Skip to content

feat: Configurable TLS server settings for argocd and argocd-agent components #2139

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
akhilnittala wants to merge 17 commits into from
Closed

feat: Configurable TLS server settings for argocd and argocd-agent components #2139

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
2828fed
[GITOPS-9258]: Configurable TLS server settings for argocd and argocd…
akhilnittala May 18, 2026
91ed329
[GITOPS-9258]: Configurable TLS server settings for argocd and argocd…
akhilnittala May 21, 2026
cb9e898
[GITOPS-9258]: Configurable TLS server settings for argocd and argocd…
akhilnittala May 21, 2026
ca8f274
[GITOPS-9258]: Configurable TLS server settings for argocd and argocd…
akhilnittala May 21, 2026
b25bca6
[GITOPS-9258]: Configurable TLS server settings for argocd and argocd…
akhilnittala May 21, 2026
6762c13
[GITOPS-9258]: Configurable TLS server settings for argocd and argocd…
akhilnittala May 21, 2026
65a9421
[GITOPS-9258]: Configurable TLS server settings for argocd and argocd…
akhilnittala May 21, 2026
e013c7d
[GITOPS-9258]: Configurable TLS server settings for argocd and argocd…
akhilnittala May 21, 2026
1a2923e
[GITOPS-9258]: Configurable TLS server settings for argocd and argocd…
akhilnittala May 21, 2026
c6a2b80
[GITOPS-9258]: Configurable TLS server settings for argocd and argocd…
akhilnittala May 29, 2026
57c3e85
[GITOPS-9258]: Configurable TLS server settings for argocd and argocd…
akhilnittala May 29, 2026
8286ed3
[GITOPS-9258]: Configurable TLS server settings for argocd and argocd…
akhilnittala May 29, 2026
ef1e3d1
[GITOPS-9258]: Configurable TLS server settings for argocd and argocd…
akhilnittala May 29, 2026
e628e2d
[GITOPS-9258]: Configurable TLS server settings for argocd and argocd…
akhilnittala May 29, 2026
67e73c6
[GITOPS-9258]: Configurable TLS server settings for argocd and argocd…
akhilnittala May 29, 2026
fd6abeb
[GITOPS-9258]: Configurable TLS server settings for argocd and argocd…
akhilnittala May 29, 2026
fc58492
Merge branch 'master' into usr/akhil/GITOPS-9260
akhilnittala Jun 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions api/v1beta1/argocd_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -345,6 +345,8 @@ type ArgoCDImageUpdaterSpec struct {

// Resources defines the Compute Resources required by the container for Argo CD Image Updater.
Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
// TLS configuration for the Image Updater
TLSConfig *ArgoCDTLSConfig `json:"tlsConfig,omitempty"`
}

// ArgoCDImportSpec defines the desired state for the ArgoCD import/restore process.
Expand Down Expand Up @@ -542,6 +544,9 @@ type ArgoCDRedisSpec struct {

// Remote specifies the remote URL of the Redis container. (optional, by default, a local instance managed by the operator is used.)
Remote *string `json:"remote,omitempty"`

// TLSConfig defines the TLS configuration for the Redis server
TLSConfig *ArgoCDTLSConfig `json:"tlsConfig,omitempty"`
}

func (a *ArgoCDRedisSpec) IsEnabled() bool {
Expand Down Expand Up @@ -630,6 +635,20 @@ type ArgoCDRepoSpec struct {

// Metrics defines the metrics configuration for the Repo Server ServiceMonitor.
Metrics *ArgoCDMetricsSpec `json:"metrics,omitempty"`
// TLS configuration for the repo server
TLSConfig *ArgoCDTLSConfig `json:"tlsConfig,omitempty"`
}

// ArgoCDTLSConfig defines TLS configuration for Argo CD components.
// +kubebuilder:validation:XValidation:rule="!has(self.minVersion) || !has(self.maxVersion) || self.minVersion <= self.maxVersion",message="minVersion must be less than or equal to maxVersion"
type ArgoCDTLSConfig struct {
// +kubebuilder:validation:Optional
// +kubebuilder:validation:Enum="1.0";"1.1";"1.2";"1.3"
MinVersion string `json:"minVersion,omitempty"`
// +kubebuilder:validation:Optional
// +kubebuilder:validation:Enum="1.0";"1.1";"1.2";"1.3"
MaxVersion string `json:"maxVersion,omitempty"`
CipherSuites []string `json:"cipherSuites,omitempty"`
Comment thread
akhilnittala marked this conversation as resolved.
}

func (a *ArgoCDRepoSpec) IsEnabled() bool {
Expand Down Expand Up @@ -767,6 +786,8 @@ type ArgoCDServerSpec struct {

// Metrics defines the metrics configuration for the Server ServiceMonitor.
Metrics *ArgoCDMetricsSpec `json:"metrics,omitempty"`
// TLS configuration for the Argo CD Server component
TLSConfig *ArgoCDTLSConfig `json:"tlsConfig,omitempty"`
}

func (a *ArgoCDServerSpec) IsEnabled() bool {
Expand Down Expand Up @@ -1486,6 +1507,8 @@ type PrincipalTLSSpec struct {

