Server-side apply moves ArgoCD's diff into the Kubernetes API server

Under the v3 defaults, diff calculation moves out of the Application Controller and into the Kubernetes API server, which also arbitrates which controller owns which field ^[3][5]. A dev.to overview of the 2026 releases puts the saving at up to 40 percent of Application Controller memory in high-density environments ^[4]. For that figure to transfer, your controller's memory has to be going on cached live state and computed diffs in the first place, and your API server needs headroom to absorb the merge work. The overview stops at the controller-side drop and says nothing about API server load ^[16].

The same overview places first-class OCI registry support in the v3 architecture work, next to server-side apply, and lists the 3.3 and 3.4 features separately ^[2][7][10]. In practice "first-class" means an Application's source can be a registry such as Harbor, ECR or Artifactory, with Helm charts or raw manifests pulled from there. The overview describes that as converging application code and infrastructure configuration into a single immutable artifact ^[2].

It also writes that "Git becomes the sole source of truth" ^[6]. If the manifests reaching a cluster come out of a registry, the commit holds a reference and the registry holds the content, and someone has to write down which of the two the release process treats as authoritative.

Cluster-level pause is the 3.4 feature I would upgrade for. Before it, an SRE fixing production with kubectl had the change detected as drift, and ArgoCD synced the old configuration back from Git ^[11]. Reverting the hotfix was the controller behaving as configured. Now `argocd cluster pause production-cluster` stops reconciliation for a whole cluster from the CLI or the UI ^[10]. Every application on that cluster stops being corrected ^[10]. Plan for that.

Cluster version labels are strictly enforced as vMajor.Minor.Patch, ApplicationSets whose generators use another format will fail after the move to 3.4, and the overview calls a review of every `.spec.generators` mandatory ^[13]. That review gets expensive at scale. In the overview's own example, one ApplicationSet covering 50 microservices across 3 regions replaces 150 Application manifests ^[14], so one generator that trips the label check takes 150 applications with it ^[17].

Two smaller 3.3 items change Repo Server sizing. Depth=1 cloning loads only the current commit, where the Repo Server previously pulled the repository's entire history ^[8]. OIDC tokens are renewed in the background while a user is active, for Keycloak, Okta or Dex ^[9]. Teams notifications now go through Workflow Adaptive Cards, replacing the discontinued Office 365 connectors ^[12].