fix: force attempt http2 with custom tls config (#26975 ) (cherry-pick #26976 for 3.4) (#27073 )

Signed-off-by: Max Verbeek <m4xv3rb33k@gmail.com> Co-authored-by: Max Verbeek <m4xv3rb33k@gmail.com>
Bump version to 3.4.0-rc4 on release-3.4 branch (#27046 )
2026-03-31 05:48:47 +02:00 · 2026-03-30 05:37:06 -10:00 · 2026-03-27 10:07:01 -04:00
19 changed files with 192 additions and 84 deletions
--- a/2
+++ b/2
@@ -1 +1 @@
-3.4.0-rc3
+3.4.0-rc4
--- a/manifests/base/commit-server/kustomization.yaml
+++ b/manifests/base/commit-server/kustomization.yaml
@@ -12,4 +12,4 @@ resources:
 images:
 - name: quay.io/argoproj/argocd
  newName: quay.io/argoproj/argocd
-  newTag: v3.4.0-rc3
+  newTag: v3.4.0-rc4
--- a/manifests/base/kustomization.yaml
+++ b/manifests/base/kustomization.yaml
@@ -5,7 +5,7 @@ kind: Kustomization
 images:
 - name: quay.io/argoproj/argocd
  newName: quay.io/argoproj/argocd
-  newTag: v3.4.0-rc3
+  newTag: v3.4.0-rc4
 resources:
 - ./application-controller
 - ./dex
--- a/manifests/core-install-with-hydrator.yaml
+++ b/manifests/core-install-with-hydrator.yaml
@@ -31332,7 +31332,7 @@ spec:
              key: applicationsetcontroller.status.max.resources.count
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-applicationset-controller
        ports:
@@ -31473,7 +31473,7 @@ spec:
              key: log.format.timestamp
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -31601,7 +31601,7 @@ spec:
        - argocd
        - admin
        - redis-initial-password
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: IfNotPresent
        name: secret-init
        securityContext:
@@ -31910,7 +31910,7 @@ spec:
          value: /helm-working-dir
        - name: HELM_DATA_HOME
          value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -31963,7 +31963,7 @@ spec:
        command:
        - sh
        - -c
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        name: copyutil
        securityContext:
          allowPrivilegeEscalation: false
@@ -32366,7 +32366,7 @@ spec:
              optional: true
        - name: KUBECACHEDIR
          value: /tmp/kubecache
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-application-controller
        ports:
--- a/manifests/core-install.yaml
+++ b/manifests/core-install.yaml
@@ -31300,7 +31300,7 @@ spec:
              key: applicationsetcontroller.status.max.resources.count
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-applicationset-controller
        ports:
@@ -31429,7 +31429,7 @@ spec:
        - argocd
        - admin
        - redis-initial-password
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: IfNotPresent
        name: secret-init
        securityContext:
@@ -31738,7 +31738,7 @@ spec:
          value: /helm-working-dir
        - name: HELM_DATA_HOME
          value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -31791,7 +31791,7 @@ spec:
        command:
        - sh
        - -c
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        name: copyutil
        securityContext:
          allowPrivilegeEscalation: false
@@ -32194,7 +32194,7 @@ spec:
              optional: true
        - name: KUBECACHEDIR
          value: /tmp/kubecache
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-application-controller
        ports:
--- a/manifests/core-install/kustomization.yaml
+++ b/manifests/core-install/kustomization.yaml
@@ -12,4 +12,4 @@ resources:
 images:
 - name: quay.io/argoproj/argocd
  newName: quay.io/argoproj/argocd
-  newTag: v3.4.0-rc3
+  newTag: v3.4.0-rc4
--- a/manifests/ha/base/kustomization.yaml
+++ b/manifests/ha/base/kustomization.yaml
@@ -12,7 +12,7 @@ patches:
 images:
 - name: quay.io/argoproj/argocd
  newName: quay.io/argoproj/argocd
-  newTag: v3.4.0-rc3
+  newTag: v3.4.0-rc4
 resources:
 - ../../base/application-controller
 - ../../base/applicationset-controller
--- a/manifests/ha/install-with-hydrator.yaml
+++ b/manifests/ha/install-with-hydrator.yaml
@@ -32758,7 +32758,7 @@ spec:
              key: applicationsetcontroller.status.max.resources.count
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-applicationset-controller
        ports:
@@ -32899,7 +32899,7 @@ spec:
              key: log.format.timestamp
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -33057,7 +33057,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: copyutil
        securityContext:
@@ -33159,7 +33159,7 @@ spec:
              key: notificationscontroller.repo.server.plaintext
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          tcpSocket:
@@ -33283,7 +33283,7 @@ spec:
        - argocd
        - admin
        - redis-initial-password
