Skip to content

Commit 7a476bd

Browse files
akhilnittalaakhilnittala
authored
feat: Configuring TLS options from Central TLS Profile for Argo CD repo server and server components (#2264)
* sync changes to master from release-0.18.0 Signed-off-by: akhil nittala <nakhil@redhat.com> * Configuring TLS options from Central TLS Profile for Argo CD repo server and server components Signed-off-by: akhil nittala <nakhil@redhat.com> * Configuring TLS options from Central TLS Profile for Argo CD repo server and server components Signed-off-by: akhil nittala <nakhil@redhat.com> * Configuring TLS options from Central TLS Profile for Argo CD repo server and server components Signed-off-by: akhil nittala <nakhil@redhat.com> * Configuring TLS options from Central TLS Profile for Argo CD repo server and server components Signed-off-by: akhil nittala <nakhil@redhat.com> * Configuring TLS options from Central TLS Profile for Argo CD repo server and server components Signed-off-by: akhil nittala <nakhil@redhat.com> * Configuring TLS options from Central TLS Profile for Argo CD repo server and server components Signed-off-by: akhil nittala <nakhil@redhat.com> * Configuring TLS options from Central TLS Profile for Argo CD repo server and server components Signed-off-by: akhil nittala <nakhil@redhat.com> * Configuring TLS options from Central TLS Profile for Argo CD repo server and server components Signed-off-by: akhil nittala <nakhil@redhat.com> --------- Signed-off-by: akhil nittala <nakhil@redhat.com>
1 parent ba07c09 commit 7a476bd

3 files changed

Lines changed: 125 additions & 1 deletion

File tree

‎controllers/argocd/deployment.go‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,9 @@ func getArgoRedisArgs(useTLS bool, centralTLSConfig TLSConfigProfile) []string {
244244

245245
// BuildRedisArgsFromClusterTLSProfile builds arguments for redis deployment based on central tls config.
246246
func BuildRedisArgsFromClusterTLSProfile(centralTLSConfig TLSConfigProfile) []string {
247+
if centralTLSConfig.DisableClusterTLSProfile {
248+
return nil
249+
}
247250
var (
248251
args []string
249252
protocol string
@@ -960,8 +963,9 @@ func (r *ReconcileArgoCD) reconcileServerDeployment(cr *argoproj.ArgoCD, useTLSF
960963
if cr.Spec.Server.VolumeMounts != nil {
961964
serverVolumeMounts = append(serverVolumeMounts, cr.Spec.Server.VolumeMounts...)
962965
}
963-
966+
arguments := BuildTLSArgsFromClusterTLSProfile(r.CentralTLSConfigProfile)
964967
deploy.Spec.Template.Spec.Containers = []corev1.Container{{
968+
Args: arguments,
965969
Command: getArgoServerCommand(cr, useTLSForRedis),
966970
Image: getArgoContainerImage(cr),
967971
ImagePullPolicy: argoutil.GetImagePullPolicy(cr.Spec.ImagePullPolicy),
@@ -1151,6 +1155,10 @@ func (r *ReconcileArgoCD) reconcileServerDeployment(cr *argoproj.ArgoCD, useTLSF
11511155
existing.Spec.Template.Labels["image.upgraded"] = time.Now().UTC().Format("01022006-150406-MST")
11521156
changes = append(changes, "container image")
11531157
}
1158+
if !reflect.DeepEqual(existing.Spec.Template.Spec.Containers[0].Args, deploy.Spec.Template.Spec.Containers[0].Args) {
1159+
existing.Spec.Template.Spec.Containers[0].Args = deploy.Spec.Template.Spec.Containers[0].Args
1160+
changes = append(changes, "container args")
1161+
}
11541162
if actualImagePullPolicy != desiredImagePullPolicy {
11551163
existing.Spec.Template.Spec.Containers[0].ImagePullPolicy = desiredImagePullPolicy
11561164
changes = append(changes, "image pull policy")
@@ -1250,6 +1258,21 @@ func (r *ReconcileArgoCD) reconcileServerDeployment(cr *argoproj.ArgoCD, useTLSF
12501258
return r.Create(context.TODO(), deploy)
12511259
}
12521260

1261+
// BuildTLSArgsFromClusterTLSProfile builds the command line arguments for the ArgoCD components based on the cluster's TLS profile configuration.
1262+
func BuildTLSArgsFromClusterTLSProfile(centralTLSConfig TLSConfigProfile) []string {
1263+
var args []string
1264+
if centralTLSConfig.DisableClusterTLSProfile {
1265+
return nil
1266+
}
1267+
if v := argoutil.TLSProtocolVersionString(centralTLSConfig.MinVersion); v != "" {
1268+
args = append(args, "--tlsminversion", v)
1269+
}
1270+
if ciphers := argoutil.MapCipherSuites(centralTLSConfig.Ciphers); len(ciphers) > 0 {
1271+
args = append(args, "--tlsciphers", strings.Join(ciphers, ":"))
1272+
}
1273+
return args
1274+
}
1275+
12531276
// triggerDeploymentRollout will update the label with the given key to trigger a new rollout of the Deployment.
12541277
func (r *ReconcileArgoCD) triggerDeploymentRollout(deployment *appsv1.Deployment, key string) error {
12551278

