feat(argo-cd): Support custom TLS certificates for Dex by pdrastil · Pull Request #1477 · argoproj/argo-helm

pdrastil · 2022-09-21T16:10:46Z

Added option to use custom TLS certificate for Dex
Enforced TLS strict mode when custom TLS is enabled

Note on DCO:

If the DCO action in the integration test fails, one or more of your commits are not signed off. Please click on the Details link next to the DCO action for instructions on how to resolve this.

Checklist:

I have bumped the chart version according to versioning
I have updated the documentation according to documentation
I have updated the chart changelog with all the changes that come with this pull request according to changelog.
Any new values are backwards compatible and/or have sensible default.
I have signed off all my commits as required by DCO.
My build is green (troubleshooting builds).

Changes are automatically published when merged to main. They are not published on branches.

pdrastil · 2022-09-21T16:13:18Z

@jmeridth @mkilchhofer - Maybe this should go together with Argo CD 2.5.x upgrade

tooptoop4 · 2022-10-25T20:03:00Z

2.5 is out

pdrastil · 2022-10-25T20:07:06Z

@tooptoop4 This will go after upgrade is out as I need to test more thoroughly. Basic support with self-signed Dex certs works.

pdrastil · 2022-10-29T14:03:57Z

charts/argo-cd/templates/_helpers.tpl

This validates Dex server certificates

pdrastil · 2022-10-29T14:04:51Z

charts/argo-cd/templates/dex/certificate.yaml

Only K8s domains argocd-dex-server and argocd-dex-server.{{ namespace }}.svc is needed

pdrastil · 2022-10-29T14:06:54Z

charts/argo-cd/templates/dex/certificate.yaml

Common name is intentionally kept for external PKI providers that require this to be set as it might be convenient to have different certs for multiple Argo / Dex instances.

pdrastil · 2022-10-29T14:09:06Z

charts/argo-cd/values.yaml

This is quite important and I would recommend to have Reloader to avoid issues with cert rotation.

Maybe we could file an Issue in the argoproj/argo-cd project. The bundled dex component is controlled by a helper utility /shared/argocd-dex rundex

https://github.com/argoproj/argo-cd/blob/776d8f97ccc95584b7ac586f0e7091819e39f583/cmd/argocd-dex/commands/argocd_dex.go#L120-L129

For DexIdp itself, feature request already exists:

add functionality to re-read config file, certificate dexidp/dex#2274

For Dex I wanted to talk to Michael and propose / ask few questions. I believe the helper utility should not be used as there are another cleaner ways how to manage Dex and allow users to have HA setup, persistent sessions, etc. which is not currently possible with a way it's implemented.

Signed-off-by: Petr Drastil <petr.drastil@gmail.com>

pdrastil · 2022-10-30T20:33:41Z

Removed support for cert-manager for now as it might be dangerous when certificates rotates and Dex can't detect this.

