Argo CD v3.5.3 - CRD Health, Repo Cleanup, and Sync Retry

Argo CD v3.5.3 was published on 14 September 2026 at 07:58 UTC. The tag is a stable patch on the 3.5 line: ten bug fixes, each a cherry pick onto that line. The change with the widest blast radius is resource health for a stopped KubeVirt virtual machine, a suspended FlinkDeployment, a Crossplane managed resource that is still provisioning, a GRPCRoute with a stale observedGeneration, and a GrafanaFolder with a negative polarity condition.

The full release notes and downloads are on the GitHub release page. The delta from v3.5.2 is the compare view. The notes also link an official blog post whose slug is the v3.0 release candidate article. Use the compare view for the v3.5.3 commit list.

Five commits change health results for custom resources argo-cd already scores.

A KubeVirt VirtualMachine declared stopped is Healthy. Commit c198be7e7a00f6e643180c0f9b762f768fefcbb1 (#29665, cherry pick of #29664) is that fix. Application health now follows a stopped declaration. Planned shutdowns leave the Application Healthy, and alerts that treated that state as failure go quiet. The VM spec is still where the stop is visible.

A suspended FlinkDeployment is reported healthy. Commit 4b3f69d204d25aeaf9056bc37c3e4d44f198570c (#29525, cherry pick of #28995, issue #26818) covers suspended Flink jobs. Application health now follows the suspended state, including a suspend that was a mistake. Job state still has to come from the Flink status fields on the object.

Crossplane managed resources report Progressing while they are provisioning. Commit 70b399c5a8335cd3abb0bf132d63129733a5e3a0 (#29520, cherry pick of #29382, issue #29381) is the fix. In that window they were reporting Healthy. Syncs that advanced on the early Healthy result now wait until provisioning finishes. Dependent waves wait with them.

The GRPCRoute health check ignores conditions whose observedGeneration is stale. Commit 18f0566fb550b1d10d9fb55a72fa887a530eca42 (#29517, cherry pick of #28087, issue #28086) keeps conditions for the current generation and skips older ones. After upgrade, recheck routes that republish status often. A leftover condition from the previous generation is ignored.

GrafanaFolder health now follows a negative polarity condition. Commit 4d653a67174ecacd3a7d17ef5f1c923a48304bd6 (#29524, cherry pick of #29397, issue #29395) is the change. On a normal condition, status True means the state is asserted. On a negative polarity condition, True means the problem is present. The check now uses that polarity. The condition type is unnamed in the notes. Compare folder health before and after the upgrade on any cluster with a large GrafanaFolder count.

The local repository is cleaned when the revision changes. Commit dd2cb1aaf12ef19a2bab816fbaecced6422cad7c (#29486, cherry pick of #28771) is the repository fix. Manifest generation reads a local copy of the source. A revision change cleans that copy before the next render. The notes leave the mechanism unnamed. Treat the next sync as a cold local copy when the remote is slow.

A retried sync now records operationState correctly. Commit be8b3873521671e3f9418c6e3019f12a472ac3c1 (#29431, cherry pick of #28778, issue #26530) fixes the retry path. The UI and any status watcher read operationState for the in flight operation. Wrong values on retry make the new attempt look like the previous one. Fields inside the block are unnamed in the commit. After rollout, force one retry on a non production Application and compare operationState with that attempt.

The UI guards the SSO redirect and stops a 401 retry loop. Commit a5e5992f62561d112a6d6a715e6631e3b6817671 (#29631, cherry pick of #28807) adds the guard. A 401 during the SSO redirect was sending the browser through the same redirect again. The guard breaks that loop. Bearer token API calls sit outside this UI path.

When hydrateTo is set, the UI uses that branch name. Commit 0b0890e0c79d2e2c7f8bf33736cde2772024e2b3 (#29564, cherry pick of #29562) is the UI fix. Source hydration targets the branch named by hydrateTo. The UI now uses that configured name, so the hydrated branch matches the spec field.

The AuthReconcile visitor recovers from panics. Commit ec585202b451045155203736eaa6bca145b19935 (#29531, cherry pick of #29440) is that fix. The object type is absent from the notes. Recovery keeps the panic inside the visitor, and the fault there can remain after the process stays up.

The changelog is bug fixes. The upgrading documentation covers jumps across minor versions. v3.5.2 to v3.5.3 stays on the 3.5 minor.

Fresh installs from the notes pass --server-side and --force-conflicts to kubectl apply. Single replica:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.3/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.3/manifests/ha/install.yaml

Container images are signed with cosign. Provenance for container images and CLI binaries meets SLSA Level 3. Verification steps are in the signed release assets documentation.

After rollout, recheck Applications whose health gates or alerts depend on a stopped KubeVirt VirtualMachine, a suspended FlinkDeployment, or a Crossplane managed resource still in provisioning. Those three health results move in this patch while the Application spec stays unchanged.