diff --git a/cmd/main.go b/cmd/main.go index c3dd5dd4471..5c2e52707da 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -312,6 +312,7 @@ func main() { Client: client, Scheme: mgr.GetScheme(), DisableDefaultInstall: strings.ToLower(os.Getenv(common.DisableDefaultInstallEnvVar)) == "true", + CentralTLSProfile: profile, }).SetupWithManager(mgr); err != nil { setupLog.Error(err, "unable to create controller", "controller", "GitopsService") os.Exit(1) diff --git a/controllers/gitopsservice_controller.go b/controllers/gitopsservice_controller.go index b643cad0529..6c434d93fb0 100644 --- a/controllers/gitopsservice_controller.go +++ b/controllers/gitopsservice_controller.go @@ -54,6 +54,8 @@ import ( logf "sigs.k8s.io/controller-runtime/pkg/log" "sigs.k8s.io/controller-runtime/pkg/predicate" "sigs.k8s.io/controller-runtime/pkg/reconcile" + + configv1 "github.com/openshift/api/config/v1" ) var logs = logf.Log.WithName("controller_gitopsservice") @@ -146,6 +148,8 @@ type ReconcileGitopsService struct { // disableDefaultInstall, if true, will ensure that the default ArgoCD instance is not instantiated in the openshift-gitops namespace. DisableDefaultInstall bool + //CentralTLSProfile contains MinVersion and CipherSuites + CentralTLSProfile configv1.TLSProfileSpec } // +kubebuilder:rbac:groups=config.openshift.io,resources=authentications,verbs=get;list;watch @@ -658,7 +662,7 @@ func (r *ReconcileGitopsService) reconcileBackend(gitopsserviceNamespacedName ty // Define a new backend Deployment { - deploymentObj := newBackendDeployment(gitopsserviceNamespacedName, instance.Spec.ImagePullPolicy) + deploymentObj := newBackendDeployment(gitopsserviceNamespacedName, instance.Spec.ImagePullPolicy, r.CentralTLSProfile) // Add SeccompProfile based on cluster version util.AddSeccompProfileForOpenShift(r.Client, &deploymentObj.Spec.Template.Spec) @@ -796,11 +800,30 @@ func objectMeta(resourceName string, namespace string, opts ...func(*metav1.Obje return objectMeta } -func newBackendDeployment(ns types.NamespacedName, crImagePullPolicy corev1.PullPolicy) *appsv1.Deployment { +func newBackendDeployment(ns types.NamespacedName, crImagePullPolicy corev1.PullPolicy, CentralTLSProfile configv1.TLSProfileSpec) *appsv1.Deployment { image := os.Getenv(backendImageEnvName) if image == "" { image = backendImage } + env := []corev1.EnvVar{ + { + Name: insecureEnvVar, + Value: insecureEnvVarValue, + }, + } + if argocdutil.TLSProtocolVersionString(CentralTLSProfile.MinTLSVersion) != "" { + env = append(env, corev1.EnvVar{ + Name: "TLS_MIN_VERSION", + Value: argocdutil.TLSProtocolVersionString(CentralTLSProfile.MinTLSVersion), + }) + } + + if len(CentralTLSProfile.Ciphers) > 0 { + env = append(env, corev1.EnvVar{ + Name: "TLS_CIPHER_SUITES", + Value: strings.Join(CentralTLSProfile.Ciphers, ":"), + }) + } podSpec := corev1.PodSpec{ Containers: []corev1.Container{ { @@ -814,12 +837,7 @@ func newBackendDeployment(ns types.NamespacedName, crImagePullPolicy corev1.Pull ContainerPort: port, // should come from flag }, }, - Env: []corev1.EnvVar{ - { - Name: insecureEnvVar, - Value: insecureEnvVarValue, - }, - }, + Env: env, VolumeMounts: []corev1.VolumeMount{ { MountPath: "/etc/gitops/ssl", diff --git a/controllers/gitopsservice_controller_test.go b/controllers/gitopsservice_controller_test.go index 