From 8618c3f36a764dca18178c24617165446c6fe81e Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Wed, 21 Oct 2026 12:44:26 +0530 Subject: [PATCH 1/4] feat(tls): configure TLS Curve Preferences for argocd Repo-server and Server component Signed-off-by: akhil nittala --- argocd-operator/common/defaults.go | 2 +- .../controllers/argocd/deployment.go | 19 ++++++-- .../controllers/argocd/deployment_test.go | 47 ++++++++++++++++++- .../controllers/argocd/image_updater.go | 8 +++- .../controllers/argocd/repo_server.go | 5 +- 5 files changed, 72 insertions(+), 9 deletions(-) diff --git a/argocd-operator/common/defaults.go b/argocd-operator/common/defaults.go index 2143eaca5bb..beb5419e2d6 100644 --- a/argocd-operator/common/defaults.go +++ b/argocd-operator/common/defaults.go @@ -82,7 +82,7 @@ const ( ArgoCDDefaultArgoImage = "quay.io/argoproj/argocd" // ArgoCDDefaultArgoVersion is the Argo CD container image digest to use when version not specified. - ArgoCDDefaultArgoVersion = "sha256:8e5cc5bb008df8a09dba439462e58c94c55b7735888d3ebde0c25fc05e4e5335" // v3.5.6 + ArgoCDDefaultArgoVersion = "sha256:479514bfba432c5b9566d5ecc6e245d72afa2d9dd30e83f863dbdaf846292eb6" // v3.6.0-rc3 // ArgoCDDefaultBackupKeyLength is the length of the generated default backup key. ArgoCDDefaultBackupKeyLength = 32 diff --git a/argocd-operator/controllers/argocd/deployment.go b/argocd-operator/controllers/argocd/deployment.go index 5d9a63c87af..4d0ba584592 100644 --- a/argocd-operator/controllers/argocd/deployment.go +++ b/argocd-operator/controllers/argocd/deployment.go @@ -984,7 +984,10 @@ func (r *ReconcileArgoCD) reconcileServerDeployment(cr *argoproj.ArgoCD, useTLSF if cr.Spec.Server.VolumeMounts != nil { serverVolumeMounts = append(serverVolumeMounts, cr.Spec.Server.VolumeMounts...) } - arguments := BuildTLSArgsFromClusterTLSProfile(r.CentralTLSConfigProfile) + arguments, err := BuildTLSArgsFromClusterTLSProfile(r.CentralTLSConfigProfile, "argocd-server") + if err != nil { + return err + } deploy.Spec.Template.Spec.Containers = []corev1.Container{{ Args: arguments, Command: getArgoServerCommand(cr, useTLSForRedis), @@ -1330,10 +1333,11 @@ func (r *ReconcileArgoCD) reconcileServerDeployment(cr *argoproj.ArgoCD, useTLSF } // BuildTLSArgsFromClusterTLSProfile builds the command line arguments for the ArgoCD components based on the cluster's TLS profile configuration. -func BuildTLSArgsFromClusterTLSProfile(centralTLSConfig tlsProfile.TLSConfigProfile) []string { +// component identifies the caller in curve-preference error/log messages (e.g. "argocd-server", "argocd-repo-server"). +func BuildTLSArgsFromClusterTLSProfile(centralTLSConfig tlsProfile.TLSConfigProfile, component string) ([]string, error) { var args []string if centralTLSConfig.DisableClusterTLSProfile { - return nil + return nil, nil } if v := argoutil.TLSProtocolVersionString(centralTLSConfig.MinVersion); v != "" { args = append(args, "--tlsminversion", v) @@ -1359,7 +1363,14 @@ func BuildTLSArgsFromClusterTLSProfile(centralTLSConfig tlsProfile.TLSConfigProf args = append(args, "--tlsciphers", strings.Join(ciphers, ":")) } } - return args + curves, err := argoutil.MapOpenShiftTLSGroupsToGoCurves(centralTLSConfig.CurvePreferences, component) + if err != nil { + return nil, err + } + if curves != "" { + args = append(args, "--tlscurvepreferences", curves) + } + return args, nil } // triggerDeploymentRollout will update the label with the given key to trigger a new rollout of the Deployment. diff --git a/argocd-operator/controllers/argocd/deployment_test.go b/argocd-operator/controllers/argocd/deployment_test.go index 74589cc9b5c..ecc4a9e749f 100644 --- a/argocd-operator/controllers/argocd/deployment_test.go +++ b/argocd-operator/controllers/argocd/deployment_test.go @@ -3497,11 +3497,46 @@ func TestBuildTLSArgs(t *testing.T) { }, wantErr: false, }, + { + name: "central TLS config with curve preferences", + centralTLS: tlsProfile.TLSConfigProfile{ + MinVersion: configv1.VersionTLS12, + CurvePreferences: []configv1.TLSGroup{ + configv1.TLSGroupX25519MLKEM768, + configv1.TLSGroupX25519, + configv1.TLSGroupSecP256r1, + }, + }, + expected: []string{ + "--tlsminversion", + "1.2", + "--tlscurvepreferences", + "X25519MLKEM768:X25519:CurveP256", + }, + wantErr: false, + }, + { + name: "errors when all curve