Merge branch 'argoproj-labs:master' into master

akhilnittala · web-flow · commit 80e93f883e0f · 2026-06-24T10:39:32.000+05:30
diff --git a/.github/workflows/ci-build.yaml b/.github/workflows/ci-build.yaml
@@ -22,7 +22,7 @@ jobs:
         run: mkdir -p ~/go/src/github.com/argoproj-labs
 
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Create symlink in GOPATH
         run: ln -s $(pwd) ~/go/src/github.com/argoproj-labs
@@ -76,7 +76,7 @@ jobs:
           kubectl version
           k3d version
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Setup Golang
         uses: actions/setup-go@v6
         with:
diff --git a/.github/workflows/codegen.yaml b/.github/workflows/codegen.yaml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Setup Golang
         uses: actions/setup-go@v6
         with:
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Setup Golang
         uses: actions/setup-go@v6
         with:
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
@@ -19,7 +19,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Set up Go
       uses: actions/setup-go@v6
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
@@ -17,7 +17,7 @@ jobs:
     steps:
 
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Go
         uses: actions/setup-go@v6
diff --git a/build/redis/init.sh.tpl b/build/redis/init.sh.tpl
@@ -266,10 +266,4 @@ echo "Setting redis auth values.."
 ESCAPED_AUTH=$(echo "${AUTH}" | sed -e 's/[\/&]/\\&/g');
 sed -i "s/__REPLACE_DEFAULT_AUTH__/${ESCAPED_AUTH}/" "${REDIS_CONF}" "${SENTINEL_CONF}"
 
-if [ "${SENTINELAUTH:-}" ]; then
-    echo "Setting sentinel auth values"
-    ESCAPED_AUTH_SENTINEL=$(echo "$SENTINELAUTH" | sed -e 's/[\/&]/\\&/g');
-    sed -i "s/__REPLACE_DEFAULT_SENTINEL_AUTH__/${ESCAPED_AUTH_SENTINEL}/" "$SENTINEL_CONF"
-fi
-
 echo "$(date) Ready..."
diff --git a/controllers/argocd/applicationset.go b/controllers/argocd/applicationset.go
@@ -645,6 +645,9 @@ func (r *ReconcileArgoCD) reconcileApplicationSetClusterRole(cr *argoproj.ArgoCD
 
 	// ArgoCD not cluster scoped, cleanup any existing resource and exit
 	if !allowed {
+		if !argoutil.CheckClusterRoleOwnership(existingClusterRole, cr) {
+			return existingClusterRole, nil
+		}
 		argoutil.LogResourceDeletion(log, existingClusterRole, "argocd not cluster scoped")
 		err := r.Delete(context.TODO(), existingClusterRole)
 		if err != nil {
@@ -709,6 +712,9 @@ func (r *ReconcileArgoCD) reconcileApplicationSetClusterRoleBinding(cr *argoproj
 
 	// ArgoCD not cluster scoped, cleanup any existing resource and exit
 	if !allowed {
+		if !argoutil.CheckClusterRoleBindingOwnership(existingClusterRB, cr) {
+			return nil
+		}
 		argoutil.LogResourceDeletion(log, existingClusterRB, "argocd not cluster scoped")
 		err := r.Delete(context.TODO(), existingClusterRB)
 		if err != nil {
diff --git a/controllers/argocd/image_updater.go b/controllers/argocd/image_updater.go
@@ -502,6 +502,16 @@ func (r *ReconcileArgoCD) deleteImageUpdaterClusterRBAC(cr *argoproj.ArgoCD) err
 				return err
 			}
 		} else {
+			switch o := obj.(type) {
+			case *rbacv1.ClusterRole:
+				if !argoutil.CheckClusterRoleOwnership(o, cr) {
+					continue
+				}
+			case *rbacv1.ClusterRoleBinding:
+				if !argoutil.CheckClusterRoleBindingOwnership(o, cr) {
+					continue
+				}
+			}
 			argoutil.LogResourceDeletion(log, obj, "IMAGE_UPDATER_WATCH_NAMESPACES is no longer \"*\"")
 			if err := r.Delete(context.TODO(), obj); err != nil && !errors.IsNotFound(err) {
 				return err
@@ -732,6 +742,9 @@ func (r *ReconcileArgoCD) reconcileRoleHelper(cr *argoproj.ArgoCD, desiredRole c
 