* feat(argo-cd): Upgrade Argo CD to 2.5.0 (argoproj#1568) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * chore(github): Bump GitHub actions versions (argoproj#1575) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * fix(argo-cd): Chart NOTES nil references (argoproj#1582) Signed-off-by: Filipe Santos <filipe@not.sh> * docs(argo-cd): Improve documentation (argoproj#1584) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * fix(argo-workflows): serviceaccount rbac when sso is enabled (argoproj#1586) Signed-off-by: Nick Fisher <nxf5025@gmail.com> Signed-off-by: Nick Fisher <nxf5025@gmail.com> * Fix incorrect applicationSet property in README (argoproj#1590) Based on [here](https://github.com/argoproj/argo-helm/blob/55b8b34d20ebaf38fa05e1113daf30220d11e725/charts/argo-cd/templates/argocd-applicationset/deployment.yaml#L9), I think `replicas` should be `replicaCount` (though `replicas` would be more consistent). Signed-off-by: Ashlin Eldridge <ashlin.eldridge@gmail.com> Signed-off-by: Ashlin Eldridge <ashlin.eldridge@gmail.com> * fix(argo-cd): Remove AWS volume from server (argoproj#1591) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * chore(argo-cd): Cleanup Redis manifest (argoproj#1577) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * fix(argo-cd): Fix migration path for server configs (argoproj#1585) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * fix(argo-cd): Type conversion for ConfigMaps values (argoproj#1594) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * feat(argo-cd): Add probes for ApplicationSet controller (argoproj#1532) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * chore(argo-cd): Remove liveness probe from application controller (argoproj#1581) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * chore(github): Add dependabot.yml (argoproj#1595) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * feat(argo-cd): Set container security contexts (argoproj#1579) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * feat(argo-cd): Support custom TLS certificates for Dex (argoproj#1477) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * feat(argo-cd): Support manually managed TLS certificate for Server (argoproj#1534) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * fix(argo-cd): Don't install CRDs for disabled components (argoproj#1596) Signed-off-by: Marco Kilchhofer <mkilchhofer@users.noreply.github.com> * fix(argo-cd): update network policy port name (argoproj#1603) Signed-off-by: Eric Cimino <ecimino@vailsys.com> * chore(argo-workflows): Update ArgoWorkflows to v3.4.3 (argoproj#1610) Signed-off-by: yu-croco <yu.croco@gmail.com> * fix(argo-cd): Replace coalesce with merge for old config values (argoproj#1612) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * feat(argo-cd): Add revisionHistoryLimit (argoproj#1599) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Upgrade Argo Image to the latest (argoproj#1614) Signed-off-by: Dong Wang <wd@wdicc.com> Signed-off-by: Dong Wang <wd@wdicc.com> * chore(argo-cd): Update redis-ha (argoproj#1617) Signed-off-by: yu-croco <yu.croco@gmail.com> * fix(argo-cd): Add /tmp voulmeMount to extensions container (argoproj#1620) * Fixes argoproj#1619 - Add /tmp voulmeMount to extensions container Signed-off-by: Tim Van de Walle <tvandewalle@trek10.com> * Bump version, add change notes Signed-off-by: Tim Van de Walle <tvandewalle@trek10.com> Signed-off-by: Tim Van de Walle <tvandewalle@trek10.com> * fix(argo-cd): Add missing ClusterRole permissions to argo-cd-server to manage Application in all namespaces (argoproj#1621) Signed-off-by: Elad Dolev <dolevelad@gmail.com> * fix(argo-cd): Use Dex non-distroless image (argoproj#1626) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * chore(argo-cd): Upgrade Argo CD to 2.5.2 (argoproj#1628) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Allow to add custom artifact repository (argoproj#1453) Signed-off-by: Max Kochubey <20810306+maxkochubey@users.noreply.github.com> Signed-off-by: Max Kochubey <20810306+maxkochubey@users.noreply.github.com> * fix(argo-cd): Use raw json for cluster credentials for Vault compatibility (argoproj#1634) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> Signed-off-by: Petr Drastil <petr.drastil@gmail.com> Co-authored-by: Aikawa <yu.croco@gmail.com> * fix(argo-cd): Cluster credentials config should be a string (argoproj#1636) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * fix(argo-workflows): Added missing attribute for sso (argoproj#1641) Signed-off-by: yu-croco <yu.croco@gmail.com> * docs(argo-cd): Improve changelog information (argoproj#1652) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * chore(argo-cd): Consolidated GnuPG configuration (argoproj#1609) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * fix(argo-cd): Invalid argocd-gpg-keys-cm template (argoproj#1656) The template removed a little too much whitespace resulting in an invalid ConfigMap. Error: ``` Error: YAML parse error on argocd/charts/argo-cd/templates/argocd-configs/argocd-gpg-keys-cm.yaml: error converting YAML to JSON: yaml: line 10: mapping values are not allowed in this context ``` Signed-off-by: Allex <allexveldman+github@gmail.com> Signed-off-by: Allex <allexveldman+github@gmail.com> * feat(argo-workflows): Allow controller to whitelist secrets (argoproj#1646) * allow users to whitelist secrets Signed-off-by: emmayylu <84873428+yolu-kxs@users.noreply.github.com> * remove unnecessary if-statement Signed-off-by: emmayylu <44856279+emmayylu@users.noreply.github.com> * use square bracket for array Signed-off-by: emmayylu <44856279+emmayylu@users.noreply.github.com> * fix typo and update readme Signed-off-by: emmayylu <44856279+emmayylu@users.noreply.github.com> Signed-off-by: emmayylu <84873428+yolu-kxs@users.noreply.github.com> Signed-off-by: emmayylu <44856279+emmayylu@users.noreply.github.com> Co-authored-by: emmayylu <84873428+yolu-kxs@users.noreply.github.com> * feat(argo-workflows): Add labels for ServiceAccounts (argoproj#1665) * Add labels for ServiceAccounts Signed-off-by: Eugene Lugovtsov <lug.zhenia@gmail.com> * fix workflow serviceaccount labels Signed-off-by: Eugene Lugovtsov <lug.zhenia@gmail.com> * fix docs Signed-off-by: Eugene Lugovtsov <lug.zhenia@gmail.com> Signed-off-by: Eugene Lugovtsov <lug.zhenia@gmail.com> * fix(argo-cd): deprecate server.extraArgs."--insecure" (argoproj#1669) Signed-off-by: GitHub <noreply@github.com> Signed-off-by: GitHub <noreply@github.com> * chore(argo-workflows): Support workflow retention (argoproj#1668) Signed-off-by: yu-croco <yu.croco@gmail.com> * feat(argo-cd): Upgrade argocd to v2.5.3 (argoproj#1671) Signed-off-by: smcavallo <smcavallo@hotmail.com> * fix helm install md (argoproj#1672) Signed-off-by: fsl <1171313930@qq.com> Signed-off-by: fsl <1171313930@qq.com> * feat(argo-cd): Add Repo Server strict TLS cert support (argoproj#1673) Signed-off-by: Karl Parry <karl.parry@imbursepayments.com> * chore(argo-workflows): Update Argo Workflows to v3.4.4 (argoproj#1674) Signed-off-by: yu-croco <yu.croco@gmail.com> * fix(argo-cd): Rename tls secret to include the -secret suffix (argoproj#1676) - "[Fixed]: TLS secret name so Dex correctly generates the checksum for argocd-dex-server-tls." - "[Fixed]: Standardise the naming convention of the TLS secret manifests." - "[Added]: Add checksum to Repo-Server for the argocd-repo-server-tls secret." Signed-off-by: Karl Parry <karl.parry@imbursepayments.com> * chore(argo-cd): Remove duplicate ApplicationSet features (argoproj#1598) Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * feat(argo-cd): Add ability to annotate Deployments and StatefulSets (argoproj#1608) * feat(argo-cd): Add ability to annotate Deployments and StatefulSets Signed-off-by: John Stewart <jstewart@rentpath.com> * fix: Controller and AppSet controller was mixed Signed-off-by: Marco Kilchhofer <mkilchhofer@users.noreply.github.com> Signed-off-by: John Stewart <jstewart@rentpath.com> Signed-off-by: Marco Kilchhofer <mkilchhofer@users.noreply.github.com> Co-authored-by: Marco Kilchhofer <mkilchhofer@users.noreply.github.com> * chart update WIP * backport applicationset * backport applicationset * argocd 2.5.5 --------- Signed-off-by: Petr Drastil <petr.drastil@gmail.com> Signed-off-by: Filipe Santos <filipe@not.sh> Signed-off-by: Nick Fisher <nxf5025@gmail.com> Signed-off-by: Ashlin Eldridge <ashlin.eldridge@gmail.com> Signed-off-by: Marco Kilchhofer <mkilchhofer@users.noreply.github.com> Signed-off-by: Eric Cimino <ecimino@vailsys.com> Signed-off-by: yu-croco <yu.croco@gmail.com> Signed-off-by: Dong Wang <wd@wdicc.com> Signed-off-by: Tim Van de Walle <tvandewalle@trek10.com> Signed-off-by: Elad Dolev <dolevelad@gmail.com> Signed-off-by: Max Kochubey <20810306+maxkochubey@users.noreply.github.com> Signed-off-by: Allex <allexveldman+github@gmail.com> Signed-off-by: emmayylu <84873428+yolu-kxs@users.noreply.github.com> Signed-off-by: emmayylu <44856279+emmayylu@users.noreply.github.com> Signed-off-by: Eugene Lugovtsov <lug.zhenia@gmail.com> Signed-off-by: GitHub <noreply@github.com> Signed-off-by: smcavallo <smcavallo@hotmail.com> Signed-off-by: fsl <1171313930@qq.com> Signed-off-by: Karl Parry <karl.parry@imbursepayments.com> Signed-off-by: John Stewart <jstewart@rentpath.com> Co-authored-by: Petr Drastil <petr.drastil@gmail.com> Co-authored-by: Filipe <filipe@not.sh> Co-authored-by: Nick Fisher <nxf5025@gmail.com> Co-authored-by: Ashlin Eldridge <ashlin.eldridge@gmail.com> Co-authored-by: Marco Kilchhofer <mkilchhofer@users.noreply.github.com> Co-authored-by: Eric Cimino <58572548+cimin0@users.noreply.github.com> Co-authored-by: Aikawa <yu.croco@gmail.com> Co-authored-by: Dong Wang <wd@wdicc.com> Co-authored-by: tvandewalle <1022306+tvandewalle@users.noreply.github.com> Co-authored-by: Elad Dolev <dolevelad@gmail.com> Co-authored-by: Max Kochubey <20810306+maxkochubey@users.noreply.github.com> Co-authored-by: Allex <a.veldman@chain-stock.com> Co-authored-by: emmayylu <44856279+emmayylu@users.noreply.github.com> Co-authored-by: emmayylu <84873428+yolu-kxs@users.noreply.github.com> Co-authored-by: Eugene Lugovtsov <34510252+EugeneLugovtsov@users.noreply.github.com> Co-authored-by: Zadkiel Aharonian <zadkiel.aharonian@gmail.com> Co-authored-by: smcavallo <smcavallo@users.noreply.github.com> Co-authored-by: fsl <1171313930@qq.com> Co-authored-by: Karl Parry <88431088+karlparry@users.noreply.github.com> Co-authored-by: John Stewart <32647598+jstewart612@users.noreply.github.com>

