diff --git a/.github/workflows/ci-build.yaml b/.github/workflows/ci-build.yaml index 5cf4189846588..3e1205b549dad 100644 --- a/.github/workflows/ci-build.yaml +++ b/.github/workflows/ci-build.yaml @@ -32,7 +32,7 @@ jobs: docs: ${{ steps.filter.outputs.docs_any_changed }} steps: - uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0 - - uses: tj-actions/changed-files@4edd678ac3f81e2dc578756871e4d00c19191daf # v45.0.4 + - uses: tj-actions/changed-files@bab30c2299617f6615ec02a68b9a40d10bd21366 # v45.0.5 id: filter with: # Any file which is not under docs/, ui/ or is not a markdown file is counted as a backend file diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index fbdf244b15af5..575b12ef26b86 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -195,7 +195,7 @@ jobs: echo "hashes=$(sha256sum /tmp/sbom.tar.gz | base64 -w0)" >> "$GITHUB_OUTPUT" - name: Upload SBOM - uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v2.1.0 + uses: softprops/action-gh-release@7b4da11513bf3f43f9999e90eabced41ab8bb048 # v2.2.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/applicationset/controllers/applicationset_controller_test.go b/applicationset/controllers/applicationset_controller_test.go index f4e63a9e6866b..6d55dd6bdb1e5 100644 --- a/applicationset/controllers/applicationset_controller_test.go +++ b/applicationset/controllers/applicationset_controller_test.go @@ -1783,7 +1783,7 @@ func TestDeleteInCluster(t *testing.T) { Name: obj.Name, }, got) - assert.EqualError(t, err, fmt.Sprintf("applications.argoproj.io \"%s\" not found", obj.Name)) + assert.EqualError(t, err, fmt.Sprintf("applications.argoproj.io %q not found", obj.Name)) } } } diff --git a/applicationset/controllers/template/template.go b/applicationset/controllers/template/template.go index bb4bc155d4e59..616b7ef9a7e74 100644 --- a/applicationset/controllers/template/template.go +++ b/applicationset/controllers/template/template.go @@ -69,9 +69,11 @@ func GenerateApplications(logCtx *log.Entry, applicationSetInfo argov1alpha1.App res = append(res, *app) } } - - logCtx.WithField("generator", requestedGenerator).Infof("generated %d applications", len(res)) - logCtx.WithField("generator", requestedGenerator).Debugf("apps from generator: %+v", res) + if log.IsLevelEnabled(log.DebugLevel) { + logCtx.WithField("generator", requestedGenerator).Debugf("apps from generator: %+v", res) + } else { + logCtx.Infof("generated %d applications", len(res)) + } } return res, applicationSetReason, firstError diff --git a/applicationset/generators/cluster.go b/applicationset/generators/cluster.go index 100e8e45022c8..79765f7bb38e8 100644 --- a/applicationset/generators/cluster.go +++ b/applicationset/generators/cluster.go @@ -48,7 +48,7 @@ func NewClusterGenerator(c client.Client, ctx context.Context, clientset kuberne // GetRequeueAfter never requeue the cluster generator because the `clusterSecretEventHandler` will requeue the appsets // when the cluster secrets change -func (g *ClusterGenerator) GetRequeueAfter(appSetGenerator *argoappsetv1alpha1.ApplicationSetGenerator) time.Duration { +func (g *ClusterGenerator) GetRequeueAfter(_ *argoappsetv1alpha1.ApplicationSetGenerator) time.Duration { return NoRequeueAfter } @@ -57,6 +57,7 @@ func (g *ClusterGenerator) GetTemplate(appSetGenerator *argoappsetv1alpha1.Appli } func (g *ClusterGenerator) GenerateParams(appSetGenerator *argoappsetv1alpha1.ApplicationSetGenerator, appSet *argoappsetv1alpha1.ApplicationSet, _ client.Client) ([]map[string]interface{}, error) { + logCtx := log.WithField("applicationset", appSet.GetName()).WithField("namespace", appSet.GetNamespace()) if appSetGenerator == nil { return nil, EmptyAppSetGeneratorError } @@ -79,7 +80,7 @@ func (g *ClusterGenerator) GenerateParams(appSetGenerator *argoappsetv1alpha1.Ap return nil, nil } - clusterSecrets, err := g.getSecretsByClusterName(appSetGenerator) + clusterSecrets, err := g.getSecretsByClusterName(logCtx, appSetGenerator) if err != nil { return nil, fmt.Errorf("error getting cluster secrets: %w", err) } @@ -89,7 +90,7 @@ func (g *ClusterGenerator) GenerateParams(appSetGenerator *argoappsetv1alpha1.Ap secretsFound := []corev1.Secret{} isFlatMode := appSetGenerator.Clusters.FlatList - log.Debug("Using flat mode = ", isFlatMode, " for cluster generator") + logCtx.Debugf("Using flat mode = %t for cluster generator", isFlatMode) clustersParams := make([]map[string]interface{}, 0) for _, cluster := range clustersFromArgoCD.Items { @@ -116,7 +117,7 @@ func (g *ClusterGenerator) GenerateParams(appSetGenerator *argoappsetv1alpha1.Ap res = append(res, params) } - log.WithField("cluster", "local cluster").Info("matched local cluster") + logCtx.WithField("cluster", "local cluster").Info("matched local cluster") } } @@ -167,7 +168,7 @@ func (g *ClusterGenerator) GenerateParams(appSetGenerator *argoappsetv1alpha1.Ap res = append(res, params) } - log.WithField("cluster", cluster.Name).Info("matched cluster secret") + logCtx.WithField("cluster", cluster.Name).Debug("matched cluster secret") } if isFlatMode { @@ -178,8 +179,7 @@ func (g *ClusterGenerator) GenerateParams(appSetGenerator *argoappsetv1alpha1.Ap return res, nil } -func (g *ClusterGenerator) getSecretsByClusterName(appSetGenerator *argoappsetv1alpha1.ApplicationSetGenerator) (map[string]corev1.Secret, error) { - // List all Clusters: +func (g *ClusterGenerator) getSecretsByClusterName(log *log.Entry, appSetGenerator *argoappsetv1alpha1.ApplicationSetGenerator) (map[string]corev1.Secret, error) { clusterSecretList := &corev1.SecretList{} selector := metav1.AddLabelToSelector(&appSetGenerator.Clusters.Selector, common.LabelKeySecretType, common.LabelValueSecretTypeCluster) @@ -191,7 +191,7 @@ func (g *ClusterGenerator) getSecretsByClusterName(appSetGenerator *argoappsetv1 if err := g.Client.List(context.Background(), clusterSecretList, client.MatchingLabelsSelector{Selector: secretSelector}); err != nil { return nil, err } - log.Debug("clusters matching labels", "count", len(clusterSecretList.Items)) + log.Debugf("clusters matching labels: %d", len(clusterSecretList.Items)) res := map[string]corev1.Secret{} diff --git a/cmd/argocd-application-controller/commands/argocd_application_controller.go b/cmd/argocd-application-controller/commands/argocd_application_controller.go index ddf6a978a42aa..75e3979ba86e3 100644 --- a/cmd/argocd-application-controller/commands/argocd_application_controller.go +++ b/cmd/argocd-application-controller/commands/argocd_application_controller.go @@ -62,6 +62,7 @@ func NewCommand() *cobra.Command { selfHealBackoffTimeoutSeconds int selfHealBackoffFactor int selfHealBackoffCapSeconds int + syncTimeout int statusProcessors int operationProcessors int glogLevel int @@ -189,6 +190,7 @@ func NewCommand() *cobra.Command { time.Duration(appResyncJitter)*time.Second, time.Duration(selfHealTimeoutSeconds)*time.Second, selfHealBackoff, + time.Duration(syncTimeout)*time.Second, time.Duration(repoErrorGracePeriod)*time.Second, metricsPort, metricsCacheExpiration, @@ -256,6 +258,7 @@ func NewCommand() *cobra.Command { command.Flags().IntVar(&selfHealBackoffTimeoutSeconds, "self-heal-backoff-timeout-seconds", env.ParseNumFromEnv("ARGOCD_APPLICATION_CONTROLLER_SELF_HEAL_BACKOFF_TIMEOUT_SECONDS", 2, 0, math.MaxInt32), "Specifies initial timeout of exponential backoff between self heal attempts") command.Flags().IntVar(&selfHealBackoffFactor, "self-heal-backoff-factor", env.ParseNumFromEnv("ARGOCD_APPLICATION_CONTROLLER_SELF_HEAL_BACKOFF_FACTOR", 3, 0, math.MaxInt32), "Specifies factor of exponential timeout between application self heal attempts") command.Flags().IntVar(&selfHealBackoffCapSeconds, "self-heal-backoff-cap-seconds", env.ParseNumFromEnv("ARGOCD_APPLICATION_CONTROLLER_SELF_HEAL_BACKOFF_CAP_SECONDS", 300, 0, math.MaxInt32), "Specifies max timeout of exponential backoff between application self heal attempts") + command.Flags().IntVar(&syncTimeout, "sync-timeout", env.ParseNumFromEnv("ARGOCD_APPLICATION_CONTROLLER_SYNC_TIMEOUT", 0, 0, math.MaxInt32), "Specifies the timeout after which a sync would be terminated. 0 means no timeout (default 0).") command.Flags().Int64Var(&kubectlParallelismLimit, "kubectl-parallelism-limit", env.ParseInt64FromEnv("ARGOCD_APPLICATION_CONTROLLER_KUBECTL_PARALLELISM_LIMIT", 20, 0, math.MaxInt64), "Number of allowed concurrent kubectl fork/execs. Any value less than 1 means no limit.") command.Flags().BoolVar(&repoServerPlaintext, "repo-server-plaintext", env.ParseBoolFromEnv("ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_PLAINTEXT", false), "Disable TLS on connections to repo server") command.Flags().BoolVar(&repoServerStrictTLS, "repo-server-strict-tls", env.ParseBoolFromEnv("ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_STRICT_TLS", false), "Whether to use strict validation of the TLS cert presented by the repo server") diff --git a/cmd/argocd/commands/admin/cluster.go b/cmd/argocd/commands/admin/cluster.go index 7841e5bab8c7b..130b9a750c60f 100644 --- a/cmd/argocd/commands/admin/cluster.go +++ b/cmd/argocd/commands/admin/cluster.go @@ -680,7 +680,7 @@ func NewGenClusterConfigCommand(pathOpts *clientcmd.PathOptions) *cobra.Command command.PersistentFlags().StringVar(&pathOpts.LoadingRules.ExplicitPath, pathOpts.ExplicitFileFlag, pathOpts.LoadingRules.ExplicitPath, "use a particular kubeconfig file") command.Flags().StringVar(&bearerToken, "bearer-token", "", "Authentication token that should be used to access K8S API server") command.Flags().BoolVar(&generateToken, "generate-bearer-token", false, "Generate authentication token that should be used to access K8S API server") - command.Flags().StringVar(&clusterOpts.ServiceAccount, "service-account", "argocd-manager", fmt.Sprintf("System namespace service account to use for kubernetes resource management. If not set then default \"%s\" SA will be used", clusterauth.ArgoCDManagerServiceAccount)) + command.Flags().StringVar(&clusterOpts.ServiceAccount, "service-account", "argocd-manager", fmt.Sprintf("System namespace service account to use for kubernetes resource management. If not set then default %q SA will be used", clusterauth.ArgoCDManagerServiceAccount)) command.Flags().StringVar(&clusterOpts.SystemNamespace, "system-namespace", common.DefaultSystemNamespace, "Use different system namespace") command.Flags().StringVarP(&outputFormat, "output", "o", "yaml", "Output format. One of: json|yaml") command.Flags().StringArrayVar(&labels, "label", nil, "Set metadata labels (e.g. --label key=value)") diff --git a/cmd/argocd/commands/admin/project.go b/cmd/argocd/commands/admin/project.go index 9ba14ab80d961..3570afbb1a61d 100644 --- a/cmd/argocd/commands/admin/project.go +++ b/cmd/argocd/commands/admin/project.go @@ -50,13 +50,13 @@ func NewGenProjectSpecCommand() *cobra.Command { Short: "Generate declarative config for a project", Example: templates.Examples(` # Generate a YAML configuration for a project named "myproject" - argocd admin projects generate-spec myproject + argocd admin proj generate-spec myproject # Generate a JSON configuration for a project named "anotherproject" and specify an output file - argocd admin projects generate-spec anotherproject --output json --file config.json + argocd admin proj generate-spec anotherproject --output json --file config.json # Generate a YAML configuration for a project named "someproject" and write it back to the input file - argocd admin projects generate-spec someproject --inline + argocd admin proj generate-spec someproject --inline `), Run: func(c *cobra.Command, args []string) { @@ -155,10 +155,10 @@ func NewUpdatePolicyRuleCommand() *cobra.Command { Use: "update-role-policy PROJECT_GLOB MODIFICATION ACTION", Short: "Implement bulk project role update. Useful to back-fill existing project policies or remove obsolete actions.", Example: ` # Add policy that allows executing any action (action/*) to roles which name matches to *deployer* in all projects - argocd admin projects update-role-policy '*' set 'action/*' --role '*deployer*' --resource applications --scope '*' --permission allow + argocd admin proj update-role-policy '*' set 'action/*' --role '*deployer*' --resource applications --scope '*' --permission allow # Remove policy that which manages running (action/*) from all roles which name matches *deployer* in all projects - argocd admin projects update-role-policy '*' remove override --role '*deployer*' + argocd admin proj update-role-policy '*' remove override --role '*deployer*' `, Run: func(c *cobra.Command, args []string) { ctx := c.Context() diff --git a/cmd/argocd/commands/cluster.go b/cmd/argocd/commands/cluster.go index 9d71af3a5ce3c..65a3981dabac8 100644 --- a/cmd/argocd/commands/cluster.go +++ b/cmd/argocd/commands/cluster.go @@ -192,7 +192,7 @@ func NewClusterAddCommand(clientOpts *argocdclient.ClientOptions, pathOpts *clie } command.PersistentFlags().StringVar(&pathOpts.LoadingRules.ExplicitPath, pathOpts.ExplicitFileFlag, pathOpts.LoadingRules.ExplicitPath, "use a particular kubeconfig file") command.Flags().BoolVar(&clusterOpts.Upsert, "upsert", false, "Override an existing cluster with the same name even if the spec differs") - command.Flags().StringVar(&clusterOpts.ServiceAccount, "service-account", "", fmt.Sprintf("System namespace service account to use for kubernetes resource management. If not set then default \"%s\" SA will be created", clusterauth.ArgoCDManagerServiceAccount)) + command.Flags().StringVar(&clusterOpts.ServiceAccount, "service-account", "", fmt.Sprintf("System namespace service account to use for kubernetes resource management. If not set then default %q SA will be created", clusterauth.ArgoCDManagerServiceAccount)) command.Flags().StringVar(&clusterOpts.SystemNamespace, "system-namespace", common.DefaultSystemNamespace, "Use different system namespace") command.Flags().BoolVarP(&skipConfirmation, "yes", "y", false, "Skip explicit confirmation") command.Flags().StringArrayVar(&labels, "label", nil, "Set metadata labels (e.g. --label key=value)") diff --git a/controller/appcontroller.go b/controller/appcontroller.go index a5f342763405e..2280474e81754 100644 --- a/controller/appcontroller.go +++ b/controller/appcontroller.go @@ -131,6 +131,7 @@ type ApplicationController struct { statusRefreshJitter time.Duration selfHealTimeout time.Duration selfHealBackOff *wait.Backoff + syncTimeout time.Duration db db.ArgoDB settingsMgr *settings_util.SettingsManager refreshRequestedApps map[string]CompareWith @@ -161,6 +162,7 @@ func NewApplicationController( appResyncJitter time.Duration, selfHealTimeout time.Duration, selfHealBackoff *wait.Backoff, + syncTimeout time.Duration, repoErrorGracePeriod time.Duration, metricsPort int, metricsCacheExpiration time.Duration, @@ -202,6 +204,7 @@ func NewApplicationController( settingsMgr: settingsMgr, selfHealTimeout: selfHealTimeout, selfHealBackOff: selfHealBackoff, + syncTimeout: syncTimeout, clusterSharding: clusterSharding, projByNameCache: sync.Map{}, applicationNamespaces: applicationNamespaces, @@ -377,7 +380,11 @@ func (projCache *appProjCache) GetAppProject(ctx context.Context) (*appv1.AppPro // getAppProj gets the AppProject for the given Application app. func (ctrl *ApplicationController) getAppProj(app *appv1.Application) (*appv1.AppProject, error) { - projCache, _ := ctrl.projByNameCache.LoadOrStore(app.Spec.GetProject(), ctrl.newAppProjCache(app.Spec.GetProject())) + projCache, _ := ctrl.projByNameCache.Load(app.Spec.GetProject()) + if projCache == nil { + projCache = ctrl.newAppProjCache(app.Spec.GetProject()) + ctrl.projByNameCache.Store(app.Spec.GetProject(), projCache) + } proj, err := projCache.(*appProjCache).GetAppProject(context.TODO()) if err != nil { if apierr.IsNotFound(err) { @@ -1373,12 +1380,21 @@ func (ctrl *ApplicationController) processRequestedAppOperation(app *appv1.Appli // Get rid of sync results and null out previous operation completion time state.SyncResult = nil } + } else if ctrl.syncTimeout != time.Duration(0) && time.Now().After(state.StartedAt.Add(ctrl.syncTimeout)) && !terminating { + state.Phase = synccommon.OperationTerminating + state.Message = "operation is terminating due to timeout" + ctrl.setOperationState(app, state) + logCtx.Infof("Terminating in-progress operation due to timeout. Started at: %v, timeout: %v", state.StartedAt, ctrl.syncTimeout) } else { logCtx.Infof("Resuming in-progress operation. phase: %s, message: %s", state.Phase, state.Message) } } else { state = &appv1.OperationState{Phase: synccommon.OperationRunning, Operation: *app.Operation, StartedAt: metav1.Now()} ctrl.setOperationState(app, state) + if ctrl.syncTimeout != time.Duration(0) { + // Schedule a check during which the timeout would be checked. + ctrl.appOperationQueue.AddAfter(ctrl.toAppKey(app.QualifiedName()), ctrl.syncTimeout) + } logCtx.Infof("Initialized new operation: %v", *app.Operation) } ts.AddCheckpoint("initial_operation_stage_ms") diff --git a/controller/appcontroller_test.go b/controller/appcontroller_test.go index 00aec780a5f4b..a515f36583edc 100644 --- a/controller/appcontroller_test.go +++ b/controller/appcontroller_test.go @@ -167,6 +167,7 @@ func newFakeControllerWithResync(data *fakeData, appResyncPeriod time.Duration, time.Second, time.Minute, nil, + 0, time.Second*10, common.DefaultPortArgoCDMetrics, data.metricsCacheExpiration, @@ -2481,3 +2482,54 @@ func TestSelfHealExponentialBackoff(t *testing.T) { }) } } + +func TestSyncTimeout(t *testing.T) { + testCases := []struct { + delta time.Duration + expectedPhase synccommon.OperationPhase + expectedMessage string + }{{ + delta: 2 * time.Minute, + expectedPhase: synccommon.OperationFailed, + expectedMessage: "Operation terminated", + }, { + delta: 30 * time.Second, + expectedPhase: synccommon.OperationSucceeded, + expectedMessage: "successfully synced (no more tasks)", + }} + for i := range testCases { + tc := testCases[i] + t.Run(fmt.Sprintf("test case %d", i), func(t *testing.T) { + app := newFakeApp() + app.Spec.Project = "default" + app.Operation = &v1alpha1.Operation{ + Sync: &v1alpha1.SyncOperation{ + Revision: "HEAD", + }, + } + ctrl := newFakeController(&fakeData{ + apps: []runtime.Object{app, &defaultProj}, + manifestResponses: []*apiclient.ManifestResponse{{ + Manifests: []string{}, + }}, + }, nil) + + ctrl.syncTimeout = time.Minute + app.Status.OperationState = &v1alpha1.OperationState{ + Operation: v1alpha1.Operation{ + Sync: &v1alpha1.SyncOperation{ + Revision: "HEAD", + }, + }, + Phase: synccommon.OperationRunning, + StartedAt: metav1.NewTime(time.Now().Add(-tc.delta)), + } + ctrl.processRequestedAppOperation(app) + + app, err := ctrl.applicationClientset.ArgoprojV1alpha1().Applications(app.ObjectMeta.Namespace).Get(context.Background(), app.ObjectMeta.Name, metav1.GetOptions{}) + require.NoError(t, err) + require.Equal(t, tc.expectedPhase, app.Status.OperationState.Phase) + require.Equal(t, tc.expectedMessage, app.Status.OperationState.Message) + }) + } +} diff --git a/controller/health_test.go b/controller/health_test.go index ec7027da7b70e..3cc3f8d67d816 100644 --- a/controller/health_test.go +++ b/controller/health_test.go @@ -142,7 +142,7 @@ func TestSetApplicationHealth_HealthImproves(t *testing.T) { for _, tc := range testCases { overrides := lua.ResourceHealthOverrides{ lua.GetConfigMapKey(schema.FromAPIVersionAndKind("v1", "Pod")): appv1.ResourceOverride{ - HealthLua: fmt.Sprintf("hs = {}\nhs.status = \"%s\"\nhs.message = \"\"return hs", tc.newStatus), + HealthLua: fmt.Sprintf("hs = {}\nhs.status = %q\nhs.message = \"\"return hs", tc.newStatus), }, } diff --git a/docs/assets/keycloak-add-client-pkce_2.png b/docs/assets/keycloak-add-client-pkce_2.png