Merge branch 'argoproj-labs:master' into master

Author: akhilnittala

OWNERS

@@ -1,21 +1,23 @@
-owners:
-- jomkz
+# https://www.kubernetes.dev/docs/guide/owners/
 
 approvers:
-- iam-veeramalla
-- wtam2018
+- anandf
+- anandrkskd
+- chetan-rns
 - jannfis
-- jopit
+- jgwest
+- olivergondza
+- svghadi
+- wtam2018
 
 reviewers:
+- jparsai
+- Rizwana777
+
+emeritus_approvers:
+- ciiay
 - iam-veeramalla
-- wtam2018
-- jannfis
-- jopit
-- jaideepr97
-- ishitasequeira 
+- ishitasequeira
+- jomkz
 - reginapizza
-- ciiay
-- svghadi
 - saumeya
-

controllers/argocd/argocd_controller.go

@@ -37,6 +37,7 @@ import (
 
 	errs "errors"
 
+	configv1 "github.com/openshift/api/config/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -102,10 +103,20 @@ type ReconcileArgoCD struct {
 	// re-run to renew the Dex OAuth client token before it expires.
 	// Key: ArgoCD namespace, Value: time.Duration
 	dexTokenRequeueAfter sync.Map
+	// CentralTLSConfigProfile specifies the TLS configuration profile in the cluster.
+	CentralTLSConfigProfile TLSConfigProfile
 }
 
 var log = logr.Log.WithName("controller_argocd")
 
+type TLSConfigProfile struct {
+	DisableClusterTLSProfile bool
+	// MinVersion specifies the minimum TLS version configured in cluster.
+	MinVersion configv1.TLSProtocolVersion
+	// Ciphers specifies the list of supported TLS cipher suites in cluster.
+	Ciphers []string
+}
+
 // Map to keep track of running Argo CD instances using their namespaces as key and phase as value
 // This map will be used for the performance metrics purposes
 // Important note: This assumes that each instance only contains one Argo CD instance

controllers/argocd/deployment.go

@@ -220,22 +220,54 @@ func getArgoImportVolumes(cr *argoprojv1alpha1.ArgoCDExport) []corev1.Volume {
 	return volumes
 }
 
-func getArgoRedisArgs(useTLS bool) []string {
+func getArgoRedisArgs(useTLS bool, centralTLSConfig TLSConfigProfile) []string {
 	args := make([]string, 0)
 
 	args = append(args, "--save", "")
 	args = append(args, "--appendonly", "no")
 	args = append(args, "--aclfile", argoutil.RedisAuthMountPath+"users.acl")
 
 	if useTLS {
+		if !centralTLSConfig.DisableClusterTLSProfile {
+			arguments := BuildRedisArgsFromClusterTLSProfile(centralTLSConfig)
+			args = append(args, arguments...)
+		}
 		args = append(args, "--tls-port", "6379")
 		args = append(args, "--port", "0")
 
 		args = append(args, "--tls-cert-file", "/app/config/redis/tls/tls.crt")
 		args = append(args, "--tls-key-file", "/app/config/redis/tls/tls.key")
 		args = append(args, "--tls-auth-clients", "no")
 	}
+	return args
+}
 
+// BuildRedisArgsFromClusterTLSProfile builds arguments for redis deployment based on central tls config.
+func BuildRedisArgsFromClusterTLSProfile(centralTLSConfig TLSConfigProfile) []string {
+	var (
+		args     []string
+		protocol string
+		ciphers  []string
+	)
+	if v := argoutil.RedisTLSProtocolVersionString(centralTLSConfig.MinVersion); v != "" {
+		protocol = v
+		args = append(args, "--tls-protocols", protocol)
+	}
+	ciphers = argoutil.MapCipherSuites(centralTLSConfig.Ciphers)
+	// Build cipher args
+	if len(ciphers) > 0 {
+		cipherString := strings.Join(ciphers, ":")
+		if protocol == "TLSv1.3" {
+			// TLS 1.3 only
+			args = append(args, "--tls-ciphersuites", cipherString)
+		} else {
+			// TLS 1.2 or mixed TLS 1.2/1.3
+			args = append(args,
+				"--tls-ciphers", cipherString,
+				"--tls-ciphersuites", cipherString,
+			)
+		}
+	}
 	return args
 }
 
