From 3f8dcc05609245ff774f7566fb50146e8d2e64d5 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Tue, 21 Jul 2026 11:59:08 +0530 Subject: [PATCH 1/5] [GITOPS-10474]: Configure TLS MinVersion and Ciphers for gitops backend component Signed-off-by: akhil nittala --- cmd/main.go | 2 ++ controllers/gitopsservice_controller.go | 47 ++++++++++++++++++++----- 2 files changed, 41 insertions(+), 8 deletions(-) diff --git a/cmd/main.go b/cmd/main.go index c3dd5dd4471..e04f6accdb6 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -312,6 +312,8 @@ func main() { Client: client, Scheme: mgr.GetScheme(), DisableDefaultInstall: strings.ToLower(os.Getenv(common.DisableDefaultInstallEnvVar)) == "true", + TLSMinVersion: string(profile.MinTLSVersion), + TLSCiphers: profile.Ciphers, }).SetupWithManager(mgr); err != nil { setupLog.Error(err, "unable to create controller", "controller", "GitopsService") os.Exit(1) diff --git a/controllers/gitopsservice_controller.go b/controllers/gitopsservice_controller.go index b643cad0529..25d62d789b6 100644 --- a/controllers/gitopsservice_controller.go +++ b/controllers/gitopsservice_controller.go @@ -146,6 +146,10 @@ type ReconcileGitopsService struct { // disableDefaultInstall, if true, will ensure that the default ArgoCD instance is not instantiated in the openshift-gitops namespace. DisableDefaultInstall bool + // TLSMinVersion is the minimum TLS version to use for the GitOps plugin. + TLSMinVersion string + // TLSCiphers is the list of supported TLS ciphers for the GitOps plugin. + TLSCiphers []string } // +kubebuilder:rbac:groups=config.openshift.io,resources=authentications,verbs=get;list;watch @@ -658,7 +662,7 @@ func (r *ReconcileGitopsService) reconcileBackend(gitopsserviceNamespacedName ty // Define a new backend Deployment { - deploymentObj := newBackendDeployment(gitopsserviceNamespacedName, instance.Spec.ImagePullPolicy) + deploymentObj := newBackendDeployment(gitopsserviceNamespacedName, instance.Spec.ImagePullPolicy, r.TLSMinVersion, r.TLSCiphers) // Add SeccompProfile based on cluster version util.AddSeccompProfileForOpenShift(r.Client, &deploymentObj.Spec.Template.Spec) @@ -796,11 +800,43 @@ func objectMeta(resourceName string, namespace string, opts ...func(*metav1.Obje return objectMeta } -func newBackendDeployment(ns types.NamespacedName, crImagePullPolicy corev1.PullPolicy) *appsv1.Deployment { +func TLSVersionToBackend(tlsVersion string) string { + versionMap := map[string]string{ + "VersionTLS12": "1.2", + "VersionTLS13": "1.3", + "VersionTLS11": "1.1", + "VersionTLS10": "1", + } + if v, ok := versionMap[tlsVersion]; ok { + return v + } + return "" // default fallback +} + +func newBackendDeployment(ns types.NamespacedName, crImagePullPolicy corev1.PullPolicy, TLSMinVersion string, TLSCiphers []string) *appsv1.Deployment { image := os.Getenv(backendImageEnvName) if image == "" { image = backendImage } + env := []corev1.EnvVar{ + { + Name: insecureEnvVar, + Value: insecureEnvVarValue, + }, + } + if TLSVersionToBackend(TLSMinVersion) != "" { + env = append(env, corev1.EnvVar{ + Name: "TLS_MIN_VERSION", + Value: TLSVersionToBackend(TLSMinVersion), + }) + } + + if len(TLSCiphers) > 0 { + env = append(env, corev1.EnvVar{ + Name: "TLS_CIPHER_SUITES", + Value: strings.Join(TLSCiphers, ":"), + }) + } podSpec := corev1.PodSpec{ Containers: []corev1.Container{ { @@ -814,12 +850,7 @@ func newBackendDeployment(ns types.NamespacedName, crImagePullPolicy