new file mode 100644 index 0000000000000..eaade14737813 Binary files /dev/null and b/docs/assets/keycloak-add-client-pkce_2.png differ diff --git a/docs/assets/keycloak-authentication-successful.png b/docs/assets/keycloak-authentication-successful.png new file mode 100644 index 0000000000000..7745773967026 Binary files /dev/null and b/docs/assets/keycloak-authentication-successful.png differ diff --git a/docs/assets/keycloak-configure-client-pkce.png b/docs/assets/keycloak-configure-client-pkce.png new file mode 100644 index 0000000000000..6b6e50cefc8c1 Binary files /dev/null and b/docs/assets/keycloak-configure-client-pkce.png differ diff --git a/docs/assets/keycloak-configure-client-pkce_2.png b/docs/assets/keycloak-configure-client-pkce_2.png new file mode 100644 index 0000000000000..ca9ec13c49600 Binary files /dev/null and b/docs/assets/keycloak-configure-client-pkce_2.png differ diff --git a/docs/assets/keycloak-configure-client.png b/docs/assets/keycloak-configure-client.png index cd711dfd602bf..9f967dc33ab0b 100644 Binary files a/docs/assets/keycloak-configure-client.png and b/docs/assets/keycloak-configure-client.png differ diff --git a/docs/operator-manual/argocd-cm.yaml b/docs/operator-manual/argocd-cm.yaml index e00c2f420d240..68b4c0c7302b9 100644 --- a/docs/operator-manual/argocd-cm.yaml +++ b/docs/operator-manual/argocd-cm.yaml @@ -432,7 +432,7 @@ data: name: some-cluster server: https://some-cluster # The maximum size of the payload that can be sent to the webhook server. - webhook.maxPayloadSizeMB: "1024" + webhook.maxPayloadSizeMB: "50" # application.sync.impersonation.enabled enables application sync to use a custom service account, via impersonation. This allows decoupling sync from control-plane service account. application.sync.impersonation.enabled: "false" diff --git a/docs/operator-manual/argocd-cmd-params-cm.yaml b/docs/operator-manual/argocd-cmd-params-cm.yaml index 7abbdb3e37a17..2ff8cd31b9ae2 100644 --- a/docs/operator-manual/argocd-cmd-params-cm.yaml +++ b/docs/operator-manual/argocd-cmd-params-cm.yaml @@ -51,6 +51,8 @@ data: controller.self.heal.timeout.seconds: "2" controller.self.heal.backoff.factor: "3" controller.self.heal.backoff.cap.seconds: "300" + # Specifies a sync timeout for applications. "0" means no timeout (default "0") + controller.sync.timeout.seconds: "0" # Cache expiration for app state (default 1h0m0s) controller.app.state.cache.expiration: "1h0m0s" diff --git a/docs/operator-manual/server-commands/argocd-application-controller.md b/docs/operator-manual/server-commands/argocd-application-controller.md index 07fd9e545c8d4..0fc41c034d449 100644 --- a/docs/operator-manual/server-commands/argocd-application-controller.md +++ b/docs/operator-manual/server-commands/argocd-application-controller.md @@ -77,6 +77,7 @@ argocd-application-controller [flags] --server-side-diff-enabled Feature flag to enable ServerSide diff. Default ("false") --sharding-method string Enables choice of sharding method. Supported sharding methods are : [legacy, round-robin, consistent-hashing] (default "legacy") --status-processors int Number of application status processors (default 20) + --sync-timeout int Specifies the timeout after which a sync would be terminated. 0 means no timeout (default 0). --tls-server-name string If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used. --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use diff --git a/docs/operator-manual/user-management/keycloak.md b/docs/operator-manual/user-management/keycloak.md index 10551321d976a..48eb86f511560 100644 --- a/docs/operator-manual/user-management/keycloak.md +++ b/docs/operator-manual/user-management/keycloak.md @@ -1,14 +1,23 @@ # Keycloak +Keycloak and ArgoCD integration can be configured in two ways with Client authentication and with PKCE. -# Integrating Keycloak and ArgoCD +If you need to authenticate with __argo-cd command line__, you must choose PKCE way. + +* [Keycloak and ArgoCD with Client authentication](#keycloak-and-argocd-with-client-authentication) +* [Keycloak and ArgoCD with PKCE](#keycloak-and-argocd-with-pkce) + +## Keycloak and ArgoCD with Client authentication + +These instructions will take you through the entire process of getting your ArgoCD application authenticating with Keycloak. -These instructions will take you through the entire process of getting your ArgoCD application authenticating with Keycloak. You will create a client within Keycloak and configure ArgoCD to use Keycloak for authentication, using groups set in Keycloak to determine privileges in Argo. -## Creating a new client in Keycloak +### Creating a new client in Keycloak + +First we need to setup a new client. -First we need to setup a new client. Start by logging into your keycloak server, select the realm you want to use (`master` by default) +Start by logging into your keycloak server, select the realm you want to use (`master` by default) and then go to __Clients__ and click the __Create client__ button at the top. ![Keycloak add client](../../assets/keycloak-add-client.png "Keycloak add client") @@ -19,62 +28,97 @@ Enable the __Client authentication__. Configure the client by setting the __Root URL__, __Web origins__, __Admin URL__ to the hostname (https://{hostname}). -Also you can set __Home URL__ to your _/applications_ path and __Valid Post logout redirect URIs__ to "+". +Also you can set __Home URL__ to _/applications_ path and __Valid Post logout redirect URIs__ to "https://{hostname}/applications". The Valid Redirect URIs should be set to https://{hostname}/auth/callback (you can also set the less secure https://{hostname}/* for testing/development purposes, but it's not recommended in production). ![Keycloak configure client](../../assets/keycloak-configure-client.png "Keycloak configure client") -Make sure to click __Save__. There should be a tab called __Credentials__. You can copy the Secret that we'll use in our ArgoCD -configuration. +Make sure to click __Save__. + +There should be a tab called __Credentials__. You can copy the Client Secret that we'll use in our ArgoCD configuration. ![Keycloak client secret](../../assets/keycloak-client-secret.png "Keycloak client secret") -## Configuring the groups claim +### Configuring ArgoCD OIDC -In order for ArgoCD to provide the groups the user is in we need to configure a groups claim that can be included in the authentication token. -To do this we'll start by creating a new __Client Scope__ called _groups_. +Let's start by storing the client secret you generated earlier in the argocd secret _argocd-secret_. -![Keycloak add scope](../../assets/keycloak-add-scope.png "Keycloak add scope") +You can patch it with value copied previously: +```bash +kubectl -n argo-cd patch secret argocd-secret --patch='{"stringData": { "oidc.keycloak.clientSecret": "" }}' +``` -Once you've created the client scope you can now add a Token Mapper which will add the groups claim to the token when the client requests -the groups scope. In the Tab "Mappers", click on "Configure a new mapper" and choose __Group Membership__. -Make sure to set the __Name__ as well as the __Token Claim Name__ to _groups_. Also disable the "Full group path". +Now we can configure the config map and add the oidc configuration to enable our keycloak authentication. +You can use `$ kubectl edit configmap argocd-cm`. -![Keycloak groups mapper](../../assets/keycloak-groups-mapper.png "Keycloak groups mapper") +Your ConfigMap should look like this: -We can now configure the client to provide the _groups_ scope. Go back to the client we've created earlier and go to the Tab "Client Scopes". -Click on "Add client scope", choose the _groups_ scope and add it either to the __Default__ or to the __Optional__ Client Scope. If you put it in the Optional -category you will need to make sure that ArgoCD requests the scope in its OIDC configuration. Since we will always want group information, I recommend -using the Default category. +```yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: argocd-cm +data: + url: https://argocd.example.com + oidc.config: | + name: Keycloak + issuer: https://keycloak.example.com/realms/master + clientID: argocd + clientSecret: $oidc.keycloak.clientSecret + requestedScopes: ["openid", "profile", "email", "groups"] +``` -![Keycloak client scope](../../assets/keycloak-client-scope.png "Keycloak client scope") +Make sure that: -Create a group called _ArgoCDAdmins_ and have your current user join the group. +- __issuer__ ends with the correct realm (in this example _master_) +- __issuer__ on Keycloak releases older than version 17 the URL must include /auth (in this example /auth/realms/master) +- __clientID__ is set to the Client ID you configured in Keycloak +- __clientSecret__ points to the right key you created in the _argocd-secret_ Secret +- __requestedScopes__ contains the _groups_ claim if you didn't add it to the Default scopes -![Keycloak user group](../../assets/keycloak-user-group.png "Keycloak user group") +## Keycloak and ArgoCD with PKCE -## Configuring ArgoCD OIDC +These instructions will take you through the entire process of getting your ArgoCD application authenticating with Keycloak. -Let's start by storing the client secret you generated earlier in the argocd secret _argocd-secret_. +You will create a client within Keycloak and configure ArgoCD to use Keycloak for authentication, using groups set in Keycloak +to determine privileges in Argo. -1. First you'll need to encode the client secret in base64: `$ echo -n '83083958-8ec6-47b0-a411-a8c55381fbd2' | base64` -2. Then you can edit the secret and add the base64 value to a new key called _oidc.keycloak.clientSecret_ using `$ kubectl edit secret argocd-secret`. - -Your Secret should look something like this: +You will also be able to authenticate