@@ -440,9 +472,9 @@ func (r *ReconcileArgoCD) reconcileRedisDeployment(cr *argoproj.ArgoCD, useTLS b
 			RunAsUser: int64Ptr(1000),
 		}
 	}
-
+	arguments := getArgoRedisArgs(useTLS, r.CentralTLSConfigProfile)
 	deploy.Spec.Template.Spec.Containers = []corev1.Container{{
-		Args:            getArgoRedisArgs(useTLS),
+		Args:            arguments,
 		Image:           argoutil.GetRedisContainerImage(cr),
 		ImagePullPolicy: argoutil.GetImagePullPolicy(cr.Spec.ImagePullPolicy),
 		Name:            "redis",

controllers/argocd/deployment_test.go

@@ -26,6 +26,8 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/assert"
 
+	configv1 "github.com/openshift/api/config/v1"
+
 	argoproj "github.com/argoproj-labs/argocd-operator/api/v1beta1"
 )
 
@@ -3134,3 +3136,104 @@ func TestReconcileArgoCD_reconcileRedisDeployment_customLabelsAndAnnotations(t *
 	assert.False(t, hasCustomAnnotation)
 	assert.False(t, hasCustomLabel)
 }
+
+func TestBuildRedisArgs(t *testing.T) {
+	tests := []struct {
+		name       string
+		centralTLS TLSConfigProfile
+		expected   []string
+		wantErr    bool
+	}{
+		{
+			name: "central TLS config with invalid min version",
+			centralTLS: TLSConfigProfile{
+				MinVersion: configv1.TLSProtocolVersion("INVALID"),
+			},
+			expected: nil,
+			wantErr:  false,
+		},
+		{
+			name: "central TLS config with tls 1.2",
+			centralTLS: TLSConfigProfile{
+				MinVersion: configv1.VersionTLS12,
+				Ciphers: []string{
+					"ECDHE-RSA-AES128-GCM-SHA256",
+				},
+			},
+			expected: []string{
+				"--tls-protocols",
+				"TLSv1.2",
+				"--tls-ciphers",
+				"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+				"--tls-ciphersuites",
+				"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+			},
+			wantErr: false,
+		},
+		{
+			name: "central TLS config with tls 1.3",
+			centralTLS: TLSConfigProfile{
+				MinVersion: configv1.VersionTLS13,
+				Ciphers: []string{
+					"TLS_AES_128_GCM_SHA256",
+				},
+			},
+			expected: []string{
+				"--tls-protocols",
+				"TLSv1.3",
+				"--tls-ciphersuites",
+				"TLS_AES_128_GCM_SHA256",
+			},
+			wantErr: false,
+		},
+		{
+			name: "central TLS config only version",
+			centralTLS: TLSConfigProfile{
+				MinVersion: configv1.VersionTLS12,
+			},
+			expected: []string{
+				"--tls-protocols",
+				"TLSv1.2",
+			},
+			wantErr: false,
+		},
+		{
+			name: "central TLS config only ciphers",
+			centralTLS: TLSConfigProfile{
+				Ciphers: []string{
+					"ECDHE-RSA-AES256-GCM-SHA384",
+				},
+			},
+			expected: []string{
+				"--tls-ciphers",
+				"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+				"--tls-ciphersuites",
+				"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+			},
+			wantErr: false,
+		},
+		{
+			name: "central TLS config with unmapped cipher",
+			centralTLS: TLSConfigProfile{
+				MinVersion: configv1.VersionTLS12,
+				Ciphers: []string{
+					"INVALID",
+				},
+			},
+			expected: []string{
+				"--tls-protocols",
+				"TLSv1.2",
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := BuildRedisArgsFromClusterTLSProfile(tt.centralTLS)
+			if !reflect.DeepEqual(got, tt.expected) {
+				t.Fatalf("expected %#v got %#v", tt.expected, got)
+			}
+		})
+	}
+}

controllers/argocdagent/deployment.go

@@ -289,6 +289,21 @@ func updateDeploymentIfChanged(compName, saName string, cr *argoproj.ArgoCD, dep
 		deployment.Spec.Template.Spec.Containers[0].Args = buildArgs(compName)
 	}
 