preferences are unsupported", + centralTLS: tlsProfile.TLSConfigProfile{ + MinVersion: configv1.VersionTLS12, + CurvePreferences: []configv1.TLSGroup{ + configv1.TLSGroupSecP256r1MLKEM768, + }, + }, + expected: nil, + wantErr: true, + }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - got := BuildTLSArgsFromClusterTLSProfile(tt.centralTLS) + got, err := BuildTLSArgsFromClusterTLSProfile(tt.centralTLS, "test") + if tt.wantErr { + assert.Error(t, err) + assert.Nil(t, got) + return + } + assert.NoError(t, err) if !reflect.DeepEqual(got, tt.expected) { t.Fatalf("expected %#v got %#v", tt.expected, got) } @@ -3525,11 +3560,19 @@ func TestArgoCDServerAndRepoServerDeploymentArgs(t *testing.T) { "ECDHE-RSA-AES128-GCM-SHA256", "ECDHE-RSA-AES256-GCM-SHA384", }, + CurvePreferences: []configv1.TLSGroup{ + configv1.TLSGroupX25519, + configv1.TLSGroupSecP256r1, + }, } deployment := &appsv1.Deployment{} assert.NoError(t, r.reconcileServerDeployment(a, false)) assert.NoError(t, r.Get(context.TODO(), types.NamespacedName{Name: "argocd-server", Namespace: a.Namespace}, deployment)) - args := []string{"--tlsminversion", "1.2", "--tlsciphers", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"} + args := []string{ + "--tlsminversion", "1.2", + "--tlsciphers", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "--tlscurvepreferences", "X25519:CurveP256", + } assert.Equal(t, args, deployment.Spec.Template.Spec.Containers[0].Args) assert.NoError(t, r.reconcileRepoDeployment(a, false)) assert.NoError(t, r.Get(context.TODO(), types.NamespacedName{Name: "argocd-repo-server", Namespace: a.Namespace}, deployment)) diff --git a/argocd-operator/controllers/argocd/image_updater.go b/argocd-operator/controllers/argocd/image_updater.go index da28d334a74..61dc3c6646f 100644 --- a/argocd-operator/controllers/argocd/image_updater.go +++ b/argocd-operator/controllers/argocd/image_updater.go @@ -715,7 +715,13 @@ func (r *ReconcileArgoCD) reconcileImageUpdaterDeployment(cr *argoproj.ArgoCD, s } args := []string{"run"} - imageUpdaterTLSProfileArguments := BuildTLSArgsFromClusterTLSProfile(r.CentralTLSConfigProfile) + // Curve preferences for image-updater are deferred to a follow-up change. + tlsProfileForImageUpdater := r.CentralTLSConfigProfile + tlsProfileForImageUpdater.CurvePreferences = nil + imageUpdaterTLSProfileArguments, err := BuildTLSArgsFromClusterTLSProfile(tlsProfileForImageUpdater, "argocd-image-updater") + if err != nil { + return err + } args = append(args, imageUpdaterTLSProfileArguments...) podSpec.Containers = []corev1.Container{{ diff --git a/argocd-operator/controllers/argocd/repo_server.go b/argocd-operator/controllers/argocd/repo_server.go index 7d44b698cd0..c626141856e 100644 --- a/argocd-operator/controllers/argocd/repo_server.go +++ b/argocd-operator/controllers/argocd/repo_server.go @@ -211,7 +211,10 @@ func (r *ReconcileArgoCD) reconcileRepoDeployment(cr *argocdoperatorv1beta1.Argo repoServerVolumeMounts = append(repoServerVolumeMounts, cr.Spec.Repo.VolumeMounts...) } - arguments := BuildTLSArgsFromClusterTLSProfile(r.CentralTLSConfigProfile) + arguments, err := BuildTLSArgsFromClusterTLSProfile(r.CentralTLSConfigProfile, "argocd-repo-server") + if err != nil { + return err + } deploy.Spec.Template.Spec.Containers = []corev1.Container{{ Args: arguments, Command: getArgoRepoCommand(cr, useTLSForRedis), From 7cf63775ef1408dabbeda92c41e055e36264a9f2 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Wed, 21 Oct 2026 12:49:07 +0530 Subject: [PATCH 2/4] feat(tls): configure TLS Curve Preferences for argocd Repo-server and Server component Signed-off-by: akhil nittala --- argocd-operator/controllers/argocd/image_updater.go | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/argocd-operator/controllers/argocd/image_updater.go b/argocd-operator/controllers/argocd/image_updater.go index 61dc3c6646f..0abcbfa5955 100644 --- a/argocd-operator/controllers/argocd/image_updater.go +++ b/argocd-operator/controllers/argocd/image_updater.go @@ -715,13 +715,7 @@ func (r *ReconcileArgoCD) reconcileImageUpdaterDeployment(cr *argoproj.ArgoCD, s } args := []string{"run"} - // Curve preferences for image-updater are deferred to a follow-up change. - tlsProfileForImageUpdater := r.CentralTLSConfigProfile - tlsProfileForImageUpdater.CurvePreferences = nil - imageUpdaterTLSProfileArguments, err := BuildTLSArgsFromClusterTLSProfile(tlsProfileForImageUpdater, "argocd-image-updater") - if err != nil { - return err - } + imageUpdaterTLSProfileArguments, _ := BuildTLSArgsFromClusterTLSProfile(r.CentralTLSConfigProfile, "argocd-image-updater") args = append(args, imageUpdaterTLSProfileArguments...) podSpec.Containers = []corev1.Container{{ From 9012cc8050b018349f15bb97364c6dc6353ed762 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Wed, 21 Oct 2026 15:38:59 +0530 Subject: [PATCH 3/4] feat(tls): configure TLS Curve Preferences for argocd Repo-server and Server component Signed-off-by: akhil nittala --- .../controllers/argocd/image_updater.go | 9 +++++++- .../controllers/argocd/image_updater_test.go | 21 +++++++++++++++++++ 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/argocd-operator/controllers/argocd/image_updater.go b/argocd-operator/controllers/argocd/image_updater.go index 0abcbfa5955..c8d96d239e7 100644 --- a/argocd-operator/controllers/argocd/image_updater.go +++ b/argocd-operator/controllers/argocd/image_updater.go @@ -715,7 +715,14 @@ func (r *ReconcileArgoCD) reconcileImageUpdaterDeployment(cr *argoproj.ArgoCD, s } args := []string{"run"} - imageUpdaterTLSProfileArguments, _ := BuildTLSArgsFromClusterTLSProfile(r.CentralTLSConfigProfile, "argocd-image-updater") + // Image Updater v1.3.0 supports --tlsminversion/--tlsciphers but not --tlscurvepreferences. + // Omit curves until a supporting image is the default; keep min version and ciphers. + tlsProfileForImageUpdater := r.CentralTLSConfigProfile + tlsProfileForImageUpdater.CurvePreferences = nil + imageUpdaterTLSProfileArguments, err := BuildTLSArgsFromClusterTLSProfile(tlsProfileForImageUpdater, "argocd-image-updater") + if err != nil { + return err + } args = append(args, imageUpdaterTLSProfileArguments...) podSpec.Containers = []corev1.Container{{ diff --git a/argocd-operator/controllers/argocd/image_updater_test.go b/argocd-operator/controllers/argocd/image_updater_test.go index 52df994e69d..74093bee911 100644 --- a/argocd-operator/controllers/argocd/image_updater_test.go +++ b/argocd-operator/controllers/argocd/image_updater_test.go @@ -1433,6 +1433,26 @@ func TestReconcileImageUpdaterDeployment_TLSArgs(t *testing.T) { }, expectedArgs: []string{}, }, + { + name: "omits tlscurvepreferences while preserving min version and ciphers", + centralTLS: tlsProfile.TLSConfigProfile{ + DisableClusterTLSProfile: false, + MinVersion: configv1.VersionTLS12, + Ciphers: []string{ + "ECDHE-RSA-AES128-GCM-SHA256", + }, + CurvePreferences: []configv1.TLSGroup{ + configv1.TLSGroupX25519, + configv1.TLSGroupSecP256r1, + }, + }, + expectedArgs: []string{ + "--tlsminversion", + "1.2", + "--tlsciphers", + "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", + }, + }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { @@ -1459,6 +1479,7 @@ func TestReconcileImageUpdaterDeployment_TLSArgs(t *testing.T) { for _, expected := range tt.expectedArgs { assert.Contains(t, args, expected) } + assert.NotContains(t, args, "--tlscurvepreferences") }) } } From 460499a6ec55add30ddb40c23437b5b3d38f45c4 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Thu, 22 Oct 2026 16:11:46 +0530 Subject: [PATCH 4/4] changes Signed-off-by: akhil nittala --- .../e2e/ginkgo/parallel/1-031_validate_toolchain_test.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/test/openshift/e2e/ginkgo/parallel/1-031_validate_toolchain_test.go b/test/openshift/e2e/ginkgo/parallel/1-031_validate_toolchain_test.go index c105cfb8572..6898475473b 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-031_validate_toolchain_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-031_validate_toolchain_test.go @@ -85,9 +85,9 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { It("verifies that toolchain versions have the expected values", Label("openshift"), func() { // These variables need to be maintained according to the component matrix: https://spaces.redhat.com/display/GITOPS/GitOps+Component+Matrix - expected_kustomizeVersion := "v5.8.1" - expected_helmVersion := "v4.2.1" - expected_argocdVersion := "v3.5.6" + expected_kustomizeVersion := "v5.8.3" + expected_helmVersion := "v4.3.1" + expected_argocdVersion := "v3.6.0-rc3" var expected_dexVersion string var expected_redisVersion string