feat(tls): configure TLS Curve Preferences for argocd Repo-server and Server component

argocd-operator/common/defaults.go

@@ -82,7 +82,7 @@ const (
 	ArgoCDDefaultArgoImage = "quay.io/argoproj/argocd"
 
 	// ArgoCDDefaultArgoVersion is the Argo CD container image digest to use when version not specified.
-	ArgoCDDefaultArgoVersion = "sha256:8e5cc5bb008df8a09dba439462e58c94c55b7735888d3ebde0c25fc05e4e5335" // v3.5.6
+	ArgoCDDefaultArgoVersion = "sha256:479514bfba432c5b9566d5ecc6e245d72afa2d9dd30e83f863dbdaf846292eb6" // v3.6.0-rc3
 
 	// ArgoCDDefaultBackupKeyLength is the length of the generated default backup key.
 	ArgoCDDefaultBackupKeyLength = 32

argocd-operator/controllers/argocd/deployment.go

@@ -984,7 +984,10 @@ func (r *ReconcileArgoCD) reconcileServerDeployment(cr *argoproj.ArgoCD, useTLSF
 	if cr.Spec.Server.VolumeMounts != nil {
 		serverVolumeMounts = append(serverVolumeMounts, cr.Spec.Server.VolumeMounts...)
 	}
-	arguments := BuildTLSArgsFromClusterTLSProfile(r.CentralTLSConfigProfile)
+	arguments, err := BuildTLSArgsFromClusterTLSProfile(r.CentralTLSConfigProfile, "argocd-server")
+	if err != nil {
+		return err
+	}
 	deploy.Spec.Template.Spec.Containers = []corev1.Container{{
 		Args:            arguments,
 		Command:         getArgoServerCommand(cr, useTLSForRedis),
@@ -1330,10 +1333,11 @@ func (r *ReconcileArgoCD) reconcileServerDeployment(cr *argoproj.ArgoCD, useTLSF
 }
 
 // BuildTLSArgsFromClusterTLSProfile builds the command line arguments for the ArgoCD components based on the cluster's TLS profile configuration.
-func BuildTLSArgsFromClusterTLSProfile(centralTLSConfig tlsProfile.TLSConfigProfile) []string {
+// component identifies the caller in curve-preference error/log messages (e.g. "argocd-server", "argocd-repo-server").
+func BuildTLSArgsFromClusterTLSProfile(centralTLSConfig tlsProfile.TLSConfigProfile, component string) ([]string, error) {
 	var args []string
 	if centralTLSConfig.DisableClusterTLSProfile {
-		return nil
+		return nil, nil
 	}
 	if v := argoutil.TLSProtocolVersionString(centralTLSConfig.MinVersion); v != "" {
 		args = append(args, "--tlsminversion", v)
@@ -1359,7 +1363,14 @@ func BuildTLSArgsFromClusterTLSProfile(centralTLSConfig tlsProfile.TLSConfigProf
 			args = append(args, "--tlsciphers", strings.Join(ciphers, ":"))
 		}
 	}
-	return args
+	curves, err := argoutil.MapOpenShiftTLSGroupsToGoCurves(centralTLSConfig.CurvePreferences, component)
+	if err != nil {
+		return nil, err
+	}
+	if curves != "" {
+		args = append(args, "--tlscurvepreferences", curves)
+	}
+	return args, nil
 }
 
 // triggerDeploymentRollout will update the label with the given key to trigger a new rollout of the Deployment.

argocd-operator/controllers/argocd/deployment_test.go

@@ -3497,11 +3497,46 @@ func TestBuildTLSArgs(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		{
+			name: "central TLS config with curve preferences",
+			centralTLS: tlsProfile.TLSConfigProfile{
+				MinVersion: configv1.VersionTLS12,
+				CurvePreferences: []configv1.TLSGroup{
+					configv1.TLSGroupX25519MLKEM768,
+					configv1.TLSGroupX25519,
+					configv1.TLSGroupSecP256r1,
+				},
+			},
+			expected: []string{
+				"--tlsminversion",
+				"1.2",
+				"--tlscurvepreferences",
+				"X25519MLKEM768:X25519:CurveP256",
+			},
+			wantErr: false,
+		},
+		{
+			name: "errors when all curve preferences are unsupported",
+			centralTLS: tlsProfile.TLSConfigProfile{
+				MinVersion: configv1.VersionTLS12,
+				CurvePreferences: []configv1.TLSGroup{
+					configv1.TLSGroupSecP256r1MLKEM768,
+				},
+			},
+			expected: nil,
+			wantErr:  true,
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := BuildTLSArgsFromClusterTLSProfile(tt.centralTLS)
+			got, err := BuildTLSArgsFromClusterTLSProfile(tt.centralTLS, "test")
+			if tt.wantErr {
+				assert.Error(t, err)
+				assert.Nil(t, got)
+				return
+			}
+			assert.NoError(t, err)
 			if !reflect.DeepEqual(got, tt.expected) {
 				t.Fatalf("expected %#v got %#v", tt.expected, got)
 			}
@@ -3525,11 +3560,19 @@ func TestArgoCDServerAndRepoServerDeploymentArgs(t *testing.T) {
 			"ECDHE-RSA-AES128-GCM-SHA256",
 			"ECDHE-RSA-AES256-GCM-SHA384",
 		},
+		CurvePreferences: []configv1.TLSGroup{
+			configv1.TLSGroupX25519,
+			configv1.TLSGroupSecP256r1,
+		},
 	}
 	deployment := &appsv1.Deployment{}
 	assert.NoError(t, r.reconcileServerDeployment(a, false))
 	assert.NoError(t, r.Get(context.TODO(), types.NamespacedName{Name: "argocd-server", Namespace: a.Namespace}, deployment))
-	args := []string{"--tlsminversion", "1.2", "--tlsciphers", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"}
+	args := []string{
+		"--tlsminversion", "1.2",
+		"--tlsciphers", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+		"--tlscurvepreferences", "X25519:CurveP256",
+	}
 	assert.Equal(t, args, deployment.Spec.Template.Spec.Containers[0].Args)
 	assert.NoError(t, r.reconcileRepoDeployment(a, false))
 	assert.NoError(t, r.Get(context.TODO(), types.NamespacedName{Name: "argocd-repo-server", Namespace: a.Namespace}, deployment))