corev1.Pull ContainerPort: port, // should come from flag }, }, - Env: []corev1.EnvVar{ - { - Name: insecureEnvVar, - Value: insecureEnvVarValue, - }, - }, + Env: env, VolumeMounts: []corev1.VolumeMount{ { MountPath: "/etc/gitops/ssl", From 0eaf3c7b475a0682737a6a1a2da2d440748ade5e Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Tue, 21 Jul 2026 12:10:33 +0530 Subject: [PATCH 2/5] [GITOPS-10474]: Configure TLS MinVersion and Ciphers for gitops backend component Signed-off-by: akhil nittala --- controllers/gitopsservice_controller_test.go | 71 +++++++++++++++++++- 1 file changed, 69 insertions(+), 2 deletions(-) diff --git a/controllers/gitopsservice_controller_test.go b/controllers/gitopsservice_controller_test.go index 65860dfeff7..68a6da8f4ae 100644 --- a/controllers/gitopsservice_controller_test.go +++ b/controllers/gitopsservice_controller_test.go @@ -62,7 +62,7 @@ func TestImageFromEnvVariable(t *testing.T) { image := "quay.io/org/test" t.Setenv(backendImageEnvName, image) - deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent)) + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), "", nil) got := deployment.Spec.Template.Spec.Containers[0].Image if got != image { @@ -70,7 +70,7 @@ func TestImageFromEnvVariable(t *testing.T) { } }) t.Run("env variable for image not found", func(t *testing.T) { - deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent)) + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), "", nil) got := deployment.Spec.Template.Spec.Containers[0].Image if got != backendImage { @@ -78,6 +78,73 @@ func TestImageFromEnvVariable(t *testing.T) { } }) + t.Run("TLS Min Version 1.3 and empty ciphers", func(t *testing.T) { + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), string(configv1.VersionTLS13), nil) + var gotTLSMinVersion string + for _, env := range deployment.Spec.Template.Spec.Containers[0].Env { + if env.Name == "TLS_MIN_VERSION" { + gotTLSMinVersion = env.Value + break + } + } + if gotTLSMinVersion != "1.3" { + t.Errorf("TLS Min Version mismatch: got %s, want %s", gotTLSMinVersion, "1.3") + } + }) + + t.Run("TLS Min Version 1.2 and empty ciphers", func(t *testing.T) { + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), string(configv1.VersionTLS12), nil) + var gotTLSMinVersion string + for _, env := range deployment.Spec.Template.Spec.Containers[0].Env { + if env.Name == "TLS_MIN_VERSION" { + gotTLSMinVersion = env.Value + break + } + } + if gotTLSMinVersion != "1.2" { + t.Errorf("TLS Min Version mismatch: got %s, want %s", gotTLSMinVersion, "1.2") + } + }) + + t.Run("TLS Min Version 1.3 and single ciphers", func(t *testing.T) { + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), string(configv1.VersionTLS13), []string{"dummy1"}) + var gotTLSMinVersion string + var gotTLSCiphers string + for _, env := range deployment.Spec.Template.Spec.Containers[0].Env { + if env.Name == "TLS_MIN_VERSION" { + gotTLSMinVersion = env.Value + break + } + if env.Name == "TLS_CIPHER_SUITES" { + gotTLSCiphers = env.Value + break + } + } + if gotTLSMinVersion != "1.3" && gotTLSCiphers != "dummy1" { + t.Errorf("TLS Min Version mismatch: got %s, want %s", gotTLSMinVersion, "1.3") + t.Errorf("TLS Cipher mismatch: got %s, want %s", gotTLSCiphers, "dummy1") + } + }) + + t.Run("TLS Min Version 1.3 and double ciphers", func(t *testing.T) { + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), string(configv1.VersionTLS13), []string{"dummy1", "dummy2"}) + var