65860dfeff7..028aca5f7ed 100644 --- a/controllers/gitopsservice_controller_test.go +++ b/controllers/gitopsservice_controller_test.go @@ -62,7 +62,7 @@ func TestImageFromEnvVariable(t *testing.T) { image := "quay.io/org/test" t.Setenv(backendImageEnvName, image) - deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent)) + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{}) got := deployment.Spec.Template.Spec.Containers[0].Image if got != image { @@ -70,7 +70,7 @@ func TestImageFromEnvVariable(t *testing.T) { } }) t.Run("env variable for image not found", func(t *testing.T) { - deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent)) + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{}) got := deployment.Spec.Template.Spec.Containers[0].Image if got != backendImage { @@ -78,6 +78,73 @@ func TestImageFromEnvVariable(t *testing.T) { } }) + t.Run("TLS Min Version 1.3 and empty ciphers", func(t *testing.T) { + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{MinTLSVersion: configv1.VersionTLS13}) + var gotTLSMinVersion string + for _, env := range deployment.Spec.Template.Spec.Containers[0].Env { + if env.Name == "TLS_MIN_VERSION" { + gotTLSMinVersion = env.Value + break + } + } + if gotTLSMinVersion != "1.3" { + t.Errorf("TLS Min Version mismatch: got %s, want %s", gotTLSMinVersion, "1.3") + } + }) + + t.Run("TLS Min Version 1.2 and empty ciphers", func(t *testing.T) { + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{MinTLSVersion: configv1.VersionTLS12}) + var gotTLSMinVersion string + for _, env := range deployment.Spec.Template.Spec.Containers[0].Env { + if env.Name == "TLS_MIN_VERSION" { + gotTLSMinVersion = env.Value + break + } + } + if gotTLSMinVersion != "1.2" { + t.Errorf("TLS Min Version mismatch: got %s, want %s", gotTLSMinVersion, "1.2") + } + }) + + t.Run("TLS Min Version 1.3 and single ciphers", func(t *testing.T) { + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{MinTLSVersion: configv1.VersionTLS13, Ciphers: []string{"dummy1"}}) + var gotTLSMinVersion string + var gotTLSCiphers string + for _, env := range deployment.Spec.Template.Spec.Containers[0].Env { + if env.Name == "TLS_MIN_VERSION" { + gotTLSMinVersion = env.Value + break + } + if env.Name == "TLS_CIPHER_SUITES" { + gotTLSCiphers = env.Value + break + } + } + if gotTLSMinVersion != "1.3" && gotTLSCiphers != "dummy1" { + t.Errorf("TLS Min Version mismatch: got %s, want %s", gotTLSMinVersion, "1.3") + t.Errorf("TLS Cipher mismatch: got %s, want %s", gotTLSCiphers, "dummy1") + } + }) + + t.Run("TLS Min Version 1.3 and double ciphers", func(t *testing.T) { + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{MinTLSVersion: configv1.VersionTLS13, Ciphers: []string{"dummy1", "dummy2"}}) + var gotTLSMinVersion string + var gotTLSCiphers string + for _, env := range deployment.Spec.Template.Spec.Containers[0].Env { + if env.Name == "TLS_MIN_VERSION" { + gotTLSMinVersion = env.Value + break + } + if env.Name == "TLS_CIPHER_SUITES" { + gotTLSCiphers = env.Value + break + } + } + if gotTLSMinVersion != "1.3" && gotTLSCiphers != "dummy1:dummy2" { + t.Errorf("TLS Min Version mismatch: got %s, want %s", gotTLSMinVersion, "1.3") + t.Errorf("TLS Cipher mismatch: got %s, want %s", gotTLSCiphers, "dummy1:dummy2") + } + }) } func TestReconcileDefaultForArgoCDNodeplacement(t *testing.T) {