argocd-operator/controllers/argocd/image_updater.go

@@ -715,7 +715,14 @@ func (r *ReconcileArgoCD) reconcileImageUpdaterDeployment(cr *argoproj.ArgoCD, s
 	}
 
 	args := []string{"run"}
-	imageUpdaterTLSProfileArguments := BuildTLSArgsFromClusterTLSProfile(r.CentralTLSConfigProfile)
+	// Image Updater v1.3.0 supports --tlsminversion/--tlsciphers but not --tlscurvepreferences.
+	// Omit curves until a supporting image is the default; keep min version and ciphers.
+	tlsProfileForImageUpdater := r.CentralTLSConfigProfile
+	tlsProfileForImageUpdater.CurvePreferences = nil
+	imageUpdaterTLSProfileArguments, err := BuildTLSArgsFromClusterTLSProfile(tlsProfileForImageUpdater, "argocd-image-updater")
+	if err != nil {
+		return err
+	}
 	args = append(args, imageUpdaterTLSProfileArguments...)
 
 	// Command is intentionally not set so that the image's own ENTRYPOINT applies.

argocd-operator/controllers/argocd/image_updater_test.go

@@ -1434,6 +1434,26 @@ func TestReconcileImageUpdaterDeployment_TLSArgs(t *testing.T) {
 			},
 			expectedArgs: []string{},
 		},
+		{
+			name: "omits tlscurvepreferences while preserving min version and ciphers",
+			centralTLS: tlsProfile.TLSConfigProfile{
+				DisableClusterTLSProfile: false,
+				MinVersion:               configv1.VersionTLS12,
+				Ciphers: []string{
+					"ECDHE-RSA-AES128-GCM-SHA256",
+				},
+				CurvePreferences: []configv1.TLSGroup{
+					configv1.TLSGroupX25519,
+					configv1.TLSGroupSecP256r1,
+				},
+			},
+			expectedArgs: []string{
+				"--tlsminversion",
+				"1.2",
+				"--tlsciphers",
+				"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -1460,6 +1480,7 @@ func TestReconcileImageUpdaterDeployment_TLSArgs(t *testing.T) {
 			for _, expected := range tt.expectedArgs {
 				assert.Contains(t, args, expected)
 			}
+			assert.NotContains(t, args, "--tlscurvepreferences")
 		})
 	}
 }

argocd-operator/controllers/argocd/repo_server.go

@@ -211,7 +211,10 @@ func (r *ReconcileArgoCD) reconcileRepoDeployment(cr *argocdoperatorv1beta1.Argo
 		repoServerVolumeMounts = append(repoServerVolumeMounts, cr.Spec.Repo.VolumeMounts...)
 	}
 
-	arguments := BuildTLSArgsFromClusterTLSProfile(r.CentralTLSConfigProfile)
+	arguments, err := BuildTLSArgsFromClusterTLSProfile(r.CentralTLSConfigProfile, "argocd-repo-server")
+	if err != nil {
+		return err
+	}
 	deploy.Spec.Template.Spec.Containers = []corev1.Container{{
 		Args:            arguments,
 		Command:         getArgoRepoCommand(cr, useTLSForRedis),

test/openshift/e2e/ginkgo/parallel/1-031_validate_toolchain_test.go

@@ -85,9 +85,9 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() {
 		It("verifies that toolchain versions have the expected values", Label("openshift"), func() {
 
 			// These variables need to be maintained according to the component matrix: https://spaces.redhat.com/display/GITOPS/GitOps+Component+Matrix
-			expected_kustomizeVersion := "v5.8.1"
-			expected_helmVersion := "v4.2.1"
-			expected_argocdVersion := "v3.5.6"
+			expected_kustomizeVersion := "v5.8.3"
+			expected_helmVersion := "v4.3.1"
+			expected_argocdVersion := "v3.6.0-rc3"
 
 			var expected_dexVersion string
 			var expected_redisVersion string