Argo CD 3.5 Tightens Fleet Security with Internal mTLS and Source Integrity

The Argo CD project rolled out version 3.5, introducing major structural enhancements across GitOps security and fleet management. The headline capabilities include native mutual TLS (mTLS) enforcement for internal communication between the repo-server and API controllers, built-in Source Integrity verification for Git commit signatures, and a dedicated ApplicationSet user interface with live template change previews. Additionally, user impersonation for server-side operations and the Source Hydrator engine graduated to beta, while support for Helm 4 and namespace-scoped ApplicationSets reached operational stability. Historically, Argo CD's internal control plane communication—specifically traffic directed to the repo-server—relied on perimeter network boundaries or third-party service meshes for encryption. In complex multi-tenant environments, this architecture left internal gRPC transactions susceptible to lateral inspection if neighboring workloads were compromised. Furthermore, GitOps workflows frequently suffered from supply-chain verification gaps, reconciling manifests without verifying author authenticity. By enforcing mTLS natively with automated certificate handling and integrating cryptographic Source Integrity checks into Application manifests, platform engineers can now verify that configurations originate from authenticated authors before reconciliation ever touches cluster state. This release aligns with the broader industry drive toward zero-trust architecture and cryptographic supply chain guarantees across modern Kubernetes environments. As fleet orchestration shifts toward centralized multi-cluster topologies governed by ApplicationSets, perimeter-only defenses are no longer sufficient. Where competing tools like Flux circumvented internal RPC risks by using native Kubernetes API abstractions, Argo CD's microservice design required explicit internal transport protection. By combining internal cryptographic binding, Git signature validation, and namespace-scoped ApplicationSet permissions, Argo CD brings its operational security model into direct alignment with enterprise SLSA and zero-trust compliance standards. Practitioners planning an upgrade to Argo CD 3.5 should assess their existing control plane and pipeline configurations. Internal mTLS operates out-of-the-box using ephemeral in-memory certificates, but custom topologies with split repo-server infrastructure will require deliberate certificate coordination. Engineering teams seeking to enforce `sourceIntegrity.required` must ensure signing keys and automated CI bot credentials are properly distributed to avoid blocked synchronization pipelines. Finally, platform teams should leverage the new ApplicationSet UI to preview templated generation outcomes before rollouts, while updating any legacy OCI chart dependencies to account for stricter Helm 4 transport rules.