Checklist:

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug

When using a named custom kustomize version in argocd-cm (e.g. kustomize.path.with-helm + kustomize.buildOptions.with-helm), the per-version build options are correctly parsed and stored internally but are never appended to the actual kustomize build command. Only the global kustomize.buildOptions (no version suffix) reaches the build invocation. The result is that kustomize.buildOptions.<version> is silently ignored even though kustomize.path.<version> works correctly.

To Reproduce

1. Add to argocd-cm:

data:
  kustomize.path.with-helm: /usr/local/bin/kustomize
  kustomize.buildOptions.with-helm: --enable-helm

2. Create an Application referencing the named version:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: test-kustomize-with-helm
spec:
  source:
    repoURL: https://example.com/repo.git
    targetRevision: HEAD
    path: my-kustomize-app
    kustomize:
      version: with-helm

3. Use a kustomization.yaml with helmCharts:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
helmCharts:
  - name: podinfo
    repo: oci://ghcr.io/stefanprodan/charts
    version: 6.7.1
    releaseName: podinfo-test
    namespace: test-podinfo

4. Restart argocd-repo-server and argocd-applicationset-controller.

5. Trigger a sync: the application fails with must specify --enable-helm.

Expected behavior

ArgoCD invokes:

/usr/local/bin/kustomize build <path> --enable-helm

The per-version build options (kustomize.buildOptions.with-helm) are applied when an Application selects that version via spec.source.kustomize.version: with-helm.

Screenshots

Repo-server log output:

time="..." level=info msg="/usr/local/bin/kustomize build /tmp/_argocd-repo/.../kustomize-with-helm"
time="..." level=error msg="`/usr/local/bin/kustomize build /tmp/_argocd-repo/.../kustomize-with-helm` failed exit status 1:
Error: trouble configuring builtin HelmChartInflationGenerator with config: `
chartHome: charts
includeCRDs: true
name: podinfo
namespace: test-podinfo
releaseName: podinfo-test
repo: oci://ghcr.io/stefanprodan/charts
version: 6.7.1
`: must specify --enable-helm"

Note: --enable-helm is absent from the command. kustomize.path.with-helm is applied correctly (the right binary path is used); only kustomize.buildOptions.with-helm is ignored.

To confirm that kustomize.path.<version> is genuinely being respected, setting the path to a non-existent binary produces the expected error:

kustomize.path.with-helm: /usr/local/bin/kustomize-test  # does not exist

Failed to load target state: failed to generate manifest for source 1 of 1:
rpc error: code = Unknown desc = fork/exec /usr/local/bin/kustomize-test: no such file or directory

This proves the path lookup works end-to-end. The build options from kustomize.buildOptions.with-helm are the only thing not reaching the command.

Version

argocd: v3.3.2
  BuildDate: 2026-02-22T12:33:55Z
  GitCommit: 8a3940d8db27928931f0a85ba7c636e54786bddc

Also reproduced by code inspection in v3.3.9 and v3.4.0-rc7: the relevant files are identical across all three versions.

Possible Root cause

GetKustomizeSettings() in util/settings/settings.go correctly parses kustomize.buildOptions.with-helm and stores it in KustomizeVersion.BuildOptions. However, in reposerver/repository/repository.go, after calling GetKustomizeBinaryPath() (which correctly resolves the binary path from Versions), there is no equivalent call to extract the matched version's BuildOptions. The Build() function in util/kustomize/kustomize.go only reads the top-level kustomizeOptions.BuildOptions (the global field): it never reads kustomizeOptions.Versions[i].BuildOptions.

Relevant files:

• https://github.com/argoproj/argo-cd/blob/v3.3.9/util/settings/settings.go
• https://github.com/argoproj/argo-cd/blob/v3.3.9/reposerver/repository/repository.go
• https://github.com/argoproj/argo-cd/blob/v3.3.9/util/kustomize/kustomize.go

Related: #18026 (different symptom: global not applied as fallback: but similar underlying gap)

Workaround

Use the global build options instead:

data:
  kustomize.buildOptions: --enable-helm