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: IfNotPresent
        name: secret-init
        securityContext:
@@ -33618,7 +33618,7 @@ spec:
          value: /helm-working-dir
        - name: HELM_DATA_HOME
          value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -33671,7 +33671,7 @@ spec:
        command:
        - sh
        - -c
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        name: copyutil
        securityContext:
          allowPrivilegeEscalation: false
@@ -34100,7 +34100,7 @@ spec:
              key: server.sync.replace.allowed
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
@@ -34532,7 +34532,7 @@ spec:
              optional: true
        - name: KUBECACHEDIR
          value: /tmp/kubecache
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-application-controller
        ports:
--- a/manifests/ha/install.yaml
+++ b/manifests/ha/install.yaml
@@ -32728,7 +32728,7 @@ spec:
              key: applicationsetcontroller.status.max.resources.count
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-applicationset-controller
        ports:
@@ -32887,7 +32887,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: copyutil
        securityContext:
@@ -32989,7 +32989,7 @@ spec:
              key: notificationscontroller.repo.server.plaintext
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          tcpSocket:
@@ -33113,7 +33113,7 @@ spec:
        - argocd
        - admin
        - redis-initial-password
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: IfNotPresent
        name: secret-init
        securityContext:
@@ -33448,7 +33448,7 @@ spec:
          value: /helm-working-dir
        - name: HELM_DATA_HOME
          value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -33501,7 +33501,7 @@ spec:
        command:
        - sh
        - -c
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        name: copyutil
        securityContext:
          allowPrivilegeEscalation: false
@@ -33930,7 +33930,7 @@ spec:
              key: server.sync.replace.allowed
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
@@ -34362,7 +34362,7 @@ spec:
              optional: true
        - name: KUBECACHEDIR
          value: /tmp/kubecache
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-application-controller
        ports:
--- a/manifests/ha/namespace-install-with-hydrator.yaml
+++ b/manifests/ha/namespace-install-with-hydrator.yaml
@@ -2005,7 +2005,7 @@ spec:
              key: applicationsetcontroller.status.max.resources.count
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-applicationset-controller
        ports:
@@ -2146,7 +2146,7 @@ spec:
              key: log.format.timestamp
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -2304,7 +2304,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: copyutil
        securityContext:
@@ -2406,7 +2406,7 @@ spec:
              key: notificationscontroller.repo.server.plaintext
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          tcpSocket:
@@ -2530,7 +2530,7 @@ spec:
        - argocd
        - admin
        - redis-initial-password
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: IfNotPresent
        name: secret-init
        securityContext:
@@ -2865,7 +2865,7 @@ spec:
          value: /helm-working-dir
        - name: HELM_DATA_HOME
          value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -2918,7 +2918,7 @@ spec:
        command:
        - sh
        - -c
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        name: copyutil
        securityContext:
          allowPrivilegeEscalation: false
@@ -3347,7 +3347,7 @@ spec:
              key: server.sync.replace.allowed
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
@@ -3779,7 +3779,7 @@ spec:
              optional: true
        - name: KUBECACHEDIR
          value: /tmp/kubecache
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-application-controller
        ports:
--- a/manifests/ha/namespace-install.yaml
+++ b/manifests/ha/namespace-install.yaml
@@ -1975,7 +1975,7 @@ spec:
              key: applicationsetcontroller.status.max.resources.count
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-applicationset-controller
        ports:
@@ -2134,7 +2134,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: copyutil
        securityContext:
@@ -2236,7 +2236,7 @@ spec:
              key: notificationscontroller.repo.server.plaintext
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          tcpSocket:
@@ -2360,7 +2360,7 @@ spec:
        - argocd
        - admin
        - redis-initial-password
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: IfNotPresent
        name: secret-init