pdrastil requested review from davidkarlsen, jmeridth, mbevc1, mkilchhofer, radiomistress, yann-soubeyrand and yu-croco as code owners September 21, 2022 16:10

github-actions bot added argo-cd size/M labels Sep 21, 2022

pdrastil mentioned this pull request Sep 21, 2022

feat(argo-cd): dex-server — Add TLS support #1452

Closed

6 tasks

pdrastil added the awaiting-upstream Is waiting for a change upstream to be completed before it can be merged. label Sep 21, 2022

pdrastil marked this pull request as draft September 21, 2022 18:23

pdrastil mentioned this pull request Oct 10, 2022

Use https for dex server #1537

Closed

pdrastil force-pushed the feature/dex-tls branch from 30c8621 to 51a0648 Compare October 11, 2022 23:18

github-actions bot added size/L and removed size/M labels Oct 11, 2022

pdrastil force-pushed the feature/dex-tls branch from 51a0648 to 4e48a6f Compare October 11, 2022 23:18

pdrastil changed the title ~~feat(argo-cd): Enable custom TLS certificates for Dex~~ feat(argo-cd): Support TLS certificates for Dex Oct 11, 2022

pdrastil removed the awaiting-upstream Is waiting for a change upstream to be completed before it can be merged. label Oct 25, 2022

pdrastil mentioned this pull request Oct 25, 2022

feat(argo-cd): Upgrade Argo CD to 2.5.0 #1568

Merged

6 tasks

pdrastil force-pushed the feature/dex-tls branch 2 times, most recently from f216ad9 to 69dd618 Compare October 29, 2022 14:01

