argocd: update viaductoss/ksops Docker tag to v4.5.1

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
viaductoss/ksops	Kustomization	minor	v4.3.3 → v4.5.1

---

Release Notes

viaduct-ai/kustomize-sops (viaductoss/ksops)

v4.5.1

Compare Source

Upgrade Guide: v4.5.0 to v4.5.1

What changed

In v4.5.0, ksops install always copied both ksops and kustomize from hardcoded paths. This release makes two improvements based on community feedback (#​327):

1. ksops install now uses os.Executable() to resolve its own binary path instead of hardcoding /usr/local/bin/ksops. This makes the install command work regardless of where the binary is located.

2. Kustomize copying is now opt-in via --with-kustomize. Since ArgoCD already ships with kustomize, ksops install now only copies the ksops binary by default. Pass --with-kustomize to also copy kustomize.

How to upgrade

Add --with-kustomize to your ksops install command if you want to continue overriding ArgoCD's built-in kustomize (the previous default behavior).

Before:

initContainers:
  - name: install-ksops
    image: viaductoss/ksops:v4.5.0
    command: ["/usr/local/bin/ksops", "install", "/custom-tools"]
    volumeMounts:
      - mountPath: /custom-tools
        name: custom-tools

After:

initContainers:
  - name: install-ksops
    image: viaductoss/ksops:v4.5.1
    command: ["/usr/local/bin/ksops", "install", "--with-kustomize", "/custom-tools"]
    volumeMounts:
      - mountPath: /custom-tools
        name: custom-tools

If you don't need to override ArgoCD's kustomize, you can drop --with-kustomize and remove the kustomize volume mount:

initContainers:
  - name: install-ksops
    image: viaductoss/ksops:v4.5.1
    command: ["/usr/local/bin/ksops", "install", "/custom-tools"]
    volumeMounts:
      - mountPath: /custom-tools
        name: custom-tools

Changelog

• fd75a70 fix: use os.Executable() for install and make kustomize opt-in (#​330)
• d9442dc v4.5.1

v4.5.0

Compare Source

Upgrade Guide: ArgoCD Init Container

What changed

Starting in v4.4.0, the ksops Docker image uses a distroless base image, which does not include /bin/sh, mv, or other shell utilities. This broke the documented ArgoCD init container pattern that relied on shell commands to copy binaries into a shared volume.

This release adds a built-in ksops install subcommand that copies the ksops and kustomize binaries to a target directory — no shell required.

How to upgrade

Replace the command and args in your init container. The volume mounts stay the same.

Before:

initContainers:

- name: install-ksops
  image: viaductoss/ksops:v4.4.0
  command: ["/bin/sh", "-c"]
  args:
  - echo "Installing KSOPS...";
    mv ksops /custom-tools/;
    mv kustomize /custom-tools/;
    echo "Done.";
    volumeMounts:
  - mountPath: /custom-tools
    name: custom-tools

After:

initContainers:

- name: install-ksops
  image: viaductoss/ksops:vX.Y.Z
  command: ["/usr/local/bin/ksops", "install", "/custom-tools"]
  volumeMounts:
  - mountPath: /custom-tools
    name: custom-tools

That's it. No other changes to your volumes, volume mounts, or container definitions are needed.

Affected configurations

This applies to all three documented ArgoCD integration methods:

• Strategic merge patch (argo-cd-repo-server-ksops-patch.yaml)
• ArgoCD CRD (OKD4/OCP4 kind: ArgoCD spec)
• Argo CD Helm chart (repoServer.initContainers values)

Workarounds no longer needed

If you were using any of these workarounds, you can remove them:

• Using alpine as the init container image to curl and extract the release tarball
• Building a custom container image that bundles ksops into the ArgoCD repo server
• Pinning to a version before v4.4.0