using argo-cd command line. -```yaml -apiVersion: v1 -kind: Secret -metadata: - name: argocd-secret -data: - ... - oidc.keycloak.clientSecret: ODMwODM5NTgtOGVjNi00N2IwLWE0MTEtYThjNTUzODFmYmQy - ... -``` +### Creating a new client in Keycloak + +First we need to setup a new client. +Start by logging into your keycloak server, select the realm you want to use (`master` by default) +and then go to __Clients__ and click the __Create client__ button at the top. + +![Keycloak add client](../../assets/keycloak-add-client.png "Keycloak add client") + +Leave default values. + +![Keycloak add client Step 2](../../assets/keycloak-add-client-pkce_2.png "Keycloak add client Step 2") + +Configure the client by setting the __Root URL__, __Web origins__, __Admin URL__ to the hostname (https://{hostname}). + +Also you can set __Home URL__ to _/applications_ path and __Valid Post logout redirect URIs__ to "https://{hostname}/applications". + +The Valid Redirect URIs should be set to: +- http://localhost:8085/auth/callback (needed for argo-cd cli, depends on value from [--sso-port](../../user-guide/commands/argocd_login.md)) +- https://{hostname}/auth/callback +- https://{hostname}/pkce/verify + +![Keycloak configure client](../../assets/keycloak-configure-client-pkce.png "Keycloak configure client") + +Make sure to click __Save__. + +Now go to a tab called __Advanced__, look for parameter named __Proof Key for Code Exchange Code Challenge Method__ and set it to __S256__ + +![Keycloak configure client Step 2](../../assets/keycloak-configure-client-pkce_2.png "Keycloak configure client Step 2") +Make sure to click __Save__. + +### Configuring ArgoCD OIDC Now we can configure the config map and add the oidc configuration to enable our keycloak authentication. You can use `$ kubectl edit configmap argocd-cm`. @@ -91,7 +135,7 @@ data: name: Keycloak issuer: https://keycloak.example.com/realms/master clientID: argocd - clientSecret: $oidc.keycloak.clientSecret + enablePKCEAuthentication: true requestedScopes: ["openid", "profile", "email", "groups"] ``` @@ -100,10 +144,44 @@ Make sure that: - __issuer__ ends with the correct realm (in this example _master_) - __issuer__ on Keycloak releases older than version 17 the URL must include /auth (in this example /auth/realms/master) - __clientID__ is set to the Client ID you configured in Keycloak -- __clientSecret__ points to the right key you created in the _argocd-secret_ Secret +- __enablePKCEAuthentication__ must be set to true to enable correct ArgoCD behaviour with PKCE - __requestedScopes__ contains the _groups_ claim if you didn't add it to the Default scopes -## Configuring ArgoCD Policy +## Configuring the groups claim + +In order for ArgoCD to provide the groups the user is in we need to configure a groups claim that can be included in the authentication token. + +To do this we'll start by creating a new __Client Scope__ called _groups_. + +![Keycloak add scope](../../assets/keycloak-add-scope.png "Keycloak add scope") + +Once you've created the client scope you can now add a Token Mapper which will add the groups claim to the token when the client requests +the groups scope. + +In the Tab "Mappers", click on "Configure a new mapper" and choose __Group Membership__. + +Make sure to set the __Name__ as well as the __Token Claim Name__ to _groups_. Also disable the "Full group path". + +![Keycloak groups mapper](../../assets/keycloak-groups-mapper.png "Keycloak groups mapper") + +We can now configure the client to provide the _groups_ scope. + +Go back to the client we've created earlier and go to the Tab "Client Scopes". + +Click on "Add client scope", choose the _groups_ scope and add it either to the __Default__ or to the __Optional__ Client Scope. + +If you put it in the Optional +category you will need to make sure that ArgoCD requests the scope in its OIDC configuration. +Since we will always want group information, I recommend +using the Default category. + +![Keycloak client scope](../../assets/keycloak-client-scope.png "Keycloak client scope") + +Create a group called _ArgoCDAdmins_ and have your current user join the group. + +![Keycloak user group](../../assets/keycloak-user-group.png "Keycloak user group") + +## Configuring ArgoCD Policy Now that we have an authentication that provides groups we want to apply a policy to these groups. We can modify the _argocd-rbac-cm_ ConfigMap using `$ kubectl edit configmap argocd-rbac-cm`. @@ -126,8 +204,23 @@ You can now login using our new Keycloak OIDC authentication: ![Keycloak ArgoCD login](../../assets/keycloak-login.png "Keycloak ArgoCD login") +If you have used PKCE method, you can also authenticate using command line: +```bash +argocd login argocd.example.com --sso --grpc-web +``` + +argocd cli will start to listen on localhost:8085 and open your web browser to allow you to authenticate with Keycloak. + +Once done, you should see + +![Authentication successful!](../../assets/keycloak-authentication-successful.png "Authentication successful!") + ## Troubleshoot If ArgoCD auth returns 401 or when the login attempt leads to the loop, then restart the argocd-server pod. ``` kubectl rollout restart deployment argocd-server -n argocd ``` + +If you migrate from Client authentification to PKCE, you can have the following error `invalid_request: Missing parameter: code_challenge_method`. + +It could be a redirect issue, try in private browsing or clean browser cookies. diff --git a/docs/operator-manual/webhook.md b/docs/operator-manual/webhook.md index 92789e983d3b3..f57918583e3ba 100644 --- a/docs/operator-manual/webhook.md +++ b/docs/operator-manual/webhook.md @@ -19,7 +19,7 @@ URL configured in the Git provider should use the `/api/webhook` endpoint of you (e.g. `https://argocd.example.com/api/webhook`). If you wish to use a shared secret, input an arbitrary value in the secret. This value will be used when configuring the webhook in the next step. -To prevent DDoS attacks with unauthenticated webhook events (the `/api/webhook` endpoint currently lacks rate limiting protection), it is recommended to limit the payload size. You can achieve this by configuring the `argocd-cm` ConfigMap with the `webhook.maxPayloadSizeMB` attribute. The default value is 1GB. +To prevent DDoS attacks with unauthenticated webhook events (the `/api/webhook` endpoint currently lacks rate limiting protection), it is recommended to limit the payload size. You can achieve this by configuring the `argocd-cm` ConfigMap with the `webhook.maxPayloadSizeMB` attribute. The default value is 50MB. ## Github diff --git a/docs/snyk/index.md b/docs/snyk/index.md index 7a01eebbd57cf..893eb93315f1e 100644 --- a/docs/snyk/index.md +++ b/docs/snyk/index.md @@ -18,7 +18,7 @@ recent minor releases. | [dex:v2.41.1](master/ghcr.io_dexidp_dex_v2.41.1.html) | 0 | 0 | 0 | 2 | | [haproxy:2.6.17-alpine](master/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html) | 0 | 0 | 2 | 4 | | [redis:7.0.15-alpine](master/public.ecr.aws_docker_library_redis_7.0.15-alpine.html) | 0 | 0 | 0 | 1 | -| [argocd:latest](master/quay.io_argoproj_argocd_latest.html) | 0 | 0 | 4 | 9 | +| [argocd:latest](master/quay.io_argoproj_argocd_latest.html) | 0 | 0 | 3 | 10 | | [redis:7.0.15-alpine](master/redis_7.0.15-alpine.html) | 0 | 0 | 0 | 1 | | [install.yaml](master/argocd-iac-install.html) | - | - | - | - | | [namespace-install.yaml](master/argocd-iac-namespace-install.html) | - | - | - | - | @@ -32,7 +32,7 @@ recent minor releases. | [dex:v2.41.1](v2.13.1/ghcr.io_dexidp_dex_v2.41.1.html) | 0 | 0 | 0 | 2 | | [haproxy:2.6.17-alpine](v2.13.1/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html) | 0 | 0 | 2 | 4 | | [redis:7.0.15-alpine](v2.13.1/public.ecr.aws_docker_library_redis_7.0.15-alpine.html) | 0 | 0 | 0 | 1 | -| [argocd:v2.13.1](v2.13.1/quay.io_argoproj_argocd_v2.13.1.html) | 0 | 0 | 4 | 9 | +| [argocd:v2.13.1](v2.13.1/quay.io_argoproj_argocd_v2.13.1.html) | 0 | 0 | 3 | 10 | | [redis:7.0.15-alpine](v2.13.1/redis_7.0.15-alpine.html) | 0 | 0 | 0 | 1 | | [install.yaml](v2.13.1/argocd-iac-install.html) | - | - | - | - | | [namespace-install.yaml](v2.13.1/argocd-iac-namespace-install.html) | - | - | - | - | @@ -46,7 +46,7 @@ recent minor releases. | [dex:v2.38.0](v2.12.7/ghcr.io_dexidp_dex_v2.38.0.html) | 0 | 0 | 6 | 7 | | [haproxy:2.6.17-alpine](v2.12.7/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html) | 0 | 0 | 2 | 4 | | [redis:7.0.15-alpine](v2.12.7/public.ecr.aws_docker_library_redis_7.0.15-alpine.html) | 0 | 0 | 0 | 1 | -| [argocd:v2.12.7](v2.12.7/quay.io_argoproj_argocd_v2.12.7.html) | 0 | 0 | 4 | 10 | +| [argocd:v2.12.7](v2.12.7/quay.io_argoproj_argocd_v2.12.7.html) | 0 | 0 | 3 | 11 | | [redis:7.0.15-alpine](v2.12.7/redis_7.0.15-alpine.html) | 0 | 0 | 0 | 1 | | [install.yaml](v2.12.7/argocd-iac-install.html) | - | - | - | - | | [namespace-install.yaml](v2.12.7/argocd-iac-namespace-install.html) | - | - | - | - | @@ -59,7 +59,7 @@ recent minor releases. | [ui/yarn.lock](v2.11.12/argocd-test.html) | 0 | 0 | 1 | 0 | | [dex:v2.38.0](v2.11.12/ghcr.io_dexidp_dex_v2.38.0.html) | 0 | 0 | 6 | 7 | | [haproxy:2.6.14-alpine](v2.11.12/haproxy_2.6.14-alpine.html) | 0 | 1 | 7 | 7 | -| [argocd:v2.11.12](v2.11.12/quay.io_argoproj_argocd_v2.11.12.html) | 0 | 0 | 5 | 19 | +| [argocd:v2.11.12](v2.11.12/quay.io_argoproj_argocd_v2.11.12.html) | 0 | 0 | 4 | 20 | | [redis:7.0.15-alpine](v2.11.12/redis_7.0.15-alpine.html) | 0 | 0 | 0 | 1 | | [install.yaml](v2.11.12/argocd-iac-install.html) | - | - | - | - | | [namespace-install.yaml](v2.11.12/argocd-iac-namespace-install.html) | - | - | - | - | diff --git a/docs/snyk/master/argocd-iac-install.html b/docs/snyk/master/argocd-iac-install.html index e01b8745e248d..0dffc06728edd 100644 --- a/docs/snyk/master/argocd-iac-install.html +++ b/docs/snyk/master/argocd-iac-install.html @@ -456,7 +456,7 @@