 	// role exists but shouldn't, so it should be deleted
 	if !cr.Spec.ImageUpdater.Enabled {
+		if clusterRole, ok := existingRole.(*rbacv1.ClusterRole); ok && !argoutil.CheckClusterRoleOwnership(clusterRole, cr) {
+			return nil, nil
+		}
 		argoutil.LogResourceDeletion(log, existingRole, "image updater is disabled")
 		return nil, r.Delete(context.TODO(), existingRole)
 	}
@@ -814,6 +827,9 @@ func (r *ReconcileArgoCD) reconcileRoleBindingHelper(cr *argoproj.ArgoCD, desire
 
 	// roleBinding exists but shouldn't, so it should be deleted
 	if !cr.Spec.ImageUpdater.Enabled {
+		if clusterRoleBinding, ok := existingRoleBinding.(*rbacv1.ClusterRoleBinding); ok && !argoutil.CheckClusterRoleBindingOwnership(clusterRoleBinding, cr) {
+			return nil
+		}
 		argoutil.LogResourceDeletion(log, existingRoleBinding, "image updater is disabled")
 		return r.Delete(context.TODO(), existingRoleBinding)
 	}
diff --git a/controllers/argocd/role.go b/controllers/argocd/role.go
@@ -384,6 +384,10 @@ func (r *ReconcileArgoCD) reconcileClusterRole(componentName string, policyRules
 	}
 
 	if !allowed {
+		ownedByCurrentArgoCD := argoutil.CheckClusterRoleOwnership(existingClusterRole, cr)
+		if !ownedByCurrentArgoCD {
+			return nil, nil
+		}
 		// delete existing ClusterRole as namespace can not host cluster-scoped Argo CD instance
 		argoutil.LogResourceDeletion(log, existingClusterRole, fmt.Sprintf("namespace '%s' cannot host cluster-scoped argocd instance", cr.Namespace))
 		return nil, r.Delete(context.TODO(), existingClusterRole)
diff --git a/controllers/argocd/rolebinding.go b/controllers/argocd/rolebinding.go
@@ -392,6 +392,9 @@ func (r *ReconcileArgoCD) reconcileClusterRoleBinding(name string, role *v1.Clus
 	}
 
 	if roleBindingExists && role == nil {
+		if !argoutil.CheckClusterRoleBindingOwnership(roleBinding, cr) {
+			return nil
+		}
 		argoutil.LogResourceDeletion(log, roleBinding, "role binding has no corresponding role")
 		return r.Delete(context.TODO(), roleBinding)
 	}
diff --git a/controllers/argocdagent/agent/role.go b/controllers/argocdagent/agent/role.go
@@ -104,6 +104,9 @@ func ReconcileAgentClusterRoles(client client.Client, compName string, cr *argop
 	// If ClusterRole exists, handle updates or deletion
 	if exists {
 		if !hasAgent(cr) || !cr.Spec.ArgoCDAgent.Agent.IsEnabled() || !allowed {
+			if !argoutil.CheckClusterRoleOwnership(clusterRole, cr) {
+				return clusterRole, nil
+			}
 			argoutil.LogResourceDeletion(log, clusterRole, "agent clusterRole is being deleted as agent is disabled")
 			if err := client.Delete(context.TODO(), clusterRole); err != nil {
 				return clusterRole, fmt.Errorf("failed to delete agent clusterRole %s: %v", clusterRole.Name, err)
diff --git a/controllers/argocdagent/agent/rolebinding.go b/controllers/argocdagent/agent/rolebinding.go
@@ -119,6 +119,9 @@ func ReconcileAgentClusterRoleBinding(client client.Client, compName string, sa
 	// If ClusterRoleBinding exists, handle updates or deletion
 	if exists {
 		if !hasAgent(cr) || !cr.Spec.ArgoCDAgent.Agent.IsEnabled() || !allowed {
+			if !argoutil.CheckClusterRoleBindingOwnership(clusterRoleBinding, cr) {
+				return nil
+			}
 			argoutil.LogResourceDeletion(log, clusterRoleBinding, "agent clusterrolebinding is being deleted as agent is disabled")
 			if err := client.Delete(context.TODO(), clusterRoleBinding); err != nil {
 				return fmt.Errorf("failed to delete agent clusterrolebinding %s: %v", clusterRoleBinding.Name, err)
diff --git a/controllers/argocdagent/role.go b/controllers/argocdagent/role.go
@@ -104,6 +104,9 @@ func ReconcilePrincipalClusterRoles(client client.Client, compName string, cr *a
 	// If ClusterRole exists, handle updates or deletion
 	if exists {
 		if cr.Spec.ArgoCDAgent == nil || cr.Spec.ArgoCDAgent.Principal == nil || !cr.Spec.ArgoCDAgent.Principal.IsEnabled() || !allowed {
+			if !argoutil.CheckClusterRoleOwnership(clusterRole, cr) {
+				return clusterRole, nil
+			}
 			argoutil.LogResourceDeletion(log, clusterRole, "principal clusterRole is being deleted as principal is disabled")
 			if err := client.Delete(context.TODO(), clusterRole); err != nil {
 				return clusterRole, fmt.Errorf("failed to delete principal clusterRole %s: %v", clusterRole.Name, err)
diff --git a/controllers/argocdagent/rolebinding.go b/controllers/argocdagent/rolebinding.go
@@ -114,6 +114,9 @@ func ReconcilePrincipalClusterRoleBinding(client client.Client, compName string,
 	// If ClusterRoleBinding exists, handle updates or deletion
 	if exists {
 		if cr.Spec.ArgoCDAgent == nil || cr.Spec.ArgoCDAgent.Principal == nil || !cr.Spec.ArgoCDAgent.Principal.IsEnabled() || !allowed {
+			if !argoutil.CheckClusterRoleBindingOwnership(clusterRoleBinding, cr) {
+				return nil
+			}
 			argoutil.LogResourceDeletion(log, clusterRoleBinding, "principal clusterRoleBinding is being deleted as principal is disabled")
 			if err := client.Delete(context.TODO(), clusterRoleBinding); err != nil {
 				return fmt.Errorf("failed to delete principal clusterRoleBinding %s: %v", clusterRoleBinding.Name, err)
diff --git a/controllers/argoutil/resource.go b/controllers/argoutil/resource.go
@@ -29,6 +29,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/go-logr/logr"
+	v1 "k8s.io/api/rbac/v1"
 