        securityContext:
@@ -2695,7 +2695,7 @@ spec:
          value: /helm-working-dir
        - name: HELM_DATA_HOME
          value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -2748,7 +2748,7 @@ spec:
        command:
        - sh
        - -c
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        name: copyutil
        securityContext:
          allowPrivilegeEscalation: false
@@ -3177,7 +3177,7 @@ spec:
              key: server.sync.replace.allowed
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
@@ -3609,7 +3609,7 @@ spec:
              optional: true
        - name: KUBECACHEDIR
          value: /tmp/kubecache
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-application-controller
        ports:
--- a/manifests/install-with-hydrator.yaml
+++ b/manifests/install-with-hydrator.yaml
@@ -31776,7 +31776,7 @@ spec:
              key: applicationsetcontroller.status.max.resources.count
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-applicationset-controller
        ports:
@@ -31917,7 +31917,7 @@ spec:
              key: log.format.timestamp
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -32075,7 +32075,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: copyutil
        securityContext:
@@ -32177,7 +32177,7 @@ spec:
              key: notificationscontroller.repo.server.plaintext
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          tcpSocket:
@@ -32279,7 +32279,7 @@ spec:
        - argocd
        - admin
        - redis-initial-password
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: IfNotPresent
        name: secret-init
        securityContext:
@@ -32588,7 +32588,7 @@ spec:
          value: /helm-working-dir
        - name: HELM_DATA_HOME
          value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -32641,7 +32641,7 @@ spec:
        command:
        - sh
        - -c
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        name: copyutil
        securityContext:
          allowPrivilegeEscalation: false
@@ -33068,7 +33068,7 @@ spec:
              key: server.sync.replace.allowed
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
@@ -33500,7 +33500,7 @@ spec:
              optional: true
        - name: KUBECACHEDIR
          value: /tmp/kubecache
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-application-controller
        ports:
--- a/manifests/install.yaml
+++ b/manifests/install.yaml
@@ -31744,7 +31744,7 @@ spec:
              key: applicationsetcontroller.status.max.resources.count
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-applicationset-controller
        ports:
@@ -31903,7 +31903,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: copyutil
        securityContext:
@@ -32005,7 +32005,7 @@ spec:
              key: notificationscontroller.repo.server.plaintext
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          tcpSocket:
@@ -32107,7 +32107,7 @@ spec:
        - argocd
        - admin
        - redis-initial-password
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: IfNotPresent
        name: secret-init
        securityContext:
@@ -32416,7 +32416,7 @@ spec:
          value: /helm-working-dir
        - name: HELM_DATA_HOME
          value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -32469,7 +32469,7 @@ spec:
        command:
        - sh
        - -c
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        name: copyutil
        securityContext:
          allowPrivilegeEscalation: false
@@ -32896,7 +32896,7 @@ spec:
              key: server.sync.replace.allowed
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
@@ -33328,7 +33328,7 @@ spec:
              optional: true
        - name: KUBECACHEDIR
          value: /tmp/kubecache
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-application-controller
        ports:
--- a/manifests/namespace-install-with-hydrator.yaml
+++ b/manifests/namespace-install-with-hydrator.yaml
@@ -1023,7 +1023,7 @@ spec:
              key: applicationsetcontroller.status.max.resources.count
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-applicationset-controller
        ports:
@@ -1164,7 +1164,7 @@ spec:
              key: log.format.timestamp
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -1322,7 +1322,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: copyutil
        securityContext:
@@ -1424,7 +1424,7 @@ spec:
              key: notificationscontroller.repo.server.plaintext
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          tcpSocket:
@@ -1526,7 +1526,7 @@ spec:
        - argocd
        - admin
        - redis-initial-password