Snyk test report

-

November 24th 2024, 12:23:21 am (UTC+00:00)

+

December 8th 2024, 12:23:04 am (UTC+00:00)

Scanned the following path: @@ -507,7 +507,7 @@

Role or ClusterRole with dangerous permissions

  • - Line number: 22702 + Line number: 22859
    • @@ -553,7 +553,7 @@

    Role or ClusterRole with dangerous permissions

  • - Line number: 22383 + Line number: 22540
    • @@ -599,7 +599,7 @@

    Role or ClusterRole with dangerous permissions

  • - Line number: 22470 + Line number: 22627
    • @@ -645,7 +645,7 @@

    Role or ClusterRole with dangerous permissions

  • - Line number: 22498 + Line number: 22655
    • @@ -691,7 +691,7 @@

    Role or ClusterRole with dangerous permissions

  • - Line number: 22528 + Line number: 22685
    • @@ -737,7 +737,7 @@

    Role or ClusterRole with dangerous permissions

  • - Line number: 22546 + Line number: 22703
    • @@ -783,7 +783,7 @@

    Role or ClusterRole with dangerous permissions

  • - Line number: 22564 + Line number: 22721
    • @@ -829,7 +829,7 @@

    Role or ClusterRole with dangerous permissions

  • - Line number: 22586 + Line number: 22743
    • @@ -881,7 +881,7 @@

    Container could be running with outdated image

  • - Line number: 23677 + Line number: 23833
    • @@ -933,7 +933,7 @@

    Container could be running with outdated image

  • - Line number: 23984 + Line number: 24140
    • @@ -991,7 +991,7 @@

    Container has no CPU limit

  • - Line number: 23196 + Line number: 23352
    • @@ -1049,7 +1049,7 @@

    Container has no CPU limit

  • - Line number: 23479 + Line number: 23635
    • @@ -1107,7 +1107,7 @@

    Container has no CPU limit

  • - Line number: 23433 + Line number: 23589
    • @@ -1165,7 +1165,7 @@

    Container has no CPU limit

  • - Line number: 23541 + Line number: 23697
    • @@ -1223,7 +1223,7 @@

    Container has no CPU limit

  • - Line number: 23648 + Line number: 23804
    • @@ -1281,7 +1281,7 @@

    Container has no CPU limit

  • - Line number: 23672 + Line number: 23828
    • @@ -1339,7 +1339,7 @@

    Container has no CPU limit

  • - Line number: 23984 + Line number: 24140
    • @@ -1397,7 +1397,7 @@

    Container has no CPU limit

  • - Line number: 23731 + Line number: 23887
    • @@ -1455,7 +1455,7 @@

    Container has no CPU limit

  • - Line number: 24071 + Line number: 24227
    • @@ -1513,7 +1513,7 @@

    Container has no CPU limit

  • - Line number: 24463 + Line number: 24619
    • @@ -1565,7 +1565,7 @@

    Container is running with multiple open ports

  • - Line number: 23459 + Line number: 23615
    • @@ -1617,7 +1617,7 @@

    Container is running without liveness probe

  • - Line number: 23196 + Line number: 23352
    • @@ -1669,7 +1669,7 @@

    Container is running without liveness probe

  • - Line number: 23433 + Line number: 23589
    • @@ -1721,7 +1721,7 @@

    Container is running without liveness probe

  • - Line number: 23648 + Line number: 23804
    • @@ -1779,7 +1779,7 @@

    Container is running without memory limit

  • - Line number: 23196 + Line number: 23352
    • @@ -1837,7 +1837,7 @@

    Container is running without memory limit

  • - Line number: 23433 + Line number: 23589
    • @@ -1895,7 +1895,7 @@

    Container is running without memory limit

  • - Line number: 23479 + Line number: 23635
    • @@ -1953,7 +1953,7 @@

    Container is running without memory limit

  • - Line number: 23541 + Line number: 23697
    • @@ -2011,7 +2011,7 @@

    Container is running without memory limit

  • - Line number: 23648 + Line number: 23804
    • @@ -2069,7 +2069,7 @@

    Container is running without memory limit

  • - Line number: 23672 + Line number: 23828
    • @@ -2127,7 +2127,7 @@

    Container is running without memory limit

  • - Line number: 23984 + Line number: 24140
    • @@ -2185,7 +2185,7 @@

    Container is running without memory limit

  • - Line number: 23731 + Line number: 23887
    • @@ -2243,7 +2243,7 @@

    Container is running without memory limit

  • - Line number: 24071 + Line number: 24227
    • @@ -2301,7 +2301,7 @@

    Container is running without memory limit

  • - Line number: 24463 + Line number: 24619
    • @@ -2357,7 +2357,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 23355 + Line number: 23511
    • @@ -2413,7 +2413,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 23487 + Line number: 23643
    • @@ -2469,7 +2469,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 23462 + Line number: 23618
    • @@ -2525,7 +2525,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 23580 + Line number: 23736
    • @@ -2581,7 +2581,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 23665 + Line number: 23821
    • @@ -2637,7 +2637,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 23679 + Line number: 23835
    • @@ -2693,7 +2693,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 23991 + Line number: 24147
    • @@ -2749,7 +2749,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 23957 + Line number: 24113
    • @@ -2805,7 +2805,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 24362 + Line number: 24518
    • @@ -2861,7 +2861,7 @@

    Container's or Pod's UID could clash with hos
  • - Line number: 24684 + Line number: 24840
    • diff --git a/docs/snyk/master/argocd-iac-namespace-install.html b/docs/snyk/master/argocd-iac-namespace-install.html index 8c0a8440e048d..9d981c5ed4b14 100644 --- a/docs/snyk/master/argocd-iac-namespace-install.html +++ b/docs/snyk/master/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:23:32 am (UTC+00:00)

    +

    December 8th 2024, 12:23:14 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/master/argocd-test.html b/docs/snyk/master/argocd-test.html index 872544114183c..0e34c9d221c4f 100644 --- a/docs/snyk/master/argocd-test.html +++ b/docs/snyk/master/argocd-test.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:21:01 am (UTC+00:00)

    +

    December 8th 2024, 12:20:56 am (UTC+00:00)

    Scanned the following paths: @@ -470,7 +470,7 @@

    Snyk test report

    7 known vulnerabilities
    26 vulnerable dependency paths
    -
    2150 dependencies
    +
    2158 dependencies
    @@ -504,7 +504,7 @@

    LGPL-3.0 license

  • Introduced through: - github.com/argoproj/argo-cd/v2@0.0.0, github.com/Azure/kubelogin/pkg/token@0.1.4 and others + github.com/argoproj/argo-cd/v2@0.0.0, github.com/Azure/kubelogin/pkg/token@0.1.5 and others
    • @@ -518,9 +518,9 @@

    Detailed paths

    Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › - github.com/Azure/kubelogin/pkg/token@0.1.4 + github.com/Azure/kubelogin/pkg/token@0.1.5 › - github.com/Azure/kubelogin/pkg/internal/token@0.1.4 + github.com/Azure/kubelogin/pkg/internal/token@0.1.5 › gopkg.in/retry.v1@1.0.3 diff --git a/docs/snyk/master/ghcr.io_dexidp_dex_v2.41.1.html b/docs/snyk/master/ghcr.io_dexidp_dex_v2.41.1.html index 83d429e788564..bd67d192d8784 100644 --- a/docs/snyk/master/ghcr.io_dexidp_dex_v2.41.1.html +++ b/docs/snyk/master/ghcr.io_dexidp_dex_v2.41.1.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:21:11 am (UTC+00:00)

    +

    December 8th 2024, 12:21:06 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/master/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html b/docs/snyk/master/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html index c1e421711feef..4f68c7b9cc6f9 100644 --- a/docs/snyk/master/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html +++ b/docs/snyk/master/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:21:18 am (UTC+00:00)

    +

    December 8th 2024, 12:21:11 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/master/public.ecr.aws_docker_library_redis_7.0.15-alpine.html b/docs/snyk/master/public.ecr.aws_docker_library_redis_7.0.15-alpine.html index 6b7bc8efb5549..8453a03fac230 100644 --- a/docs/snyk/master/public.ecr.aws_docker_library_redis_7.0.15-alpine.html +++ b/docs/snyk/master/public.ecr.aws_docker_library_redis_7.0.15-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:21:25 am (UTC+00:00)

    +

    December 8th 2024, 12:21:15 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/master/quay.io_argoproj_argocd_latest.html b/docs/snyk/master/quay.io_argoproj_argocd_latest.html index e7f4b8d0ba3c3..18c692c3c0536 100644 --- a/docs/snyk/master/quay.io_argoproj_argocd_latest.html +++ b/docs/snyk/master/quay.io_argoproj_argocd_latest.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:21:49 am (UTC+00:00)

    +

    December 8th 2024, 12:21:33 am (UTC+00:00)

    Scanned the following paths: @@ -472,7 +472,7 @@

    Snyk test report

    20 known vulnerabilities
    100 vulnerable dependency paths
    -
    2359 dependencies
    +
    2378 dependencies
    @@ -707,6 +707,8 @@

    References

  • http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-10041
  • https://access.redhat.com/security/cve/CVE-2024-10041
  • https://bugzilla.redhat.com/show_bug.cgi?id=2319212
    • +
  • https://access.redhat.com/errata/RHSA-2024:9941
    • +
  • https://access.redhat.com/errata/RHSA-2024:10379
    • @@ -951,170 +953,6 @@

    References

    More about this vulnerability

    -
    -
    -

    Information Exposure

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd › Dockerfile -
      • -
    • - Package Manager: ubuntu:24.04 -
      • -
    • - Vulnerable module: - - libgcrypt20 -
      • - -
    • Introduced through: - - docker-image|quay.io/argoproj/argocd@latest and libgcrypt20@1.10.3-2build1 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - gnupg2/dirmngr@2.4.4-2ubuntu17 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - gnupg2/gpg@2.4.4-2ubuntu17 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - gnupg2/gpg-agent@2.4.4-2ubuntu17 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - apt@2.7.14build2 - › - apt/libapt-pkg6.0t64@2.7.14build2 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - apt@2.7.14build2 - › - gnupg2/gpgv@2.4.4-2ubuntu17 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - gnupg2/gpg@2.4.4-2ubuntu17 - › - gnupg2/gpgconf@2.4.4-2ubuntu17 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@latest - › - apt@2.7.14build2 - › - adduser@3.137ubuntu1 - › - shadow/passwd@1:4.13+dfsg1-4ubuntu3.2 - › - pam/libpam-modules@1.5.3-5ubuntu5.1 - › - systemd/libsystemd0@255.4-1ubuntu8.4 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Ubuntu. - See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    -

    A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

    -

    Remediation

    -

    There is no fixed version for Ubuntu:24.04 libgcrypt20.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    -

    CVE-2024-26462

    @@ -2086,6 +1924,170 @@

    References

    More about this vulnerability

    +
    +
    +

    Information Exposure

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + libgcrypt20 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@latest and libgcrypt20@1.10.3-2build1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + gnupg2/dirmngr@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + gnupg2/gpg@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + gnupg2/gpg-agent@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + apt@2.7.14build2 + › + apt/libapt-pkg6.0t64@2.7.14build2 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + apt@2.7.14build2 + › + gnupg2/gpgv@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + gnupg2/gpg@2.4.4-2ubuntu17 + › + gnupg2/gpgconf@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@latest + › + apt@2.7.14build2 + › + adduser@3.137ubuntu1 + › + shadow/passwd@1:4.13+dfsg1-4ubuntu3.2 + › + pam/libpam-modules@1.5.3-5ubuntu5.1 + › + systemd/libsystemd0@255.4-1ubuntu8.4 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Ubuntu. + See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    +

    A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 libgcrypt20.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    +

    CVE-2024-26458

    diff --git a/docs/snyk/master/redis_7.0.15-alpine.html b/docs/snyk/master/redis_7.0.15-alpine.html index 64ae2496a6105..3db408ad152bb 100644 --- a/docs/snyk/master/redis_7.0.15-alpine.html +++ b/docs/snyk/master/redis_7.0.15-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:21:54 am (UTC+00:00)

    +

    December 8th 2024, 12:21:38 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/v2.11.12/argocd-iac-install.html b/docs/snyk/v2.11.12/argocd-iac-install.html index 13491276056dd..8098344f87387 100644 --- a/docs/snyk/v2.11.12/argocd-iac-install.html +++ b/docs/snyk/v2.11.12/argocd-iac-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:31:10 am (UTC+00:00)

    +

    December 8th 2024, 12:30:13 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.11.12/argocd-iac-namespace-install.html b/docs/snyk/v2.11.12/argocd-iac-namespace-install.html index 4f8893733872b..191e8f076b21d 100644 --- a/docs/snyk/v2.11.12/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.11.12/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:31:20 am (UTC+00:00)

    +

    December 8th 2024, 12:30:22 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.11.12/argocd-test.html b/docs/snyk/v2.11.12/argocd-test.html index 916dcc1127b0c..7dbbfb552e48a 100644 --- a/docs/snyk/v2.11.12/argocd-test.html +++ b/docs/snyk/v2.11.12/argocd-test.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:29:08 am (UTC+00:00)

    +

    December 8th 2024, 12:28:19 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/v2.11.12/ghcr.io_dexidp_dex_v2.38.0.html b/docs/snyk/v2.11.12/ghcr.io_dexidp_dex_v2.38.0.html index 80f6bb02175bc..7706e17895a5d 100644 --- a/docs/snyk/v2.11.12/ghcr.io_dexidp_dex_v2.38.0.html +++ b/docs/snyk/v2.11.12/ghcr.io_dexidp_dex_v2.38.0.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:29:16 am (UTC+00:00)

    +

    December 8th 2024, 12:28:28 am (UTC+00:00)

    Scanned the following paths: @@ -777,15 +777,15 @@

    Remediation

    References

    @@ -2817,6 +2817,7 @@

    Remediation

    References

    diff --git a/docs/snyk/v2.11.12/haproxy_2.6.14-alpine.html b/docs/snyk/v2.11.12/haproxy_2.6.14-alpine.html index e18007f91e5cb..41c0079895977 100644 --- a/docs/snyk/v2.11.12/haproxy_2.6.14-alpine.html +++ b/docs/snyk/v2.11.12/haproxy_2.6.14-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:29:22 am (UTC+00:00)