 	argoprojv1alpha1 "github.com/argoproj-labs/argocd-operator/api/v1alpha1"
 	argoproj "github.com/argoproj-labs/argocd-operator/api/v1beta1"
@@ -140,6 +141,22 @@ func NameWithSuffix(meta metav1.ObjectMeta, suffix string) string {
 	return TruncateWithHash(fullName, maxLabelLength)
 }
 
+func CheckClusterRoleOwnership(clusterRole *v1.ClusterRole, cr *argoproj.ArgoCD) bool {
+	managedByLabelValue, managedByLabelExists := clusterRole.Labels[common.ArgoCDKeyManagedBy]
+	if managedByLabelExists && managedByLabelValue != cr.Name {
+		return false
+	}
+	return true
+}
+
+func CheckClusterRoleBindingOwnership(clusterRoleBinding *v1.ClusterRoleBinding, cr *argoproj.ArgoCD) bool {
+	managedByLabelValue, managedByLabelExists := clusterRoleBinding.Labels[common.ArgoCDKeyManagedBy]
+	if managedByLabelExists && managedByLabelValue != cr.Name {
+		return false
+	}
+	return true
+}
+
 // NameWithSuffixForStatefulSet returns a StatefulSet name that stays within the Kubernetes
 // label length limit after controller revision hash suffixes are applied.
 // Preserves the original suffix when possible to maintain backward compatibility.
diff --git a/docs/usage/respect_rbac.md b/docs/usage/respect_rbac.md
@@ -15,4 +15,10 @@ spec:
     respectRBAC: strict
 ```
 
+## Cluster Scoped Instances
+
+For cluster-scoped Argo CD instances, it is recommended to disable the default cluster roles to retain full control over the Kubernetes permissions granted to the application-controller. This can be achieved by setting `ArgoCD.Spec.DefaultClusterScopedRoleDisabled` field to `true`. Refer to the [Custom Roles documentation](custom_roles.md#cluster-scoped-roles) for further details.
+
+
+> Note: When respectRBAC is enabled on a cluster-scoped Argo CD instance, the application-controller service account still requires cluster-wide permissions for the Application, AppProject and ApplicationSet resources, and the server service account needs cluster-wide permissions for the Application and ApplicationSet resources. These permissions are required because the controller establishes watches on these resources independently of the watches Argo CD creates for managed cluster resources.
 

Original file line number	Diff line number	Diff line change
`@@ -392,6 +392,9 @@ func (r ReconcileArgoCD) reconcileClusterRoleBinding(name string, role v1.Clus`
`392`	`392`	`}`
`393`	`393`
`394`	`394`	`if roleBindingExists && role == nil {`
	`395`	`+ if !argoutil.CheckClusterRoleBindingOwnership(roleBinding, cr) {`
	`396`	`+ return nil`
	`397`	`+ }`
`395`	`398`	`argoutil.LogResourceDeletion(log, roleBinding, "role binding has no corresponding role")`
`396`	`399`	`return r.Delete(context.TODO(), roleBinding)`
`397`	`400`	`}`