// InsecureGenerate is the flag to allow the principal to generate its own set of TLS cert and key on startup when none are configured
InsecureGenerate *bool `json:"insecureGenerate,omitempty"`
// TLS configuration for the Principal component.
TLSConfig *ArgoCDTLSConfig `json:"tlsConfig,omitempty"`
}

// ArgoCDAgentPrincipalServiceSpec defines the options for the Service backing the ArgoCD Agent Principalcomponent.
Expand Down
45 changes: 45 additions & 0 deletions api/v1beta1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion bundle/manifests/argocd-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -257,7 +257,7 @@ metadata:
capabilities: Deep Insights
categories: Integration & Delivery
certified: "false"
createdAt: "2026-05-29T09:49:36Z"
createdAt: "2026-05-29T13:29:42Z"
description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.
operators.operatorframework.io/builder: operator-sdk-v1.35.0
operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
Expand Down
131 changes: 131 additions & 0 deletions bundle/manifests/argoproj.io_argocds.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12313,6 +12313,32 @@ spec:
description: SecretName is The name of the secret containing
the TLS certificate and key.
type: string
tlsConfig:
description: TLS configuration for the Principal component.
properties:
cipherSuites:
items:
type: string
type: array
maxVersion:
enum:
- "1.0"
Comment thread
akhilnittala marked this conversation as resolved.
- "1.1"
- "1.2"
- "1.3"
type: string
minVersion:
enum:
- "1.0"
- "1.1"
- "1.2"
- "1.3"
type: string
type: object
Comment thread
akhilnittala marked this conversation as resolved.
x-kubernetes-validations:
- message: minVersion must be less than or equal to maxVersion
rule: '!has(self.minVersion) || !has(self.maxVersion)
|| self.minVersion <= self.maxVersion'
type: object
type: object
type: object
Expand Down Expand Up @@ -18319,6 +18345,32 @@ spec:
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
type: object
type: object
tlsConfig:
description: TLS configuration for the Image Updater
properties:
cipherSuites:
items:
type: string
type: array
maxVersion:
enum:
- "1.0"
- "1.1"
- "1.2"
- "1.3"
type: string
minVersion:
enum:
- "1.0"
- "1.1"
- "1.2"
- "1.3"
type: string
type: object
x-kubernetes-validations:
- message: minVersion must be less than or equal to maxVersion
rule: '!has(self.minVersion) || !has(self.maxVersion) || self.minVersion
<= self.maxVersion'
required:
- enabled
type: object
Expand Down Expand Up @@ -19097,6 +19149,33 @@ spec:
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
type: object
type: object
tlsConfig:
description: TLSConfig defines the TLS configuration for the Redis
server
properties:
cipherSuites:
items:
type: string
type: array
maxVersion:
enum:
- "1.0"
- "1.1"
- "1.2"
- "1.3"
type: string
minVersion:
enum:
- "1.0"
- "1.1"
- "1.2"
- "1.3"
type: string
type: object
x-kubernetes-validations:
- message: minVersion must be less than or equal to maxVersion
rule: '!has(self.minVersion) || !has(self.maxVersion) || self.minVersion
<= self.maxVersion'
version:
description: Version is the Redis container image tag.
type: string
Expand Down Expand Up @@ -22696,6 +22775,32 @@ spec:
x-kubernetes-map-type: atomic
type: array
type: object
tlsConfig:
description: TLS configuration for the repo server
properties:
cipherSuites:
items:
type: string
type: array
maxVersion:
enum:
- "1.0"
- "1.1"
- "1.2"
- "1.3"
type: string
minVersion:
enum:
- "1.0"
- "1.1"
- "1.2"
- "1.3"
type: string
type: object
x-kubernetes-validations:
- message: minVersion must be less than or equal to maxVersion
rule: '!has(self.minVersion) || !has(self.maxVersion) || self.minVersion
<= self.maxVersion'
verifytls:
description: VerifyTLS defines whether repo server API should
be accessed using strict TLS validation
Expand Down Expand Up @@ -28391,6 +28496,32 @@ spec:
- name
type: object
type: array
tlsConfig:
description: TLS configuration for the Argo CD Server component
properties:
cipherSuites:
items:
type: string
type: array
maxVersion:
enum:
- "1.0"
- "1.1"
- "1.2"
- "1.3"
type: string
minVersion:
enum:
- "1.0"
- "1.1"
- "1.2"
- "1.3"
type: string
type: object
x-kubernetes-validations:
- message: minVersion must be less than or equal to maxVersion
rule: '!has(self.minVersion) || !has(self.maxVersion) || self.minVersion
<= self.maxVersion'
volumeMounts:
description: VolumeMounts adds volumeMounts to the Argo CD Server
container.
Expand Down
Loading