    +

    December 8th 2024, 12:28:32 am (UTC+00:00)

    Scanned the following path: @@ -1032,15 +1032,15 @@

    Remediation

    References

    @@ -1325,6 +1325,7 @@

    Remediation

    References

    diff --git a/docs/snyk/v2.11.12/quay.io_argoproj_argocd_v2.11.12.html b/docs/snyk/v2.11.12/quay.io_argoproj_argocd_v2.11.12.html index df9d164ab2f47..316876f7f9bfe 100644 --- a/docs/snyk/v2.11.12/quay.io_argoproj_argocd_v2.11.12.html +++ b/docs/snyk/v2.11.12/quay.io_argoproj_argocd_v2.11.12.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:29:44 am (UTC+00:00)

    +

    December 8th 2024, 12:28:51 am (UTC+00:00)

    Scanned the following paths: @@ -872,6 +872,8 @@

    References

  • http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-10041
  • https://access.redhat.com/security/cve/CVE-2024-10041
  • https://bugzilla.redhat.com/show_bug.cgi?id=2319212
    • +
  • https://access.redhat.com/errata/RHSA-2024:9941
    • +
  • https://access.redhat.com/errata/RHSA-2024:10379
    • @@ -1106,220 +1108,6 @@

    References

    More about this vulnerability

    -
    -
    -

    Information Exposure

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Manifest file: quay.io/argoproj/argocd:v2.11.12/argoproj/argocd › Dockerfile -
      • -
    • - Package Manager: ubuntu:22.04 -
      • -
    • - Vulnerable module: - - libgcrypt20 -
      • - -
    • Introduced through: - - docker-image|quay.io/argoproj/argocd@v2.11.12 and libgcrypt20@1.9.4-3ubuntu3 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.11.12 - › - libgcrypt20@1.9.4-3ubuntu3 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.11.12 - › - gnupg2/dirmngr@2.2.27-3ubuntu2.1 - › - libgcrypt20@1.9.4-3ubuntu3 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.11.12 - › - gnupg2/gpg@2.2.27-3ubuntu2.1 - › - libgcrypt20@1.9.4-3ubuntu3 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.11.12 - › - apt@2.4.13 - › - apt/libapt-pkg6.0@2.4.13 - › - libgcrypt20@1.9.4-3ubuntu3 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.11.12 - › - apt@2.4.13 - › - gnupg2/gpgv@2.2.27-3ubuntu2.1 - › - libgcrypt20@1.9.4-3ubuntu3 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.11.12 - › - gnupg2/gpg@2.2.27-3ubuntu2.1 - › - gnupg2/gpgconf@2.2.27-3ubuntu2.1 - › - libgcrypt20@1.9.4-3ubuntu3 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.11.12 - › - gnupg2/gnupg@2.2.27-3ubuntu2.1 - › - gnupg2/gnupg-utils@2.2.27-3ubuntu2.1 - › - libgcrypt20@1.9.4-3ubuntu3 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.11.12 - › - gnupg2/gnupg@2.2.27-3ubuntu2.1 - › - gnupg2/gpg-agent@2.2.27-3ubuntu2.1 - › - libgcrypt20@1.9.4-3ubuntu3 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.11.12 - › - gnupg2/gnupg@2.2.27-3ubuntu2.1 - › - gnupg2/gpg-wks-client@2.2.27-3ubuntu2.1 - › - libgcrypt20@1.9.4-3ubuntu3 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.11.12 - › - gnupg2/gnupg@2.2.27-3ubuntu2.1 - › - gnupg2/gpg-wks-server@2.2.27-3ubuntu2.1 - › - libgcrypt20@1.9.4-3ubuntu3 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.11.12 - › - gnupg2/gnupg@2.2.27-3ubuntu2.1 - › - gnupg2/gpgsm@2.2.27-3ubuntu2.1 - › - libgcrypt20@1.9.4-3ubuntu3 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.11.12 - › - apt@2.4.13 - › - apt/libapt-pkg6.0@2.4.13 - › - systemd/libsystemd0@249.11-0ubuntu3.12 - › - libgcrypt20@1.9.4-3ubuntu3 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Ubuntu. - See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    -

    A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

    -

    Remediation

    -

    There is no fixed version for Ubuntu:22.04 libgcrypt20.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    -

    CVE-2024-26462

    @@ -3631,6 +3419,220 @@

    References

    More about this vulnerability

    +
    +
    +

    Information Exposure

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.11.12/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:22.04 +
      • +
    • + Vulnerable module: + + libgcrypt20 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.11.12 and libgcrypt20@1.9.4-3ubuntu3 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.11.12 + › + libgcrypt20@1.9.4-3ubuntu3 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.11.12 + › + gnupg2/dirmngr@2.2.27-3ubuntu2.1 + › + libgcrypt20@1.9.4-3ubuntu3 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.11.12 + › + gnupg2/gpg@2.2.27-3ubuntu2.1 + › + libgcrypt20@1.9.4-3ubuntu3 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.11.12 + › + apt@2.4.13 + › + apt/libapt-pkg6.0@2.4.13 + › + libgcrypt20@1.9.4-3ubuntu3 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.11.12 + › + apt@2.4.13 + › + gnupg2/gpgv@2.2.27-3ubuntu2.1 + › + libgcrypt20@1.9.4-3ubuntu3 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.11.12 + › + gnupg2/gpg@2.2.27-3ubuntu2.1 + › + gnupg2/gpgconf@2.2.27-3ubuntu2.1 + › + libgcrypt20@1.9.4-3ubuntu3 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.11.12 + › + gnupg2/gnupg@2.2.27-3ubuntu2.1 + › + gnupg2/gnupg-utils@2.2.27-3ubuntu2.1 + › + libgcrypt20@1.9.4-3ubuntu3 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.11.12 + › + gnupg2/gnupg@2.2.27-3ubuntu2.1 + › + gnupg2/gpg-agent@2.2.27-3ubuntu2.1 + › + libgcrypt20@1.9.4-3ubuntu3 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.11.12 + › + gnupg2/gnupg@2.2.27-3ubuntu2.1 + › + gnupg2/gpg-wks-client@2.2.27-3ubuntu2.1 + › + libgcrypt20@1.9.4-3ubuntu3 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.11.12 + › + gnupg2/gnupg@2.2.27-3ubuntu2.1 + › + gnupg2/gpg-wks-server@2.2.27-3ubuntu2.1 + › + libgcrypt20@1.9.4-3ubuntu3 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.11.12 + › + gnupg2/gnupg@2.2.27-3ubuntu2.1 + › + gnupg2/gpgsm@2.2.27-3ubuntu2.1 + › + libgcrypt20@1.9.4-3ubuntu3 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.11.12 + › + apt@2.4.13 + › + apt/libapt-pkg6.0@2.4.13 + › + systemd/libsystemd0@249.11-0ubuntu3.12 + › + libgcrypt20@1.9.4-3ubuntu3 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Ubuntu. + See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    +

    A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:22.04 libgcrypt20.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    +

    Integer Overflow or Wraparound

    @@ -5105,7 +5107,7 @@

    References

    -

    CVE-2024-9681

    +

    Insufficient Comparison

    diff --git a/docs/snyk/v2.11.12/redis_7.0.15-alpine.html b/docs/snyk/v2.11.12/redis_7.0.15-alpine.html index 4fd4c36b2997b..a6a6bc8e0e1f5 100644 --- a/docs/snyk/v2.11.12/redis_7.0.15-alpine.html +++ b/docs/snyk/v2.11.12/redis_7.0.15-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:29:49 am (UTC+00:00)

    +

    December 8th 2024, 12:28:55 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/v2.12.7/argocd-iac-install.html b/docs/snyk/v2.12.7/argocd-iac-install.html index e37b4101fd709..5b917695af4b7 100644 --- a/docs/snyk/v2.12.7/argocd-iac-install.html +++ b/docs/snyk/v2.12.7/argocd-iac-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:28:35 am (UTC+00:00)

    +

    December 8th 2024, 12:27:55 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.12.7/argocd-iac-namespace-install.html b/docs/snyk/v2.12.7/argocd-iac-namespace-install.html index 0f63e427684cb..f1787b91d225c 100644 --- a/docs/snyk/v2.12.7/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.12.7/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:28:46 am (UTC+00:00)

    +

    December 8th 2024, 12:28:04 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.12.7/argocd-test.html b/docs/snyk/v2.12.7/argocd-test.html index 22df8a62616c1..529ca8df39edd 100644 --- a/docs/snyk/v2.12.7/argocd-test.html +++ b/docs/snyk/v2.12.7/argocd-test.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:26:24 am (UTC+00:00)

    +

    December 8th 2024, 12:25:56 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/v2.12.7/ghcr.io_dexidp_dex_v2.38.0.html b/docs/snyk/v2.12.7/ghcr.io_dexidp_dex_v2.38.0.html index d47a6bbe78692..a7c95cb07bbef 100644 --- a/docs/snyk/v2.12.7/ghcr.io_dexidp_dex_v2.38.0.html +++ b/docs/snyk/v2.12.7/ghcr.io_dexidp_dex_v2.38.0.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:26:34 am (UTC+00:00)

    +

    December 8th 2024, 12:26:04 am (UTC+00:00)

    Scanned the following paths: @@ -777,15 +777,15 @@

    Remediation

    References

    @@ -2817,6 +2817,7 @@

    Remediation

    References

    diff --git a/docs/snyk/v2.12.7/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html b/docs/snyk/v2.12.7/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html index a28a076d5d8c4..509e70d765f11 100644 --- a/docs/snyk/v2.12.7/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html +++ b/docs/snyk/v2.12.7/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:26:39 am (UTC+00:00)

    +

    December 8th 2024, 12:26:08 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.12.7/public.ecr.aws_docker_library_redis_7.0.15-alpine.html b/docs/snyk/v2.12.7/public.ecr.aws_docker_library_redis_7.0.15-alpine.html index 5f024472ca410..b69828ca77f11 100644 --- a/docs/snyk/v2.12.7/public.ecr.aws_docker_library_redis_7.0.15-alpine.html +++ b/docs/snyk/v2.12.7/public.ecr.aws_docker_library_redis_7.0.15-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:26:44 am (UTC+00:00)

    +

    December 8th 2024, 12:26:12 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/v2.12.7/quay.io_argoproj_argocd_v2.12.7.html b/docs/snyk/v2.12.7/quay.io_argoproj_argocd_v2.12.7.html index 51e272d0419c8..4d80f74f4b008 100644 --- a/docs/snyk/v2.12.7/quay.io_argoproj_argocd_v2.12.7.html +++ b/docs/snyk/v2.12.7/quay.io_argoproj_argocd_v2.12.7.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:27:07 am (UTC+00:00)

    +

    December 8th 2024, 12:26:30 am (UTC+00:00)

    Scanned the following paths: @@ -707,6 +707,8 @@

    References

  • http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-10041
  • https://access.redhat.com/security/cve/CVE-2024-10041
  • https://bugzilla.redhat.com/show_bug.cgi?id=2319212
    • +
  • https://access.redhat.com/errata/RHSA-2024:9941
    • +
  • https://access.redhat.com/errata/RHSA-2024:10379
    • @@ -951,170 +953,6 @@

