Merge branch 'argoproj-labs:master' into master

Author: akhilnittala

bundle/manifests/argocd-operator.clusterserviceversion.yaml

@@ -257,7 +257,7 @@ metadata:
     capabilities: Deep Insights
     categories: Integration & Delivery
     certified: "false"
-    createdAt: "2026-06-30T07:22:31Z"
+    createdAt: "2026-07-07T12:03:30Z"
     description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.
     operators.operatorframework.io/builder: operator-sdk-v1.35.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4

bundle/manifests/argoproj.io_argocds.yaml

@@ -1690,7 +1690,7 @@ func (r *ReconcileArgoCD) reconcileArgoCDAgent(cr *argoproj.ArgoCD) error {
 	}
 
 	log.Info("reconciling ArgoCD Agent's Principal deployment")
-	if err := argocdagent.ReconcilePrincipalDeployment(r.Client, compName, sa.Name, cr, r.Scheme); err != nil {
+	if err := argocdagent.ReconcilePrincipalDeployment(r.Client, compName, sa.Name, cr, r.Scheme, r.CentralTLSConfigProfile); err != nil {
 		return err
 	}
 

config/crd/bases/argoproj.io_argocds.yaml

@@ -34,11 +34,13 @@ import (
 	argoproj "github.com/argoproj-labs/argocd-operator/api/v1beta1"
 	"github.com/argoproj-labs/argocd-operator/common"
 	"github.com/argoproj-labs/argocd-operator/controllers/argoutil"
+
+	tlsProfile "github.com/argoproj-labs/argocd-operator/pkg/tlsprofile"
 )
 
 // ReconcilePrincipalDeployment reconciles the ArgoCD agent principal deployment.
 // It creates, updates, or deletes the deployment based on the ArgoCD CR configuration.
-func ReconcilePrincipalDeployment(client client.Client, compName, saName string, cr *argoproj.ArgoCD, scheme *runtime.Scheme) error {
+func ReconcilePrincipalDeployment(client client.Client, compName, saName string, cr *argoproj.ArgoCD, scheme *runtime.Scheme, centralTLSProfile tlsProfile.TLSConfigProfile) error {
 	deployment := buildDeployment(compName, cr)
 
 	// Check if deployment already exists
@@ -60,7 +62,7 @@ func ReconcilePrincipalDeployment(client client.Client, compName, saName string,
 			return nil
 		}
 
-		deployment, changed := updateDeploymentIfChanged(compName, saName, cr, deployment)
+		deployment, changed := updateDeploymentIfChanged(compName, saName, cr, deployment, centralTLSProfile)
 		if changed {
 			argoutil.LogResourceUpdate(log, deployment, "principal deployment is being updated")
 			if err := client.Update(context.TODO(), deployment); err != nil {
@@ -80,7 +82,7 @@ func ReconcilePrincipalDeployment(client client.Client, compName, saName string,
 	}
 
 	argoutil.LogResourceCreation(log, deployment)
-	deployment.Spec = buildPrincipalSpec(compName, saName, cr)
+	deployment.Spec = buildPrincipalSpec(compName, saName, cr, centralTLSProfile)
 	if err := client.Create(context.TODO(), deployment); err != nil {
 		return fmt.Errorf("failed to create principal deployment %s in namespace %s: %v", deployment.Name, cr.Namespace, err)
 	}
@@ -97,8 +99,9 @@ func buildDeployment(compName string, cr *argoproj.ArgoCD) *appsv1.Deployment {
 	}
 }
 
-func buildPrincipalSpec(compName, saName string, cr *argoproj.ArgoCD) appsv1.DeploymentSpec {
+func buildPrincipalSpec(compName, saName string, cr *argoproj.ArgoCD, centralTLSProfile tlsProfile.TLSConfigProfile) appsv1.DeploymentSpec {
 	redisAuthVolume, redisAuthMount := argoutil.MountRedisAuthToArgo(cr)
+	envParams := buildPrincipalContainerEnv(cr, centralTLSProfile)
 	return appsv1.DeploymentSpec{
 		Selector: buildSelector(compName, cr),
 		Template: corev1.PodTemplateSpec{
@@ -111,7 +114,7 @@ func buildPrincipalSpec(compName, saName string, cr *argoproj.ArgoCD) appsv1.Dep
 						Image:           buildPrincipalImage(cr),
 						ImagePullPolicy: argoutil.GetImagePullPolicy(cr.Spec.ImagePullPolicy),
 						Name:            generateAgentResourceName(cr.Name, compName),
-						Env:             buildPrincipalContainerEnv(cr),
+						Env:             envParams,
 						Args:            buildArgs(compName),
 						SecurityContext: buildSecurityContext(),
 						Ports:           buildPorts(compName),
@@ -250,7 +253,7 @@ func buildVolumes() []corev1.Volume {
 // updateDeploymentIfChanged compares the current deployment with the desired state
 // and updates it if any changes are detected. Returns the updated deployment and a boolean
 // indicating whether any changes were made.
-func updateDeploymentIfChanged(compName, saName string, cr *argoproj.ArgoCD, deployment *appsv1.Deployment) (*appsv1.Deployment, bool) {
+func updateDeploymentIfChanged(compName, saName string, cr *argoproj.ArgoCD, deployment *appsv1.Deployment, centralTLSProfile tlsProfile.TLSConfigProfile) (*appsv1.Deployment, bool) {
 	changed := false
 