pdrastil changed the title ~~feat(argo-cd): Support TLS certificates for Dex~~ feat(argo-cd): Support custom TLS certificates for Dex Oct 29, 2022

pdrastil commented Oct 29, 2022

View reviewed changes

charts/argo-cd/templates/_helpers.tpl Outdated

Copy link

Member Author

pdrastil Oct 29, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This validates Dex server certificates

mkilchhofer reacted with thumbs up emoji

pdrastil commented Oct 29, 2022

View reviewed changes

pdrastil force-pushed the feature/dex-tls branch from 69dd618 to ce20f9d Compare October 29, 2022 14:07

pdrastil force-pushed the feature/dex-tls branch from ce20f9d to 8b83844 Compare October 29, 2022 14:08

pdrastil commented Oct 29, 2022

View reviewed changes

pdrastil marked this pull request as ready for review October 29, 2022 14:09

pdrastil mentioned this pull request Oct 29, 2022

feat(argo-cd): Support manually managed TLS certificate for Server #1534

Merged

6 tasks

pdrastil force-pushed the feature/dex-tls branch 4 times, most recently from 8ab19b3 to a329ada Compare October 30, 2022 18:09

feat(argo-cd): Support custom TLS certificates for Dex

f274322

Signed-off-by: Petr Drastil <petr.drastil@gmail.com>

pdrastil force-pushed the feature/dex-tls branch from a329ada to f274322 Compare October 30, 2022 19:14

github-actions bot added size/M and removed size/L labels Oct 30, 2022

pdrastil force-pushed the feature/dex-tls branch 2 times, most recently from 0e32f00 to 9b064ce Compare October 30, 2022 19:23

Drop support for cert-manager

f557cf0

Signed-off-by: Petr Drastil <petr.drastil@gmail.com>

pdrastil force-pushed the feature/dex-tls branch from 9b064ce to f557cf0 Compare October 30, 2022 20:29

mkilchhofer approved these changes Oct 30, 2022

View reviewed changes

pdrastil merged commit 9819da3 into argoproj:main Oct 30, 2022

pdrastil deleted the feature/dex-tls branch October 30, 2022 20:44

hairmare mentioned this pull request Oct 31, 2022

feat(infra-apps): update argo-cd from 5.8 to 5.12 adfinis/helm-charts#842

Merged

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(argo-cd): Support custom TLS certificates for Dex#1477

feat(argo-cd): Support custom TLS certificates for Dex#1477
pdrastil merged 2 commits intoargoproj:mainfrom
pdrastil:feature/dex-tls

pdrastil commented Sep 21, 2022 •

edited

Loading

Uh oh!

pdrastil commented Sep 21, 2022

Uh oh!

tooptoop4 commented Oct 25, 2022

Uh oh!

pdrastil commented Oct 25, 2022

Uh oh!

pdrastil Oct 29, 2022

Uh oh!

pdrastil Oct 29, 2022

Uh oh!

pdrastil Oct 29, 2022

Uh oh!

pdrastil Oct 29, 2022

Uh oh!

mkilchhofer Oct 30, 2022 •

edited

Loading

Uh oh!

pdrastil Oct 30, 2022

Uh oh!

pdrastil commented Oct 30, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

pdrastil commented Sep 21, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pdrastil commented Sep 21, 2022

Uh oh!

tooptoop4 commented Oct 25, 2022

Uh oh!

pdrastil commented Oct 25, 2022

Uh oh!

pdrastil Oct 29, 2022

Choose a reason for hiding this comment

Uh oh!

pdrastil Oct 29, 2022

Choose a reason for hiding this comment

Uh oh!

pdrastil Oct 29, 2022

Choose a reason for hiding this comment

Uh oh!

pdrastil Oct 29, 2022

Choose a reason for hiding this comment

Uh oh!

mkilchhofer Oct 30, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pdrastil Oct 30, 2022

Choose a reason for hiding this comment

Uh oh!

pdrastil commented Oct 30, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

pdrastil commented Sep 21, 2022 •

edited

Loading

mkilchhofer Oct 30, 2022 •

edited

Loading