gotTLSMinVersion string + var gotTLSCiphers string + for _, env := range deployment.Spec.Template.Spec.Containers[0].Env { + if env.Name == "TLS_MIN_VERSION" { + gotTLSMinVersion = env.Value + break + } + if env.Name == "TLS_CIPHER_SUITES" { + gotTLSCiphers = env.Value + break + } + } + if gotTLSMinVersion != "1.3" && gotTLSCiphers != "dummy1:dummy2" { + t.Errorf("TLS Min Version mismatch: got %s, want %s", gotTLSMinVersion, "1.3") + t.Errorf("TLS Cipher mismatch: got %s, want %s", gotTLSCiphers, "dummy1:dummy2") + } + }) } func TestReconcileDefaultForArgoCDNodeplacement(t *testing.T) { From dcd1e578e40049e47dc2eb5f4f3d400cb46a68e9 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Thu, 23 Jul 2026 12:05:23 +0530 Subject: [PATCH 3/5] feat(gitops-backend): Configure TLS MinVersion and Ciphers Signed-off-by: akhil nittala --- cmd/main.go | 3 +- controllers/gitopsservice_controller.go | 34 +++++++------------- controllers/gitopsservice_controller_test.go | 12 +++---- 3 files changed, 18 insertions(+), 31 deletions(-) diff --git a/cmd/main.go b/cmd/main.go index e04f6accdb6..073aa7c6c61 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -312,8 +312,7 @@ func main() { Client: client, Scheme: mgr.GetScheme(), DisableDefaultInstall: strings.ToLower(os.Getenv(common.DisableDefaultInstallEnvVar)) == "true", - TLSMinVersion: string(profile.MinTLSVersion), - TLSCiphers: profile.Ciphers, + CentralTLSProfile: configv1.TLSProfileSpec{}, }).SetupWithManager(mgr); err != nil { setupLog.Error(err, "unable to create controller", "controller", "GitopsService") os.Exit(1) diff --git a/controllers/gitopsservice_controller.go b/controllers/gitopsservice_controller.go index 25d62d789b6..3f2b5c0bde3 100644 --- a/controllers/gitopsservice_controller.go +++ b/controllers/gitopsservice_controller.go @@ -27,6 +27,7 @@ import ( argoapp "github.com/argoproj-labs/argocd-operator/api/v1beta1" argocommon "github.com/argoproj-labs/argocd-operator/common" argocdcontroller "github.com/argoproj-labs/argocd-operator/controllers/argocd" + "github.com/argoproj-labs/argocd-operator/controllers/argoutil" argocdutil "github.com/argoproj-labs/argocd-operator/controllers/argoutil" "github.com/go-logr/logr" version "github.com/hashicorp/go-version" @@ -54,6 +55,8 @@ import ( logf "sigs.k8s.io/controller-runtime/pkg/log" "sigs.k8s.io/controller-runtime/pkg/predicate" "sigs.k8s.io/controller-runtime/pkg/reconcile" + + configv1 "github.com/openshift/api/config/v1" ) var logs = logf.Log.WithName("controller_gitopsservice") @@ -146,10 +149,8 @@ type ReconcileGitopsService struct { // disableDefaultInstall, if true, will ensure that the default ArgoCD instance is not instantiated in the openshift-gitops namespace. DisableDefaultInstall bool - // TLSMinVersion is the minimum TLS version to use for the GitOps plugin. - TLSMinVersion string - // TLSCiphers is the list of supported TLS ciphers for the GitOps plugin. - TLSCiphers []string + //CentralTLSProfile contains MinVersion and CipherSuites + CentralTLSProfile configv1.TLSProfileSpec } // +kubebuilder:rbac:groups=config.openshift.io,resources=authentications,verbs=get;list;watch @@ -662,7 +663,7 @@ func (r *ReconcileGitopsService) reconcileBackend(gitopsserviceNamespacedName ty // Define a new backend Deployment { - deploymentObj := newBackendDeployment(gitopsserviceNamespacedName, instance.Spec.ImagePullPolicy, r.TLSMinVersion, r.TLSCiphers) + deploymentObj := newBackendDeployment(gitopsserviceNamespacedName, instance.Spec.ImagePullPolicy, r.CentralTLSProfile) // Add SeccompProfile based on cluster version util.AddSeccompProfileForOpenShift(r.Client, &deploymentObj.Spec.Template.Spec) @@ -800,20 +801,7 @@ func objectMeta(resourceName string, namespace string, opts ...func(*metav1.Obje return objectMeta } -func TLSVersionToBackend(tlsVersion string) string { - versionMap := map[string]string{ - "VersionTLS12": "1.2", - "VersionTLS13": "1.3", - "VersionTLS11": "1.1", - "VersionTLS10": "1", - } - if v, ok := versionMap[tlsVersion]; ok { - return v - } - return "" // default fallback -} - -func newBackendDeployment(ns types.NamespacedName, crImagePullPolicy corev1.PullPolicy, TLSMinVersion string, TLSCiphers []string) *appsv1.Deployment { +func newBackendDeployment(ns types.NamespacedName, crImagePullPolicy corev1.PullPolicy, CentralTLSProfile configv1.TLSProfileSpec) *appsv1.Deployment { image := os.Getenv(backendImageEnvName) if image == "" { image = backendImage @@ -824,17 +812,17 @@ func newBackendDeployment(ns types.NamespacedName, crImagePullPolicy corev1.Pull Value: insecureEnvVarValue, }, } - if TLSVersionToBackend(TLSMinVersion) != "" { + if argoutil.TLSProtocolVersionString(CentralTLSProfile.MinTLSVersion) != "" { env = append(env, corev1.EnvVar{ Name: "TLS_MIN_VERSION", - Value: TLSVersionToBackend(TLSMinVersion), + Value: argoutil.TLSProtocolVersionString(CentralTLSProfile.MinTLSVersion), }) } - if len(TLSCiphers) > 0 { + if len(CentralTLSProfile.Ciphers) > 0 { env = append(env, corev1.EnvVar{ Name: "TLS_CIPHER_SUITES", - Value: strings.Join(TLSCiphers, ":"), + Value: strings.Join(CentralTLSProfile.Ciphers, ":"), }) } podSpec := corev1.PodSpec{ diff --git a/controllers/gitopsservice_controller_test.go b/controllers/gitopsservice_controller_test.go index 68a6da8f4ae..028aca5f7ed 100644 --- a/controllers/gitopsservice_controller_test.go +++ b/controllers/gitopsservice_controller_test.go @@ -62,7 +62,7 @@ func TestImageFromEnvVariable(t *testing.T) { image := "quay.io/org/test" t.Setenv(backendImageEnvName, image) - deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), "", nil) + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{}) got := deployment.Spec.Template.Spec.Containers[0].Image if got != image { @@ -70,7 +70,7 @@ func TestImageFromEnvVariable(t *testing.T) { } }) t.Run("env variable for image not found", func(t *testing.T) { - deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), "", nil) + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{}) got := deployment.Spec.Template.Spec.Containers[0].Image if got != backendImage { @@ -79,7 +79,7 @@ func TestImageFromEnvVariable(t *testing.T) { }) t.Run("TLS Min Version 1.3 and empty ciphers", func(t *testing.T) { - deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), string(configv1.VersionTLS13), nil) + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{MinTLSVersion: configv1.VersionTLS13}) var gotTLSMinVersion string for _, env := range deployment.Spec.Template.Spec.Containers[0].Env { if env.Name == "TLS_MIN_VERSION" { @@ -93,7 +93,7 @@ func TestImageFromEnvVariable(t *testing.T) { }) t.Run("TLS Min Version 1.2 and empty ciphers", func(t *testing.T) { - deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), string(configv1.VersionTLS12), nil) + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{MinTLSVersion: configv1.VersionTLS12}) var