Changelog

• 92bc163 chore(deps): bump actions/checkout from 5 to 6 (#​307)
• 42d7795 chore(deps): bump actions/setup-go from 5 to 6 (#​302)
• cfb835c chore(deps): bump docker/login-action from 3 to 4 (#​315)
• a25bfcd chore(deps): bump docker/setup-buildx-action from 3 to 4 (#​316)
• 2aee20e chore(deps): bump docker/setup-qemu-action from 3 to 4 (#​317)
• 061495f chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#​309)
• 845389a chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#​325)
• d70b62e chore(deps): bump github.com/getsops/sops/v3 from 3.11.0 to 3.12.2 (#​319)
• 98fe884 chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.1 to 4.1.4 (#​323)
• 80616de chore(deps): bump github/codeql-action from 3 to 4 (#​305)
• eb80fe6 chore(deps): bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.43.0 (#​326)
• dd0987e chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.45.0 (#​306)
• 31dfb4e chore(deps): bump google.golang.org/grpc from 1.75.1 to 1.79.3 (#​318)
• d4c8c13 chore(deps): bump goreleaser/goreleaser-action from 6 to 7 (#​312)
• dfeab3f chore: v4.5.0 (#​329)
• 8f3b8d1 feat: add ksops install subcommand for distroless compatibility (#​327)
• 50ad78f feat: concurrent secret decryption (#​328)
• 4345f5f fix: pin to 1.25.0
• 8624cb3 update(sops): 3.10.2 -> 3.11.0 (#​304)

v4.4.0

Compare Source

Changelog

• 970918f Bump sigs.k8s.io/kustomize/api from v0.16.0 to v0.19.0 (#​275)
• 97f66d0 Optimize Docker image (#​271)
• 18bcac8 Optimize and structure Makefile (#​274)
• d79a6f0 chore(deps): bump actions/checkout from 4 to 5 (#​293)
• bc46d4d chore(deps): bump github.com/cloudflare/circl from 1.4.0 to 1.6.1 (#​285)
• 1ced974 chore(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 (#​280)
• 487dded chore(deps): bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 (#​282)
• 404363d chore(deps): bump golang.org/x/net from 0.33.0 to 0.36.0 (#​281)
• fc21455 chore(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 (#​284)
• 167e8ab chore(deps): bump golang.org/x/oauth2 from 0.24.0 to 0.27.0 (#​287)
• 86c8643 chore(deps): bump sigs.k8s.io/yaml from 1.4.0 to 1.5.0 (#​286)
• 844d8c2 chore(deps): bump sigs.k8s.io/yaml from 1.5.0 to 1.6.0 (#​288)
• 6f0e2a6 chore: update golang version to patch CVEs (#​296)
• ec19be6 fix(build): resolve kustomize installation failures during cross-compilation (#​299)
• 5890575 fix(cd): try use full path for checking kustomize installation
• 96fb5ef fix(ci): ensure go bin is part of PATH, add logging for debugging release CD
• c58ac0b update(sops): 3.9.2 -> 3.10.2 (#​297)
• 01bebbd v4.4.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Infro diff for e7497d6

argocd.hashbang.sh > argocd (0 files changed)

Details

time="2026-07-21T02:07:00Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."
time="2026-07-21T02:07:14Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."

===== apps/Deployment argocd/argocd-repo-server ======
--- /tmp/argocd-diff2763105844/argocd-repo-server-live.yaml
+++ /tmp/argocd-diff2763105844/argocd-repo-server
@@ -1044,7 +1044,7 @@
         command:
         - /bin/sh
         - -c
-        image: viaductoss/ksops:v4.3.3@sha256:6b5ec4b6144307f78bcddffd8f09020482836eee34cf77bf4ce8614b0452a73c
+        image: viaductoss/ksops:v4.5.1@sha256:4def9fdd4e2f850265740ebe9592c5455d19b76891e88e602df8b52d74b95334
         imagePullPolicy: IfNotPresent
         name: install-ksops
         resources: {}

argocd.hashbang.sh > cloudnative-pg (0 files changed)

Details

time="2026-07-21T02:07:34Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."
time="2026-07-21T02:07:43Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."

===== apiextensions.k8s.io/CustomResourceDefinition /clusters.postgresql.cnpg.io ======
--- /tmp/argocd-diff1203806406/clusters.postgresql.cnpg.io-live.yaml
+++ /tmp/argocd-diff1203806406/clusters.postgresql.cnpg.io
@@ -5784,7 +5784,6 @@
                       procMount denotes the type of proc mount to use for the containers.
                       The default value is Default which uses the container runtime defaults for
                       readonly paths and masked paths.
-                      This requires the ProcMountType feature flag to be enabled.
                       Note that this field cannot be set when spec.os.name is windows.
                     type: string
                   readOnlyRootFilesystem:

