Argo CD 3.5 Hardens Enterprise GitOps with Internal mTLS and Native Source Hydration

The Argo CD project has released version 3.5, introducing critical architectural enhancements focused on zero-trust cluster networking, manifest hydration workflows, and supply chain integrity. Key upgrades include mandatory mutual TLS (mTLS) encryption for internal communication with the repo-server component, cryptographic Git commit signature verification via Source Integrity, and the promotion of both user impersonation and the Source Hydrator to beta status. Additionally, the release delivers native ApplicationSet visualization and management within the Argo CD web user interface, support for deploying ApplicationSets into arbitrary namespaces, concurrency throttling controls, and native Helm 4 compatibility alongside backward support for Helm 3. For enterprise platform engineers and DevSecOps teams running multi-tenant Kubernetes fleets, this milestone addresses long-standing operational vulnerabilities. Previously, internal component traffic between the API server, controllers, and repo-server remained unencrypted by default, requiring perimeter network policies to mitigate lateral movement risks. The integration of in-memory self-signed or custom certificate mTLS hardens the internal control plane against pod-level compromise. Furthermore, moving the Source Hydrator to beta enables teams to decouple raw, unhydrated templating repositories (using Helm or Kustomize) from rendered, audit-ready manifests in separate repositories, each governed by distinct role-based access control (RBAC) boundaries. This release aligns with a wider industry push to mature GitOps from basic declarative synchronisation toward hardened, enterprise-grade software supply chain governance. While early GitOps tooling focused primarily on eliminating manual configuration drift and replacing push-based CI/CD pipelines, modern cloud-native standards demand strict cryptographic provenance, fine-grained multi-tenancy, and compliance-driven auditability. The adoption of OpenSSF and CNCF security best practices across continuous delivery engines reflects how critical in-cluster agents have become as prime attack surfaces. By baking commit signature verification and separated hydration tiers into core workflows, Argo CD continues to solidify its footprint as the enterprise baseline for declarative Kubernetes lifecycle management. Practitioners managing production Argo CD installations should evaluate upgrading to version 3.5 to take advantage of the internal mTLS defaults and the decoupled hydration architecture. When adopting Source Hydrator, platform teams must plan repository access models to distinguish developer-facing template repositories from machine-managed deployment targets. Security leads should configure source integrity requirements to enforce commit signing policies before manifests reach production clusters. Concurrently, platform administrators leveraging ApplicationSets should test the new namespace delegation features and concurrency limits to prevent upstream Git API rate limiting during large-scale fleet deployments.