that many applications are affected."; "`server.webhook.refresh.workers` defaults to `20`." ### Argo CD PullRequest resource merge action (2026-02-02) - slug: argo-cd-pullrequest-resource-merge-action-4e3c395e0822 - score: 0.94 How to use it: When the Argo CD application contains the target PullRequest resource in the `open` state, run its `merge` action to set its state to `merged`. Examples: ``` argocd app actions run merge --kind PullRequest --group promoter.argoproj.io --namespace --resource-name ``` - why_it_matters: Merge a GitOps Promoter PullRequest resource from Argo CD. - sources: , , , - gotchas: "Version: v3.3.0"; " (required): Application name."; "merge (required): Action name; the PullRequest action is discovered as `merge`."; "--kind (required): Resource kind; use `PullRequest`."; "--group: Resource API group; use `promoter.argoproj.io`."; "--namespace: Filter by resource namespace."; "--resource-name: Filter by resource name."; "Prerequisite: The action is enabled for a PullRequest resource whose `spec.state` is `open`; the action sets `spec.state` to `merged`."; "Prerequisite: `argocd app actions run` requires `--kind`; the documented CLI syntax and flags were found in Argo CD v3.4 docs, not v3.3.0 docs." ### Argo CD Redis credentials can be read from mounted files (2026-02-02) - slug: argo-cd-redis-credentials-can-be-read-from-mounted-files-b7b36ffe5d63 - score: 0.93 How to use it: When configuring Redis-connected Argo CD components to use mounted file credentials, create a Secret with `auth` and mount it into each component. Set `REDIS_CREDS_DIR_PATH` to the mount directory; file credentials take precedence over credential environment variables. Examples: ``` apiVersion: v1 kind: Secret metadata: name: namespace: argocd type: Opaque stringData: auth: "" auth_username: "" sentinel_auth: "" sentinel_username: "" ``` ``` spec: containers: - name: env: - name: REDIS_CREDS_DIR_PATH value: "/var/run/secrets/redis" volumeMounts: - name: redis-creds mountPath: "/var/run/secrets/redis" readOnly: true volumes: - name: redis-creds secret: secretName: ``` - why_it_matters: Configure Argo CD components to read Redis credentials from a mounted Kubernetes Secret. - before: Configure Redis credentials through environment variables such as `REDIS_PASSWORD`. - sources: , , - gotchas: "Version: v3.3.0"; "REDIS_CREDS_DIR_PATH (required): Environment variable containing the mounted credential directory path; when specified, file credentials take precedence and environment-variable values are ignored."; "auth (required): Redis password file."; "auth_username: Redis username file."; "sentinel_auth: Redis Sentinel password file."; "sentinel_username: Redis Sentinel username file."; "Prerequisite: Mount the credential Secret into each Redis-connected Argo CD component that needs access. Components named by the docs: application-controller, repo-server, and server."; "The FAQ uses `REDIS_CREDS_DIR_PATH`; the PR description also names `REDIS_CREDS_FILE_PATH`."; "`auth` is mandatory; the other listed credential files are optional."; "When `REDIS_CREDS_DIR_PATH` is specified, file credentials take precedence and environment-variable values are ignored."; "The supplied example manifest excerpt does not include a complete component volume mount configuration."; "Docs conflict: The release-note PR description names REDIS_CREDS_FILE_PATH, while the v3.3 FAQ specifies REDIS_CREDS_DIR_PATH; use the documented v3.3 name." ### Argo CD supports PreDelete hooks (2026-02-02) - slug: argo-cd-supports-predelete-hooks-70c82cdb5ebe - score: 0.96 How to use it: When an Argo CD Application is deleted, define a `PreDelete` hook to run cleanup before its resources are deleted. It does not run during normal sync, including pruning. Examples: ``` apiVersion: batch/v1 kind: Job metadata: name: annotations: argocd.argoproj.io/hook: PreDelete spec: template: spec: containers: - name: cleanup image: command: [""] restartPolicy: Never ``` ``` # Helm chart template annotation: helm.sh/hook: pre-delete ``` - why_it_matters: Run a cleanup hook before deleting an Application's resources. - sources: , , , - gotchas: "Version: v3.3.0"; "argocd.argoproj.io/hook (required): Set