gotTLSMinVersion string for _, env := range deployment.Spec.Template.Spec.Containers[0].Env { if env.Name == "TLS_MIN_VERSION" { @@ -107,7 +107,7 @@ func TestImageFromEnvVariable(t *testing.T) { }) t.Run("TLS Min Version 1.3 and single ciphers", func(t *testing.T) { - deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), string(configv1.VersionTLS13), []string{"dummy1"}) + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{MinTLSVersion: configv1.VersionTLS13, Ciphers: []string{"dummy1"}}) var gotTLSMinVersion string var gotTLSCiphers string for _, env := range deployment.Spec.Template.Spec.Containers[0].Env { @@ -127,7 +127,7 @@ func TestImageFromEnvVariable(t *testing.T) { }) t.Run("TLS Min Version 1.3 and double ciphers", func(t *testing.T) { - deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), string(configv1.VersionTLS13), []string{"dummy1", "dummy2"}) + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{MinTLSVersion: configv1.VersionTLS13, Ciphers: []string{"dummy1", "dummy2"}}) var gotTLSMinVersion string var gotTLSCiphers string for _, env := range deployment.Spec.Template.Spec.Containers[0].Env { From 24858396dc70e8224916499a40270d4a9c4dfb02 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Thu, 23 Jul 2026 12:20:09 +0530 Subject: [PATCH 4/5] feat(gitops-backend): Configure TLS MinVersion and Ciphers Signed-off-by: akhil nittala --- controllers/gitopsservice_controller.go | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/controllers/gitopsservice_controller.go b/controllers/gitopsservice_controller.go index 3f2b5c0bde3..6c434d93fb0 100644 --- a/controllers/gitopsservice_controller.go +++ b/controllers/gitopsservice_controller.go @@ -27,7 +27,6 @@ import ( argoapp "github.com/argoproj-labs/argocd-operator/api/v1beta1" argocommon "github.com/argoproj-labs/argocd-operator/common" argocdcontroller "github.com/argoproj-labs/argocd-operator/controllers/argocd" - "github.com/argoproj-labs/argocd-operator/controllers/argoutil" argocdutil "github.com/argoproj-labs/argocd-operator/controllers/argoutil" "github.com/go-logr/logr" version "github.com/hashicorp/go-version" @@ -812,10 +811,10 @@ func newBackendDeployment(ns types.NamespacedName, crImagePullPolicy corev1.Pull Value: insecureEnvVarValue, }, } - if argoutil.TLSProtocolVersionString(CentralTLSProfile.MinTLSVersion) != "" { + if argocdutil.TLSProtocolVersionString(CentralTLSProfile.MinTLSVersion) != "" { env = append(env, corev1.EnvVar{ Name: "TLS_MIN_VERSION", - Value: argoutil.TLSProtocolVersionString(CentralTLSProfile.MinTLSVersion), + Value: argocdutil.TLSProtocolVersionString(CentralTLSProfile.MinTLSVersion), }) } From cd00b10dc3502130ad516c01fef66981c2686b14 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Thu, 23 Jul 2026 12:33:29 +0530 Subject: [PATCH 5/5] feat(gitops-backend): Configure TLS MinVersion and Ciphers Signed-off-by: akhil nittala --- cmd/main.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cmd/main.go b/cmd/main.go index 073aa7c6c61..5c2e52707da 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -312,7 +312,7 @@ func main() { Client: client, Scheme: mgr.GetScheme(), DisableDefaultInstall: strings.ToLower(os.Getenv(common.DisableDefaultInstallEnvVar)) == "true", - CentralTLSProfile: configv1.TLSProfileSpec{}, + CentralTLSProfile: profile, }).SetupWithManager(mgr); err != nil { setupLog.Error(err, "unable to create controller", "controller", "GitopsService") os.Exit(1)