===== apiextensions.k8s.io/CustomResourceDefinition /poolers.postgresql.cnpg.io ======
--- /tmp/argocd-diff600613833/poolers.postgresql.cnpg.io-live.yaml
+++ /tmp/argocd-diff600613833/poolers.postgresql.cnpg.io
@@ -2934,7 +2934,6 @@
                                     procMount denotes the type of proc mount to use for the containers.
                                     The default value is Default which uses the container runtime defaults for
                                     readonly paths and masked paths.
-                                    This requires the ProcMountType feature flag to be enabled.
                                     Note that this field cannot be set when spec.os.name is windows.
                                   type: string
                                 readOnlyRootFilesystem:
@@ -4505,7 +4504,6 @@
                                     procMount denotes the type of proc mount to use for the containers.
                                     The default value is Default which uses the container runtime defaults for
                                     readonly paths and masked paths.
-                                    This requires the ProcMountType feature flag to be enabled.
                                     Note that this field cannot be set when spec.os.name is windows.
                                   type: string
                                 readOnlyRootFilesystem:
@@ -4989,7 +4987,6 @@
                           When set to false, a new userns is created for the pod. Setting false is useful for
                           mitigating container breakout vulnerabilities even allowing users to run their
                           containers as root without actually having root privileges on the host.
-                          This field is alpha-level and is only honored by servers that enable the UserNamespacesSupport feature.
                         type: boolean
                       hostname:
                         description: |-
@@ -6159,7 +6156,6 @@
                                     procMount denotes the type of proc mount to use for the containers.
                                     The default value is Default which uses the container runtime defaults for
                                     readonly paths and masked paths.
-                                    This requires the ProcMountType feature flag to be enabled.
                                     Note that this field cannot be set when spec.os.name is windows.
                                   type: string
                                 readOnlyRootFilesystem:
@@ -6728,6 +6724,14 @@
 
                             It adds a name to it that uniquely identifies the ResourceClaim inside the Pod.
                             Containers that need access to the ResourceClaim reference it with this name.
+
+                            When the DRAWorkloadResourceClaims feature gate is enabled and this Pod
+                            belongs to a PodGroup, a PodResourceClaim is matched to a
+                            PodGroupResourceClaim if all of their fields are equal (Name,
+                            ResourceClaimName, and ResourceClaimTemplateName). A matched claim references
+                            a single ResourceClaim shared across all Pods in the PodGroup, reserved for
+                            the PodGroup in ResourceClaimStatus.ReservedFor rather than for individual
+                            Pods.
                           properties:
                             name:
                               description: |-
@@ -6753,6 +6757,16 @@
                                 generated component, will be used to form a unique name for the
                                 ResourceClaim, which will be recorded in pod.status.resourceClaimStatuses.
 