+	redisAuthVolume, redisAuthMount := argoutil.MountRedisAuthToArgo(cr)
+	desiredVolumeMounts := append(buildVolumeMounts(), redisAuthMount)
+	desiredVolumes := append(buildVolumes(), redisAuthVolume)
+	if !reflect.DeepEqual(deployment.Spec.Template.Spec.Containers[0].VolumeMounts, desiredVolumeMounts) {
+		log.Info("deployment container volume mounts are being updated")
+		changed = true
+		deployment.Spec.Template.Spec.Containers[0].VolumeMounts = desiredVolumeMounts
+	}
+
+	if !reflect.DeepEqual(deployment.Spec.Template.Spec.Volumes, desiredVolumes) {
+		log.Info("deployment container volumes are being updated")
+		changed = true
+		deployment.Spec.Template.Spec.Volumes = desiredVolumes
+	}
+
 	if !reflect.DeepEqual(deployment.Spec.Template.Spec.Containers[0].SecurityContext, buildSecurityContext()) {
 		log.Info("deployment container security context is being updated")
 		changed = true

controllers/argoutil/tls.go

@@ -28,6 +28,8 @@ import (
 
 	certmanagerv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
 
+	configv1 "github.com/openshift/api/config/v1"
+
 	"github.com/argoproj-labs/argocd-operator/common"
 )
 
@@ -122,3 +124,56 @@ func NewSignedCertificate(cfg *certmanagerv1.CertificateSpec, dnsNames []string,
 	}
 	return x509.ParseCertificate(certDERBytes)
 }
+
+// -------------------- Redis TLS Args --------------------
+
+func TLSProtocolVersionString(v configv1.TLSProtocolVersion) string {
+	switch v {
+	case configv1.VersionTLS10:
+		return "1.0"
+	case configv1.VersionTLS11:
+		return "1.1"
+	case configv1.VersionTLS12:
+		return "1.2"
+	case configv1.VersionTLS13:
+		return "1.3"
+	default:
+		return ""
+	}
+}
+
+func RedisTLSProtocolVersionString(v configv1.TLSProtocolVersion) string {
+	version := TLSProtocolVersionString(v)
+	if version == "" {
+		return ""
+	}
+	if version == "1.0" {
+		return "TLSv1"
+	}
+	return "TLSv" + version
+}
+
+func MapCipherSuites(names []string) []string {
+	m := map[string]string{
+		"TLS_AES_128_GCM_SHA256":        "TLS_AES_128_GCM_SHA256",                        // 0x13,0x01
+		"TLS_AES_256_GCM_SHA384":        "TLS_AES_256_GCM_SHA384",                        // 0x13,0x02
+		"TLS_CHACHA20_POLY1305_SHA256":  "TLS_CHACHA20_POLY1305_SHA256",                  // 0x13,0x03
+		"ECDHE-ECDSA-AES128-GCM-SHA256": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",       // 0xC0,0x2B
+		"ECDHE-RSA-AES128-GCM-SHA256":   "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",         // 0xC0,0x2F
+		"ECDHE-ECDSA-AES256-GCM-SHA384": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",       // 0xC0,0x2C
+		"ECDHE-RSA-AES256-GCM-SHA384":   "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",         // 0xC0,0x30
+		"ECDHE-ECDSA-CHACHA20-POLY1305": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", // 0xCC,0xA9
+		"ECDHE-RSA-CHACHA20-POLY1305":   "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",   // 0xCC,0xA8
+		// Go's crypto/tls does not support CBC mode and DHE ciphers, so we don't want to include them here.
+		// See:
+		//   - https://github.com/golang/go/issues/26652
+		//   - https://github.com/golang/go/issues/7758
+	}
+	out := make([]string, 0, len(names))
+	for _, name := range names {
+		if mapped, ok := m[name]; ok {
+			out = append(out, mapped)
+		}
+	}
+	return out
+}