‎controllers/argocd/deployment_test.go‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3237,3 +3237,98 @@ func TestBuildRedisArgs(t *testing.T) {
32373237
})
32383238
}
32393239
}
3240+
3241+
func TestBuildTLSArgs(t *testing.T) {
3242+
tests := []struct {
3243+
name string
3244+
centralTLS TLSConfigProfile
3245+
expected []string
3246+
wantErr bool
3247+
}{
3248+
{
3249+
name: "disable central tls config",
3250+
centralTLS: TLSConfigProfile{
3251+
DisableClusterTLSProfile: true,
3252+
},
3253+
expected: nil,
3254+
wantErr: false,
3255+
},
3256+
{
3257+
name: "central TLS config with min version only",
3258+
centralTLS: TLSConfigProfile{
3259+
MinVersion: configv1.VersionTLS12,
3260+
},
3261+
expected: []string{
3262+
"--tlsminversion",
3263+
"1.2",
3264+
},
3265+
wantErr: false,
3266+
},
3267+
{
3268+
name: "central TLS config with ciphers only",
3269+
centralTLS: TLSConfigProfile{
3270+
Ciphers: []string{
3271+
"ECDHE-RSA-AES128-GCM-SHA256",
3272+
},
3273+
},
3274+
expected: []string{
3275+
"--tlsciphers",
3276+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
3277+
},
3278+
wantErr: false,
3279+
},
3280+
{
3281+
name: "central TLS config with version and ciphers",
3282+
centralTLS: TLSConfigProfile{
3283+
MinVersion: configv1.VersionTLS13,
3284+
Ciphers: []string{
3285+
"TLS_AES_128_GCM_SHA256",
3286+
"ECDHE-RSA-AES256-GCM-SHA384",
3287+
},
3288+
},
3289+
expected: []string{
3290+
"--tlsminversion",
3291+
"1.3",
3292+
"--tlsciphers",
3293+
"TLS_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
3294+
},
3295+
wantErr: false,
3296+
},
3297+
}
3298+
3299+
for _, tt := range tests {
3300+
t.Run(tt.name, func(t *testing.T) {
3301+
got := BuildTLSArgsFromClusterTLSProfile(tt.centralTLS)
3302+
if !reflect.DeepEqual(got, tt.expected) {
3303+
t.Fatalf("expected %#v got %#v", tt.expected, got)
3304+
}
3305+
})
3306+
}
3307+
}
3308+
3309+
func TestArgoCDServerAndRepoServerDeploymentArgs(t *testing.T) {
3310+
a := makeTestArgoCD()
3311+
3312+
resObjs := []client.Object{a}
3313+
subresObjs := []client.Object{a}
3314+
runtimeObjs := []runtime.Object{}
3315+
sch := makeTestReconcilerScheme(argoproj.AddToScheme)
3316+
cl := makeTestReconcilerClient(sch, resObjs, subresObjs, runtimeObjs)
3317+
r := makeTestReconciler(cl, sch, testclient.NewSimpleClientset())
3318+
r.CentralTLSConfigProfile = TLSConfigProfile{
3319+
DisableClusterTLSProfile: false,
3320+
MinVersion: configv1.VersionTLS12,
3321+
Ciphers: []string{
3322+
"ECDHE-RSA-AES128-GCM-SHA256",
3323+
"ECDHE-RSA-AES256-GCM-SHA384",
3324+
},
3325+
}
3326+
deployment := &appsv1.Deployment{}
3327+
assert.NoError(t, r.reconcileServerDeployment(a, false))
3328+
assert.NoError(t, r.Get(context.TODO(), types.NamespacedName{Name: "argocd-server", Namespace: a.Namespace}, deployment))
3329+
args := []string{"--tlsminversion", "1.2", "--tlsciphers", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"}
3330+
assert.Equal(t, args, deployment.Spec.Template.Spec.Containers[0].Args)
3331+
assert.NoError(t, r.reconcileRepoDeployment(a, false))
3332+
assert.NoError(t, r.Get(context.TODO(), types.NamespacedName{Name: "argocd-repo-server", Namespace: a.Namespace}, deployment))
3333+
assert.Equal(t, args, deployment.Spec.Template.Spec.Containers[0].Args)
3334+
}

‎controllers/argocd/repo_server.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,9 @@ func (r *ReconcileArgoCD) reconcileRepoDeployment(cr *argocdoperatorv1beta1.Argo
223223
repoServerVolumeMounts = append(repoServerVolumeMounts, cr.Spec.Repo.VolumeMounts...)
224224
}
225225

226+
arguments := BuildTLSArgsFromClusterTLSProfile(r.CentralTLSConfigProfile)
226227
deploy.Spec.Template.Spec.Containers = []corev1.Container{{
228+
Args: arguments,
227229
Command: getArgoRepoCommand(cr, useTLSForRedis),
228230
Image: getRepoServerContainerImage(cr),
229231
ImagePullPolicy: argoutil.GetImagePullPolicy(cr.Spec.ImagePullPolicy),
@@ -419,6 +421,10 @@ func (r *ReconcileArgoCD) reconcileRepoDeployment(cr *argocdoperatorv1beta1.Argo
419421
existing.Spec.Template.Labels["image.upgraded"] = time.Now().UTC().Format("01022006-150406-MST")
420422
changes = append(changes, "container image")
421423
}
424+
if !reflect.DeepEqual(existing.Spec.Template.Spec.Containers[0].Args, deploy.Spec.Template.Spec.Containers[0].Args) {
425+
existing.Spec.Template.Spec.Containers[0].Args = deploy.Spec.Template.Spec.Containers[0].Args
426+
changes = append(changes, "container args")
427+
}
422428
if actualImagePullPolicy != desiredImagePullPolicy {
423429
existing.Spec.Template.Spec.Containers[0].ImagePullPolicy = desiredImagePullPolicy
424430
changes = append(changes, "image pull policy")

0 commit comments

Comments
 (0)