to `PreDelete` to run the resource before Application resources are deleted."; "helm.sh/hook: Set to `pre-delete` in a Helm chart; documented as equivalent to the Argo CD `PreDelete` hook annotation."; "metadata.annotations (required): Place the hook annotation on the resource manifest."; "Prerequisite: Use an Argo CD version that supports PreDelete hooks; this change is documented in v3.3.0."; "Prerequisite: The hook must be defined in the Application's manifests. Argo CD waits for PreDelete hooks to reach Healthy before continuing deletion."; "PreDelete runs only when the entire Application is deleted, not during normal sync operations, including pruning." ### argocd app get-resource filters by group (2026-02-02) - slug: argocd-app-get-resource-filters-by-group-736ef0d5a97f - score: 0.94 How to use it: When you need to retrieve an application resource filtered to an API group, run `argocd app get-resource` with the application name, required resource kind, and `--group`. Examples: ``` argocd app get-resource --kind --group ``` - why_it_matters: Retrieve an application resource when you need to restrict the result to an API group. - sources: , , - gotchas: "Version: v3.3.0"; "APPNAME (required): Application name positional argument."; "--kind (required): Kind of resource."; "--group: Group." ### argocd app list filters applications by path (2026-02-02) - slug: argocd-app-list-filters-applications-by-path-4f892980e6c8 - score: 0.97 How to use it: When you need applications matching a repository path, run `argocd app list -P `; `-P` and `--path` are documented aliases for listing apps by path. Examples: ``` argocd app list -P ``` - why_it_matters: List applications from the Argo CD CLI that match a repository path. - sources: , , - gotchas: "Version: v3.3.0"; "-P, --path : List apps by path." ### Source Hydrator supports inline Helm source parameters (2026-02-02) - slug: source-hydrator-supports-inline-helm-source-parameters-7d0be0f084f0 - score: 0.96 How to use it: When configuring a Source Hydrator Application to render a Helm chart with environment-specific values, put the Helm settings under `spec.sourceHydrator.drySource.helm`; the hydrator uses that inline source configuration when rendering. Examples: ``` apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: my-helm-app spec: sourceHydrator: drySource: repoURL: https://github.com/argoproj/argocd-example-apps path: helm-guestbook targetRevision: HEAD helm: valueFiles: - values-prod.yaml parameters: - name: image.tag value: v1.2.3 releaseName: my-release syncSource: targetBranch: environments/prod path: helm-guestbook-hydrated ``` - why_it_matters: Configure a Source Hydrator Application to render a Helm chart with environment-specific values. - before: Source Hydrator supported basic Git repository fields (`repoURL`, `targetRevision`, `path`) in `DrySource`, but not Helm-specific configuration such as value files or parameters. - sources: , , - gotchas: "Version: v3.3.0"; "Availability: Source Hydrator is identified as an alpha feature in the PR description."; "spec.sourceHydrator.drySource.repoURL (required): Repository URL containing the source."; "spec.sourceHydrator.drySource.path: Path to the source within the repository."; "spec.sourceHydrator.drySource.targetRevision (required): Revision of the dry source."; "spec.sourceHydrator.drySource.helm.valueFiles: Helm values files used to override chart values."; "spec.sourceHydrator.drySource.helm.parameters[].name: Helm parameter name to set."; "spec.sourceHydrator.drySource.helm.parameters[].value: Value for the named Helm parameter."; "spec.sourceHydrator.drySource.helm.releaseName: Helm release name override."; "spec.sourceHydrator.syncSource.targetBranch (required): Branch receiving hydrated manifests."; "spec.sourceHydrator.syncSource.path (required): Output path for hydrated manifests; must be a non-root repository directory."; "Prerequisite: Source Hydrator is disabled by default. Enable the commit server and set `hydrator.enabled: \"true\"` in `argocd-cmd-params-cm`, then restart the Argo CD controller and API server."; "Prerequisite: Install separate pull and push repository secrets for the source repository."