    References

    More about this vulnerability

    -
    -
    -

    Information Exposure

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argocd › Dockerfile -
      • -
    • - Package Manager: ubuntu:24.04 -
      • -
    • - Vulnerable module: - - libgcrypt20 -
      • - -
    • Introduced through: - - docker-image|quay.io/argoproj/argocd@v2.12.7 and libgcrypt20@1.10.3-2build1 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 - › - gnupg2/dirmngr@2.4.4-2ubuntu17 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 - › - gnupg2/gpg@2.4.4-2ubuntu17 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 - › - gnupg2/gpg-agent@2.4.4-2ubuntu17 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 - › - apt@2.7.14build2 - › - apt/libapt-pkg6.0t64@2.7.14build2 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 - › - apt@2.7.14build2 - › - gnupg2/gpgv@2.4.4-2ubuntu17 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 - › - gnupg2/gpg@2.4.4-2ubuntu17 - › - gnupg2/gpgconf@2.4.4-2ubuntu17 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.12.7 - › - apt@2.7.14build2 - › - adduser@3.137ubuntu1 - › - shadow/passwd@1:4.13+dfsg1-4ubuntu3.2 - › - pam/libpam-modules@1.5.3-5ubuntu5.1 - › - systemd/libsystemd0@255.4-1ubuntu8.4 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Ubuntu. - See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    -

    A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

    -

    Remediation

    -

    There is no fixed version for Ubuntu:24.04 libgcrypt20.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    -

    CVE-2024-26462

    @@ -2196,6 +2034,170 @@

    References

    More about this vulnerability

    +
    +
    +

    Information Exposure

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.12.7/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + libgcrypt20 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.12.7 and libgcrypt20@1.10.3-2build1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.7 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.7 + › + gnupg2/dirmngr@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.7 + › + gnupg2/gpg@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.7 + › + gnupg2/gpg-agent@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.7 + › + apt@2.7.14build2 + › + apt/libapt-pkg6.0t64@2.7.14build2 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.7 + › + apt@2.7.14build2 + › + gnupg2/gpgv@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.7 + › + gnupg2/gpg@2.4.4-2ubuntu17 + › + gnupg2/gpgconf@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.12.7 + › + apt@2.7.14build2 + › + adduser@3.137ubuntu1 + › + shadow/passwd@1:4.13+dfsg1-4ubuntu3.2 + › + pam/libpam-modules@1.5.3-5ubuntu5.1 + › + systemd/libsystemd0@255.4-1ubuntu8.4 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Ubuntu. + See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    +

    A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 libgcrypt20.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    +

    CVE-2024-26458

    @@ -3072,7 +3074,7 @@

    References

    -

    CVE-2024-9681

    +

    Insufficient Comparison

    diff --git a/docs/snyk/v2.12.7/redis_7.0.15-alpine.html b/docs/snyk/v2.12.7/redis_7.0.15-alpine.html index fda3c08ce5105..76181d1173f0f 100644 --- a/docs/snyk/v2.12.7/redis_7.0.15-alpine.html +++ b/docs/snyk/v2.12.7/redis_7.0.15-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:27:13 am (UTC+00:00)

    +

    December 8th 2024, 12:26:35 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/v2.13.1/argocd-iac-install.html b/docs/snyk/v2.13.1/argocd-iac-install.html index 8bdb8927ebfee..fc1126512ae00 100644 --- a/docs/snyk/v2.13.1/argocd-iac-install.html +++ b/docs/snyk/v2.13.1/argocd-iac-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:25:52 am (UTC+00:00)

    +

    December 8th 2024, 12:25:26 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.13.1/argocd-iac-namespace-install.html b/docs/snyk/v2.13.1/argocd-iac-namespace-install.html index fc5ceb1aaa24b..df8e9ecd32933 100644 --- a/docs/snyk/v2.13.1/argocd-iac-namespace-install.html +++ b/docs/snyk/v2.13.1/argocd-iac-namespace-install.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:26:02 am (UTC+00:00)

    +

    December 8th 2024, 12:25:35 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.13.1/argocd-test.html b/docs/snyk/v2.13.1/argocd-test.html index b60c2185d4179..13f3c2956ffed 100644 --- a/docs/snyk/v2.13.1/argocd-test.html +++ b/docs/snyk/v2.13.1/argocd-test.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:23:46 am (UTC+00:00)

    +

    December 8th 2024, 12:23:27 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/v2.13.1/ghcr.io_dexidp_dex_v2.41.1.html b/docs/snyk/v2.13.1/ghcr.io_dexidp_dex_v2.41.1.html index 127976e74d29c..780d8a759cfdd 100644 --- a/docs/snyk/v2.13.1/ghcr.io_dexidp_dex_v2.41.1.html +++ b/docs/snyk/v2.13.1/ghcr.io_dexidp_dex_v2.41.1.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:23:53 am (UTC+00:00)

    +

    December 8th 2024, 12:23:34 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/v2.13.1/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html b/docs/snyk/v2.13.1/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html index c41b788b74f01..3753b33f73d7e 100644 --- a/docs/snyk/v2.13.1/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html +++ b/docs/snyk/v2.13.1/public.ecr.aws_docker_library_haproxy_2.6.17-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:23:58 am (UTC+00:00)

    +

    December 8th 2024, 12:23:37 am (UTC+00:00)

    Scanned the following path: diff --git a/docs/snyk/v2.13.1/public.ecr.aws_docker_library_redis_7.0.15-alpine.html b/docs/snyk/v2.13.1/public.ecr.aws_docker_library_redis_7.0.15-alpine.html index e53df762a6202..aeee34558fde1 100644 --- a/docs/snyk/v2.13.1/public.ecr.aws_docker_library_redis_7.0.15-alpine.html +++ b/docs/snyk/v2.13.1/public.ecr.aws_docker_library_redis_7.0.15-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:24:02 am (UTC+00:00)

    +

    December 8th 2024, 12:23:41 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/snyk/v2.13.1/quay.io_argoproj_argocd_v2.13.1.html b/docs/snyk/v2.13.1/quay.io_argoproj_argocd_v2.13.1.html index 3ce75092f327b..9b2d11e5b67eb 100644 --- a/docs/snyk/v2.13.1/quay.io_argoproj_argocd_v2.13.1.html +++ b/docs/snyk/v2.13.1/quay.io_argoproj_argocd_v2.13.1.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:24:22 am (UTC+00:00)

    +

    December 8th 2024, 12:23:59 am (UTC+00:00)

    Scanned the following paths: @@ -707,6 +707,8 @@

    References

  • http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-10041
  • https://access.redhat.com/security/cve/CVE-2024-10041
  • https://bugzilla.redhat.com/show_bug.cgi?id=2319212
    • +
  • https://access.redhat.com/errata/RHSA-2024:9941
    • +
  • https://access.redhat.com/errata/RHSA-2024:10379
    • @@ -951,170 +953,6 @@

    References

    More about this vulnerability

    -
    -
    -

    Information Exposure

    -
    - -
    - medium severity -
    - -
    - -
      -
    • - Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argocd › Dockerfile -
      • -
    • - Package Manager: ubuntu:24.04 -
      • -
    • - Vulnerable module: - - libgcrypt20 -
      • - -
    • Introduced through: - - docker-image|quay.io/argoproj/argocd@v2.13.1 and libgcrypt20@1.10.3-2build1 - -
      • -
    - -
    - - -

    Detailed paths

    - -
      -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 - › - gnupg2/dirmngr@2.4.4-2ubuntu17 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 - › - gnupg2/gpg@2.4.4-2ubuntu17 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 - › - gnupg2/gpg-agent@2.4.4-2ubuntu17 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 - › - apt@2.7.14build2 - › - apt/libapt-pkg6.0t64@2.7.14build2 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 - › - apt@2.7.14build2 - › - gnupg2/gpgv@2.4.4-2ubuntu17 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 - › - gnupg2/gpg@2.4.4-2ubuntu17 - › - gnupg2/gpgconf@2.4.4-2ubuntu17 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    • - Introduced through: - docker-image|quay.io/argoproj/argocd@v2.13.1 - › - apt@2.7.14build2 - › - adduser@3.137ubuntu1 - › - shadow/passwd@1:4.13+dfsg1-4ubuntu3.2 - › - pam/libpam-modules@1.5.3-5ubuntu5.1 - › - systemd/libsystemd0@255.4-1ubuntu8.4 - › - libgcrypt20@1.10.3-2build1 - - - -
      • -
    - -
    - -
    - -

    NVD Description

    -

    Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Ubuntu. - See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    -

    A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

    -

    Remediation

    -

    There is no fixed version for Ubuntu:24.04 libgcrypt20.

    -

    References

    - - -
    - -
    -

    More about this vulnerability

    -
    -

    CVE-2024-26462

    @@ -2086,6 +1924,170 @@

    References

    More about this vulnerability

    +
    +
    +

    Information Exposure

    +
    + +
    + low severity +
    + +
    + +
      +
    • + Manifest file: quay.io/argoproj/argocd:v2.13.1/argoproj/argocd › Dockerfile +
      • +
    • + Package Manager: ubuntu:24.04 +
      • +
    • + Vulnerable module: + + libgcrypt20 +
      • + +
    • Introduced through: + + docker-image|quay.io/argoproj/argocd@v2.13.1 and libgcrypt20@1.10.3-2build1 + +
      • +
    + +
    + + +

    Detailed paths

    + +
      +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.13.1 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.13.1 + › + gnupg2/dirmngr@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.13.1 + › + gnupg2/gpg@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.13.1 + › + gnupg2/gpg-agent@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.13.1 + › + apt@2.7.14build2 + › + apt/libapt-pkg6.0t64@2.7.14build2 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.13.1 + › + apt@2.7.14build2 + › + gnupg2/gpgv@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.13.1 + › + gnupg2/gpg@2.4.4-2ubuntu17 + › + gnupg2/gpgconf@2.4.4-2ubuntu17 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    • + Introduced through: + docker-image|quay.io/argoproj/argocd@v2.13.1 + › + apt@2.7.14build2 + › + adduser@3.137ubuntu1 + › + shadow/passwd@1:4.13+dfsg1-4ubuntu3.2 + › + pam/libpam-modules@1.5.3-5ubuntu5.1 + › + systemd/libsystemd0@255.4-1ubuntu8.4 + › + libgcrypt20@1.10.3-2build1 + + + +
      • +
    + +
    + +
    + +

    NVD Description

    +

    Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Ubuntu. + See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

    +

    A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

    +

    Remediation

    +

    There is no fixed version for Ubuntu:24.04 libgcrypt20.

