chore(argo-cd): take the chart to 10.8.0

[jdwlabs-agent-bot]

Takes the argo-cd chart from 10.4.1 to 10.8.0. Split out of #417 so that it lands on its own and a failure stays attributable. #443 carries the nginx-gateway-fabric bump, which is the one with a traffic cost — land this one first.

Why this is safe

appVersion is unchanged: v3.5.2 → v3.5.2. No Argo CD binary change, no CRD change, no schema or database migration. This is a chart-template-only bump.

helm template on both versions against tenants/platform/services/argo-cd/values.yaml, normalising the helm.sh/chart string, is 24 changed lines in total:

• checksum/cm and checksum/cmd-params annotation values change on the controller StatefulSet and the server / repo-server / dex / applicationset Deployments. The chart's checksum helper now hashes only data/stringData rather than the whole rendered manifest — the ConfigMap contents are byte-identical, only the hash function changed.
• optional: true added to the argocd-tls-certs-cm volume on server, repo-server and applicationset. The ConfigMap exists (0 keys), so nothing changes.
• dnsPolicy: ClusterFirst added to the redis-secret-init Job — that is the Kubernetes default, so the applied value equals the live defaulted one.

Everything else in the values diff is additive and unused in this tenant: configs.cm.resourceExclusionsAdditional, per-component vpa.startupBoost (VPA not enabled), redis.hostNetwork, redisSecretInit.dnsConfig/dnsPolicy, the redis-ha sentinel postStart hook (redis-ha not enabled) and a redis-exporter tag bump (exporter not enabled). redis.image.tag is 8.6.4-alpine in both charts, matching the running pod.

The livenessProbe question

The reason this bump sat parked was a new controller livenessProbe. It ships disabled:

livenessProbe:
  enabled: false

with the chart's own comment recording that Argo CD removed the probe deliberately, because restarting an overloaded controller usually makes things worse. The StatefulSet template gates the whole block on .Values.controller.livenessProbe.enabled, so the OOM-during-sync-storm concern written down in this tenant's argo-cd values is not exposed by the upgrade. This PR deliberately does not pin controller.livenessProbe — the default is already correct, and pinning it would freeze a value that then has to be maintained by hand.

What it disrupts

Argo CD applies itself here, and the pods will restart — but from the helm.sh/chart pod-template label, not from the checksum annotations. The tenant appset's ignoreDifferences covers .spec.template.metadata.annotations for StatefulSets and checksum/secret for Deployments, and neither covers .labels.

• argocd-application-controller restarts on the label alone.
• argocd-server, argocd-repo-server, argocd-dex-server, argocd-applicationset-controller restart on the label and the annotations.

This is precedented, not new: every argocd pod in the cluster last restarted together at 2026-08-29T04:52 — the previous chart bump doing exactly this — and has shown RESTARTS: 0 since. Because appVersion is unchanged, the controller that comes back is the identical binary. Worst case is a sync operation left in Running that needs a manual re-sync.

Rollback

Revert the one line and let Argo CD sync. Rollback is symmetric because appVersion is the same in both directions, so it carries no migration risk. If the controller itself fails to come back and cannot self-heal, kubectl -n argocd rollout undo statefulset/argocd-application-controller restores the previous pod template out-of-band without needing a working Argo CD.

🤖 Generated with Claude Code

[jdwillmsen]

Approved on jdwillmsen's instruction, posted by an agent session on their behalf.

Chart-template-only: appVersion unchanged at v3.5.2, so no Argo CD binary, CRD or schema change. The parked livenessProbe concern does not apply — the chart ships it enabled: false with the StatefulSet template gated on that value. Rendered delta against this tenant's values is 24 lines. Pods will restart from the helm.sh/chart pod-template label, which ignoreDifferences does not cover; precedented by the 2026-08-29 bump. 19/19 checks green.