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: IfNotPresent
        name: secret-init
        securityContext:
@@ -1835,7 +1835,7 @@ spec:
          value: /helm-working-dir
        - name: HELM_DATA_HOME
          value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -1888,7 +1888,7 @@ spec:
        command:
        - sh
        - -c
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        name: copyutil
        securityContext:
          allowPrivilegeEscalation: false
@@ -2315,7 +2315,7 @@ spec:
              key: server.sync.replace.allowed
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
@@ -2747,7 +2747,7 @@ spec:
              optional: true
        - name: KUBECACHEDIR
          value: /tmp/kubecache
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-application-controller
        ports:
--- a/manifests/namespace-install.yaml
+++ b/manifests/namespace-install.yaml
@@ -991,7 +991,7 @@ spec:
              key: applicationsetcontroller.status.max.resources.count
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-applicationset-controller
        ports:
@@ -1150,7 +1150,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: copyutil
        securityContext:
@@ -1252,7 +1252,7 @@ spec:
              key: notificationscontroller.repo.server.plaintext
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          tcpSocket:
@@ -1354,7 +1354,7 @@ spec:
        - argocd
        - admin
        - redis-initial-password
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: IfNotPresent
        name: secret-init
        securityContext:
@@ -1663,7 +1663,7 @@ spec:
          value: /helm-working-dir
        - name: HELM_DATA_HOME
          value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -1716,7 +1716,7 @@ spec:
        command:
        - sh
        - -c
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        name: copyutil
        securityContext:
          allowPrivilegeEscalation: false
@@ -2143,7 +2143,7 @@ spec:
              key: server.sync.replace.allowed
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
@@ -2575,7 +2575,7 @@ spec:
              optional: true
        - name: KUBECACHEDIR
          value: /tmp/kubecache
-        image: quay.io/argoproj/argocd:v3.4.0-rc3
+        image: quay.io/argoproj/argocd:v3.4.0-rc4
        imagePullPolicy: Always
        name: argocd-application-controller
        ports:
--- a/util/helm/client.go
+++ b/util/helm/client.go
@@ -373,6 +373,7 @@ func (c *nativeHelmChart) loadRepoIndex(ctx context.Context, maxIndexSize int64)
 		Proxy:             proxy.GetCallback(c.proxy, c.noProxy),
 		TLSClientConfig:   tlsConf,
 		DisableKeepAlives: true,
+		ForceAttemptHTTP2: true,
 	}
 	client := http.Client{Transport: tr}
 	resp, err := client.Do(req)
@@ -492,6 +493,7 @@ func (c *nativeHelmChart) GetTags(chart string, noCache bool) ([]string, error)
 			Proxy:             proxy.GetCallback(c.proxy, c.noProxy),
 			TLSClientConfig:   tlsConf,
 			DisableKeepAlives: true,
+			ForceAttemptHTTP2: true,
 		}

 		// Wrap transport to add User-Agent header to all requests
--- a/util/helm/client_test.go
+++ b/util/helm/client_test.go
@@ -2,6 +2,7 @@ package helm

 import (
 	"bytes"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"math"
@@ -10,6 +11,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"testing"

@@ -574,6 +576,68 @@ func TestGetTagsCaching(t *testing.T) {
 	})
 }

+func TestGetTagsUsesHTTP2(t *testing.T) {
+	t.Run("should negotiate HTTP/2 when TLS is configured", func(t *testing.T) {
+		var requestProtos []string
+		server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			requestProtos = append(requestProtos, r.Proto)
+			t.Logf("called %s with proto %s", r.URL.Path, r.Proto)
+
+			responseTags := fakeTagsList{
+				Tags: []string{"1.0.0"},
+			}
+
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusOK)
+			require.NoError(t, json.NewEncoder(w).Encode(responseTags))
+		}))
+		// httptest.NewTLSServer only advertises http/1.1 in ALPN, so we must
+		// configure the server to also offer h2 for HTTP/2 negotiation to work.
+		server.TLS = &tls.Config{NextProtos: []string{"h2", "http/1.1"}}
+		server.StartTLS()
+		t.Cleanup(server.Close)
+
+		client := NewClient(server.URL, HelmCreds{InsecureSkipVerify: true}, true, "", "")
+
+		tags, err := client.GetTags("mychart", true)
+		require.NoError(t, err)
+		assert.Equal(t, []string{"1.0.0"}, tags)
+
+		// Verify that at least one request used HTTP/2. When ForceAttemptHTTP2 is
+		// not set on the Transport, Go's TLS stack won't negotiate h2 even though
+		// the server supports it, because a custom TLSClientConfig disables the
+		// automatic HTTP/2 setup.