+                                When the DRAWorkloadResourceClaims feature gate is enabled and the pod
+                                belongs to a PodGroup that defines a PodGroupResourceClaim with the same
+                                Name and ResourceClaimTemplateName, this PodResourceClaim resolves to the
+                                ResourceClaim generated for the PodGroup. All pods in the group that
+                                define an equivalent PodResourceClaim matching the
+                                PodGroupResourceClaim's Name and ResourceClaimTemplateName share the same
+                                generated ResourceClaim. ResourceClaims generated for a PodGroup are
+                                owned by the PodGroup and their lifecycles are tied to the PodGroup
+                                instead of any individual pod.
+
                                 This field is immutable and no changes will be made to the
                                 corresponding ResourceClaim by the control plane after creating the
                                 ResourceClaim.
@@ -6878,6 +6892,28 @@
                         x-kubernetes-list-map-keys:
                         - name
                         x-kubernetes-list-type: map
+                      schedulingGroup:
+                        description: |-
+                          SchedulingGroup provides a reference to the immediate scheduling runtime
+                          grouping object that this Pod belongs to.
+                          This field is used by the scheduler to identify the group and apply the
+                          correct group scheduling policies. The association with a group also
+                          impacts other lifecycle aspects of a Pod that are relevant in a wider context
+                          of scheduling like preemption, resource attachment, etc. If not specified,
+                          the Pod is treated as a single unit in all of these aspects.
+                          The group object referenced by this field may not exist at the time the
+                          Pod is created.
+                          This field is immutable, but a group object with the same name may be
+                          recreated with different policies. Doing this during pod scheduling
+                          may result in the placement not conforming to the expected policies.
+                        properties:
+                          podGroupName:
+                            description: |-
+                              PodGroupName specifies the name of the standalone PodGroup object
+                              that represents the runtime instance of this group.
+                              Must be a DNS subdomain.
+                            type: string
+                        type: object
                       securityContext:
                         description: |-
                           SecurityContext holds pod-level security attributes and common container settings.
@@ -8306,7 +8342,7 @@
                                 A failure to resolve or pull the image during pod startup will block containers from starting and may add significant latency. Failures will be retried using normal volume backoff and will be reported on the pod reason and message.
                                 The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
                                 The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
-                                The volume will be mounted read-only (ro) and non-executable files (noexec).
+                                The volume will be mounted read-only (ro).
                                 Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
                                 The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
                               properties:
@@ -8478,8 +8514,7 @@
                               description: |-
                                 portworxVolume represents a portworx volume attached and mounted on kubelets host machine.
                                 Deprecated: PortworxVolume is deprecated. All operations for the in-tree portworxVolume type
-                                are redirected to the pxd.portworx.com CSI driver when the CSIMigrationPortworx feature-gate
-                                is on.
+                                are redirected to the pxd.portworx.com CSI driver.
                               properties:
                                 fsType:
                                   description: |-
@@ -9302,42 +9337,6 @@
                         x-kubernetes-list-map-keys:
                         - name
                         x-kubernetes-list-type: map
-                      workloadRef:
-                        description: |-
-                          WorkloadRef provides a reference to the Workload object that this Pod belongs to.
-                          This field is used by the scheduler to identify the PodGroup and apply the
-                          correct group scheduling policies. The Workload object referenced
-                          by this field may not exist at the time the Pod is created.
-                          This field is immutable, but a Workload object with the same name
-                          may be recreated with different policies. Doing this during pod scheduling
-                          may result in the placement not conforming to the expected policies.
-                        properties:
-                          name:
-                            description: |-
-                              Name defines the name of the Workload object this Pod belongs to.
-                              Workload must be in the same namespace as the Pod.
-                              If it doesn't match any existing Workload, the Pod will remain unschedulable
-                              until a Workload object is created and observed by the kube-scheduler.
-                              It must be a DNS subdomain.
-                            type: string
-                          podGroup:
-                            description: |-
-                              PodGroup is the name of the PodGroup within the Workload that this Pod
-                              belongs to. If it doesn't match any existing PodGroup within the Workload,
-                              the Pod will remain unschedulable until the Workload object is recreated
-                              and observed by the kube-scheduler. It must be a DNS label.
-                            type: string
-                          podGroupReplicaKey:
-                            description: |-
-                              PodGroupReplicaKey specifies the replica key of the PodGroup to which this
-                              Pod belongs. It is used to distinguish pods belonging to different replicas
-                              of the same pod group. The pod group policy is applied separately to each replica.
-                              When set, it must be a DNS label.
-                            type: string
-                        required:
-                        - name
-                        - podGroup
-                        type: object
                     required:
                     - containers
                     type: object

===== coordination.k8s.io/Lease /db9c8771.cnpg.io ======
--- /tmp/argocd-diff3123588241/db9c8771.cnpg.io-live.yaml
+++ /tmp/argocd-diff3123588241/db9c8771.cnpg.io
@@ -0,0 +1,11 @@
+apiVersion: coordination.k8s.io/v1
+kind: Lease
+metadata:
+  annotations:
+    argocd.argoproj.io/tracking-id: cloudnative-pg:coordination.k8s.io/Lease:cloudnative-pg/db9c8771.cnpg.io
+  labels:
+    app.kubernetes.io/component: manager
+    app.kubernetes.io/instance: cloudnative-pg
+    app.kubernetes.io/name: cloudnative-pg
+  name: db9c8771.cnpg.io
+spec: {}

argocd.hashbang.sh > external-dns (0 files changed)

Details

time="2026-07-21T02:07:46Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."
time="2026-07-21T02:07:49Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."

===== apps/Deployment external-dns/external-dns ======
--- /tmp/argocd-diff708768206/external-dns-live.yaml
+++ /tmp/argocd-diff708768206/external-dns
@@ -173,11 +173,6 @@
         - --provider=aws
         - --txt-owner-id=digitalocean-hashbang
         - --txt-prefix=_owner.
-        - --source=crd
-        - --domain-filter=hashbang.sh
-        - --managed-record-types=A
-        - --managed-record-types=CNAME
-        - --managed-record-types=TXT
         env:
         - name: AWS_REGION
           value: us-west-2