 	if !reflect.DeepEqual(deployment.Spec.Selector, buildSelector(compName, cr)) {
@@ -276,11 +279,11 @@ func updateDeploymentIfChanged(compName, saName string, cr *argoproj.ArgoCD, dep
 		changed = true
 		deployment.Spec.Template.Spec.Containers[0].Name = generateAgentResourceName(cr.Name, compName)
 	}
-
-	if !reflect.DeepEqual(deployment.Spec.Template.Spec.Containers[0].Env, buildPrincipalContainerEnv(cr)) {
+	envParams := buildPrincipalContainerEnv(cr, centralTLSProfile)
+	if !reflect.DeepEqual(deployment.Spec.Template.Spec.Containers[0].Env, envParams) {
 		log.Info("deployment container env is being updated")
 		changed = true
-		deployment.Spec.Template.Spec.Containers[0].Env = buildPrincipalContainerEnv(cr)
+		deployment.Spec.Template.Spec.Containers[0].Env = envParams
 	}
 
 	if !reflect.DeepEqual(deployment.Spec.Template.Spec.Containers[0].Args, buildArgs(compName)) {
@@ -332,7 +335,8 @@ func updateDeploymentIfChanged(compName, saName string, cr *argoproj.ArgoCD, dep
 	return deployment, changed
 }
 
-func buildPrincipalContainerEnv(cr *argoproj.ArgoCD) []corev1.EnvVar {
+func buildPrincipalContainerEnv(cr *argoproj.ArgoCD, centralTLSProfile tlsProfile.TLSConfigProfile) []corev1.EnvVar {
+	arguments := getPrincipalTlsConfig(centralTLSProfile)
 	env := []corev1.EnvVar{
 		{
 			Name:  EnvArgoCDPrincipalLogLevel,
@@ -391,6 +395,12 @@ func buildPrincipalContainerEnv(cr *argoproj.ArgoCD) []corev1.EnvVar {
 		}, {
 			Name:  EnvArgoCDPrincipalResourceProxyCaSecretName,
 			Value: getPrincipalResourceProxyCaSecretName(cr),
+		}, {
+			Name:  EnvArgoCDPrincipalTlsMinVersion,
+			Value: arguments["--tlsminversion"],
+		}, {
+			Name:  EnvArgoCDPrincipalCipherSuites,
+			Value: arguments["--tlsciphers"],
 		}, {
 			Name:  EnvArgoCDPrincipalJwtSecretName,
 			Value: getPrincipalJWTSecretName(cr),
@@ -435,8 +445,42 @@ const (
 	EnvArgoCDPrincipalJwtSecretName             = "ARGOCD_PRINCIPAL_JWT_SECRET_NAME"
 	EnvArgoCDPrincipalImage                     = "ARGOCD_PRINCIPAL_IMAGE"
 	EnvArgoCDPrincipalDestinationBasedMapping   = "ARGOCD_PRINCIPAL_DESTINATION_BASED_MAPPING"
+	EnvArgoCDPrincipalTlsMinVersion             = "ARGOCD_PRINCIPAL_TLS_MIN_VERSION"
+	EnvArgoCDPrincipalCipherSuites              = "ARGOCD_PRINCIPAL_TLS_CIPHERSUITES"
 )
 
+func getPrincipalTlsConfig(centralTLSProfile tlsProfile.TLSConfigProfile) map[string]string {
+	if centralTLSProfile.DisableClusterTLSProfile {
+		return nil
+	}
+	arguments := make(map[string]string)
+	if v := argoutil.AgentTLSProtocolVersionString(centralTLSProfile.MinVersion); v != "" {
+		arguments["--tlsminversion"] = v
+	}
+	if ciphers := argoutil.MapCipherSuites(centralTLSProfile.Ciphers); len(ciphers) > 0 {
+		// Go does not allow configuring TLS 1.3 cipher suites.
+		// Only filter them when TLS versions below 1.3 are used.
+		if centralTLSProfile.MinVersion != "VersionTLS13" {
+			tls13Ciphers := map[string]bool{
+				"TLS_AES_128_GCM_SHA256":       true,
+				"TLS_AES_256_GCM_SHA384":       true,
+				"TLS_CHACHA20_POLY1305_SHA256": true,
+			}
+			filtered := make([]string, 0, len(ciphers))
+			for _, cipher := range ciphers {
+				if !tls13Ciphers[cipher] {
+					filtered = append(filtered, cipher)
+				}
+			}
+			ciphers = filtered
+		}
+		if len(ciphers) > 0 {
+			arguments["--tlsciphers"] = strings.Join(ciphers, ",")
+		}
+	}
+	return arguments
+}
+
 // Logging Configuration
 func getPrincipalLogLevel(cr *argoproj.ArgoCD) string {
 	if hasPrincipal(cr) && cr.Spec.ArgoCDAgent.Principal.LogLevel != "" {