+		require.NotEmpty(t, requestProtos, "expected at least one request to the server")
+		hasHTTP2 := slices.Contains(requestProtos, "HTTP/2.0")
+		assert.True(t, hasHTTP2, "expected at least one HTTP/2 request, but got protocols: %v", requestProtos)
+	})
+}
+
+func TestLoadRepoIndexUsesHTTP2(t *testing.T) {
+	t.Run("should negotiate HTTP/2 when fetching index", func(t *testing.T) {
+		var requestProto string
+		server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			requestProto = r.Proto
+			t.Logf("called %s with proto %s", r.URL.Path, r.Proto)
+
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write([]byte(`apiVersion: v1
+entries: {}
+`))
+		}))
+		server.TLS = &tls.Config{NextProtos: []string{"h2", "http/1.1"}}
+		server.StartTLS()
+		t.Cleanup(server.Close)
+
+		client := NewClient(server.URL, HelmCreds{InsecureSkipVerify: true}, false, "", "")
+
+		_, err := client.GetIndex(false, 10000)
+		require.NoError(t, err)
+
+		assert.Equal(t, "HTTP/2.0", requestProto, "expected HTTP/2 request for index fetch, but got %s", requestProto)
+	})
+}
+
 func TestUserAgentIsSet(t *testing.T) {
 	t.Run("Default User-Agent for traditional Helm repo", func(t *testing.T) {
 		// Create a test server that captures the User-Agent header
--- a/util/oci/client.go
+++ b/util/oci/client.go
@@ -143,6 +143,7 @@ func NewClientWithLock(repoURL string, creds Creds, repoLock sync.KeyLock, proxy
 			Proxy:             proxy.GetCallback(proxyURL, noProxy),
 			TLSClientConfig:   tlsConf,
 			DisableKeepAlives: true,
+			ForceAttemptHTTP2: true,
 		},
 		/*
 			CheckRedirect: func(req *http.Request, via []*http.Request) error {
--- a/util/oci/client_test.go
+++ b/util/oci/client_test.go
@@ -5,16 +5,22 @@ import (
 	"bytes"
 	"compress/gzip"
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"errors"
 	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
 	"os"
 	"path/filepath"
+	"slices"
 	"testing"

 	"github.com/opencontainers/go-digest"
 	"github.com/opencontainers/image-spec/specs-go"
 	imagev1 "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"oras.land/oras-go/v2"
 	"oras.land/oras-go/v2/content"
@@ -761,6 +767,38 @@ func Test_nativeOCIClient_ResolveRevision(t *testing.T) {
 	}
 }

+func TestNewClientUsesHTTP2(t *testing.T) {
+	t.Run("should negotiate HTTP/2 when TLS is configured", func(t *testing.T) {
+		var requestProtos []string
+		server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			requestProtos = append(requestProtos, r.Proto)
+			t.Logf("called %s with proto %s", r.URL.Path, r.Proto)
+			w.WriteHeader(http.StatusOK)
+		}))
+		// httptest.NewTLSServer only advertises http/1.1 in ALPN, so we must
+		// configure the server to also offer h2 for HTTP/2 negotiation to work.
+		server.TLS = &tls.Config{NextProtos: []string{"h2", "http/1.1"}}
+		server.StartTLS()
+		t.Cleanup(server.Close)
+
+		serverURL, err := url.Parse(server.URL)
+		require.NoError(t, err)
+
+		// NewClient expects oci://host/path format.
+		repoURL := "oci://" + serverURL.Host + "/myorg/myrepo"
+		client, err := NewClient(repoURL, Creds{InsecureSkipVerify: true}, "", "", nil,
+			WithEventHandlers(fakeEventHandlers(t, serverURL.Host+"/myorg/myrepo")))
+		require.NoError(t, err)
+
+		// TestRepo pings the registry's /v2/ endpoint, exercising the transport.
+		_, _ = client.TestRepo(t.Context())
+
+		require.NotEmpty(t, requestProtos, "expected at least one request to the server")
+		hasHTTP2 := slices.Contains(requestProtos, "HTTP/2.0")
+		assert.True(t, hasHTTP2, "expected at least one HTTP/2 request, but got protocols: %v", requestProtos)
+	})
+}
+
 func fakeEventHandlers(t *testing.T, repoURL string) EventHandlers {
 	t.Helper()
 	return EventHandlers{
@@ -772,6 +810,9 @@ func fakeEventHandlers(t *testing.T, repoURL string) EventHandlers {
 		OnGetTagsFail: func(repo string) func() {
 			return func() { require.Equal(t, repoURL, repo) }
 		},
+		OnTestRepoFail: func(repo string) func() {
+			return func() { require.Equal(t, repoURL, repo) }
+		},
 		OnExtractFail: func(repo string) func(revision string) {
 			return func(_ string) { require.Equal(t, repoURL, repo) }
 		},
Author	SHA1	Message	Date
argo-cd-cherry-pick-bot[bot]	8550f60a05	fix: force attempt http2 with custom tls config (#26975 ) (cherry-pick #26976 for 3.4) (#27073 ) Signed-off-by: Max Verbeek <m4xv3rb33k@gmail.com> Co-authored-by: Max Verbeek <m4xv3rb33k@gmail.com>	2026-03-30 05:37:06 -10:00
github-actions[bot]	d29ec76295	Bump version to 3.4.0-rc4 on release-3.4 branch (#27046 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: crenshaw-dev <350466+crenshaw-dev@users.noreply.github.com>	2026-03-27 10:07:01 -04:00