    +

    References

    + + +
    + +
    +

    More about this vulnerability

    +
    +

    CVE-2024-26458

    diff --git a/docs/snyk/v2.13.1/redis_7.0.15-alpine.html b/docs/snyk/v2.13.1/redis_7.0.15-alpine.html index 098a7cf051920..fd80c350ed0d6 100644 --- a/docs/snyk/v2.13.1/redis_7.0.15-alpine.html +++ b/docs/snyk/v2.13.1/redis_7.0.15-alpine.html @@ -456,7 +456,7 @@

    Snyk test report

    -

    November 24th 2024, 12:24:27 am (UTC+00:00)

    +

    December 8th 2024, 12:24:03 am (UTC+00:00)

    Scanned the following paths: diff --git a/docs/user-guide/commands/argocd_admin_proj_generate-spec.md b/docs/user-guide/commands/argocd_admin_proj_generate-spec.md index 92feec6bef3f2..c25d24f6bef73 100644 --- a/docs/user-guide/commands/argocd_admin_proj_generate-spec.md +++ b/docs/user-guide/commands/argocd_admin_proj_generate-spec.md @@ -12,13 +12,13 @@ argocd admin proj generate-spec PROJECT [flags] ``` # Generate a YAML configuration for a project named "myproject" - argocd admin projects generate-spec myproject + argocd admin proj generate-spec myproject # Generate a JSON configuration for a project named "anotherproject" and specify an output file - argocd admin projects generate-spec anotherproject --output json --file config.json + argocd admin proj generate-spec anotherproject --output json --file config.json # Generate a YAML configuration for a project named "someproject" and write it back to the input file - argocd admin projects generate-spec someproject --inline + argocd admin proj generate-spec someproject --inline ``` ### Options diff --git a/docs/user-guide/commands/argocd_admin_proj_update-role-policy.md b/docs/user-guide/commands/argocd_admin_proj_update-role-policy.md index c339ad43f311d..9e086f0281aca 100644 --- a/docs/user-guide/commands/argocd_admin_proj_update-role-policy.md +++ b/docs/user-guide/commands/argocd_admin_proj_update-role-policy.md @@ -12,10 +12,10 @@ argocd admin proj update-role-policy PROJECT_GLOB MODIFICATION ACTION [flags] ``` # Add policy that allows executing any action (action/*) to roles which name matches to *deployer* in all projects - argocd admin projects update-role-policy '*' set 'action/*' --role '*deployer*' --resource applications --scope '*' --permission allow + argocd admin proj update-role-policy '*' set 'action/*' --role '*deployer*' --resource applications --scope '*' --permission allow # Remove policy that which manages running (action/*) from all roles which name matches *deployer* in all projects - argocd admin projects update-role-policy '*' remove override --role '*deployer*' + argocd admin proj update-role-policy '*' remove override --role '*deployer*' ``` diff --git a/docs/user-guide/sync_windows.md b/docs/user-guide/sync_windows.md index f6bc6b82f8b69..a786d158ffd23 100644 --- a/docs/user-guide/sync_windows.md +++ b/docs/user-guide/sync_windows.md @@ -2,7 +2,31 @@ Sync windows are configurable windows of time where syncs will either be blocked or allowed. These are defined by a kind, which can be either `allow` or `deny`, a `schedule` in cron format and a duration along with one or -more of either `applications`, `namespaces` and `clusters`. Wildcards are supported. These windows affect the running +more of either `applications`, `namespaces` and `clusters`. Wildcards are supported. + +## Relationship between Sync Windows and Applications + +The relationship between Sync Windows and Application resources is many-to-many. This means that an Application resource +may be affected by multiple Sync Windows, and that a single Sync Window definition may apply to multiple Application +resources. + +The relationship between Sync Window and Application is established as part of the definition of Sync Window. +Sync Window definition includes a section defining the Application resources to which it applies. There +are three mechanisms for selecting the Application resources to which a Sync Window applies: + +- By name of Application resource +- By cluster into which resources are installed by Application resource. This is specified by `Application.spec.destination.name` and `.server` fields +- By namespace into which resources are installed by Application resource. This is specified by `Application.spec.destination.namespace` field. + +All three mechanisms allow usage of wildcards. The mechanisms are not mutually exclusive, and all three of them can be used in single +Sync Window definition. + +When multiple selection mechanisms are used, they are effectively `ORed`, meaning that if any of the selector selects the Application, +then the Application is affected by the Sync Window. + +## Effect of Sync Windows + +These windows affect the running of both manual and automated syncs but allow an override for manual syncs which is useful if you are only interested in preventing automated syncs or if you need to temporarily override a window to perform a sync. diff --git a/go.mod b/go.mod index d9802f897cb44..b756f2fe16b11 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 github.com/chainguard-dev/git-urls v1.0.2 github.com/coreos/go-oidc/v3 v3.11.0 - github.com/cyphar/filepath-securejoin v0.3.4 + github.com/cyphar/filepath-securejoin v0.3.5 github.com/dustin/go-humanize v1.0.1 github.com/evanphx/json-patch v5.9.0+incompatible github.com/expr-lang/expr v1.16.9 diff --git a/go.sum b/go.sum index e7d5d2009afb0..5cfe6edec501b 100644 --- a/go.sum +++ b/go.sum @@ -210,8 +210,8 @@ github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7Do github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY= github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4= -github.com/cyphar/filepath-securejoin v0.3.4 h1:VBWugsJh2ZxJmLFSM06/0qzQyiQX2Qs0ViKrUAcqdZ8= -github.com/cyphar/filepath-securejoin v0.3.4/go.mod h1:8s/MCNJREmFK0H02MF6Ihv1nakJe4L/w3WZLHNkvlYM= +github.com/cyphar/filepath-securejoin v0.3.5 h1:L81NHjquoQmcPgXcttUS9qTSR/+bXry6pbSINQGpjj4= +github.com/cyphar/filepath-securejoin v0.3.5/go.mod h1:edhVd3c6OXKjUmSrVa/tGJRS9joFTxlslFCAyaxigkE= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= diff --git a/hack/gen-resources/generators/application_generator.go b/hack/gen-resources/generators/application_generator.go index 9e78299d979b0..6d7db8c587910 100644 --- a/hack/gen-resources/generators/application_generator.go +++ b/hack/gen-resources/generators/application_generator.go @@ -82,12 +82,12 @@ func (pg *ApplicationGenerator) Generate(opts *util.GenerateOpts) error { if err != nil { return err } - log.Printf("Pick source \"%s\"", source) + log.Printf("Pick source %q", source) destination, err := pg.buildDestination(opts, clusters.Items) if err != nil { return err } - log.Printf("Pick destination \"%s\"", destination) + log.Printf("Pick destination %q", destination) log.Printf("Create application") _, err = applications.Create(context.TODO(), &v1alpha1.Application{ ObjectMeta: v1.ObjectMeta{ diff --git a/manifests/base/application-controller-deployment/argocd-application-controller-deployment.yaml b/manifests/base/application-controller-deployment/argocd-application-controller-deployment.yaml index 3398ece8ef8d3..77ef1c3a3fd6b 100644 --- a/manifests/base/application-controller-deployment/argocd-application-controller-deployment.yaml +++ b/manifests/base/application-controller-deployment/argocd-application-controller-deployment.yaml @@ -115,6 +115,12 @@ spec: name: argocd-cmd-params-cm key: controller.self.heal.backoff.cap.seconds optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_SYNC_TIMEOUT + valueFrom: + configMapKeyRef: + name: argocd-cmd-params-cm + key: controller.sync.timeout.seconds + optional: true - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_PLAINTEXT valueFrom: configMapKeyRef: diff --git a/manifests/base/application-controller/argocd-application-controller-statefulset.yaml b/manifests/base/application-controller/argocd-application-controller-statefulset.yaml index 9e07525a27982..6162dfb2d27fc 100644 --- a/manifests/base/application-controller/argocd-application-controller-statefulset.yaml +++ b/manifests/base/application-controller/argocd-application-controller-statefulset.yaml @@ -118,6 +118,12 @@ spec: name: argocd-cmd-params-cm key: controller.self.heal.backoff.cap.seconds optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_SYNC_TIMEOUT + valueFrom: + configMapKeyRef: + name: argocd-cmd-params-cm + key: controller.sync.timeout.seconds + optional: true - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_PLAINTEXT valueFrom: configMapKeyRef: diff --git a/manifests/core-install.yaml b/manifests/core-install.yaml index 00bf5457e81fb..8854c5c25d40f 100644 --- a/manifests/core-install.yaml +++ b/manifests/core-install.yaml @@ -23657,6 +23657,12 @@ spec: key: controller.self.heal.backoff.cap.seconds name: argocd-cmd-params-cm optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_SYNC_TIMEOUT + valueFrom: + configMapKeyRef: + key: controller.sync.timeout.seconds + name: argocd-cmd-params-cm + optional: true - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_PLAINTEXT valueFrom: configMapKeyRef: diff --git a/manifests/ha/install.yaml b/manifests/ha/install.yaml index 39d75b0ac25c5..b0cacfca0a4c8 100644 --- a/manifests/ha/install.yaml +++ b/manifests/ha/install.yaml @@ -25646,6 +25646,12 @@ spec: key: controller.self.heal.backoff.cap.seconds name: argocd-cmd-params-cm optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_SYNC_TIMEOUT + valueFrom: + configMapKeyRef: + key: controller.sync.timeout.seconds + name: argocd-cmd-params-cm + optional: true - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_PLAINTEXT valueFrom: configMapKeyRef: diff --git a/manifests/ha/namespace-install.yaml b/manifests/ha/namespace-install.yaml index 6f4231e7d4944..3e3f954a224f6 100644 --- a/manifests/ha/namespace-install.yaml +++ b/manifests/ha/namespace-install.yaml @@ -2969,6 +2969,12 @@ spec: key: controller.self.heal.backoff.cap.seconds name: argocd-cmd-params-cm optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_SYNC_TIMEOUT + valueFrom: + configMapKeyRef: + key: controller.sync.timeout.seconds + name: argocd-cmd-params-cm + optional: true - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_PLAINTEXT valueFrom: configMapKeyRef: diff --git a/manifests/install.yaml b/manifests/install.yaml index 0cdf784a2031b..007cdb7ba2027 100644 --- a/manifests/install.yaml +++ b/manifests/install.yaml @@ -24716,6 +24716,12 @@ spec: key: controller.self.heal.backoff.cap.seconds name: argocd-cmd-params-cm optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_SYNC_TIMEOUT + valueFrom: + configMapKeyRef: + key: controller.sync.timeout.seconds + name: argocd-cmd-params-cm + optional: true - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_PLAINTEXT valueFrom: configMapKeyRef: diff --git a/manifests/namespace-install.yaml b/manifests/namespace-install.yaml index 73fe685010ae4..b1a099956fd7c 100644 --- a/manifests/namespace-install.yaml +++ b/manifests/namespace-install.yaml @@ -2039,6 +2039,12 @@ spec: key: controller.self.heal.backoff.cap.seconds name: argocd-cmd-params-cm optional: true + - name: ARGOCD_APPLICATION_CONTROLLER_SYNC_TIMEOUT + valueFrom: + configMapKeyRef: + key: controller.sync.timeout.seconds + name: argocd-cmd-params-cm + optional: true - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_PLAINTEXT valueFrom: configMapKeyRef: diff --git a/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/health.lua b/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/health.lua new file mode 100644 index 0000000000000..48ef1a8aea9d6 --- /dev/null +++ b/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/health.lua @@ -0,0 +1,18 @@ +local hs = {} +if obj.status ~= nil then + local state_map = { + initializing = "Progressing", + ready = "Healthy", + error = "Degraded", + stopping = "Progressing", + paused = "Suspended" + } + + hs.status = state_map[obj.status.state] or "Unknown" + hs.message = obj.status.ready .. "/" .. obj.status.size .. " node(s) are ready" + return hs +end + +hs.status = "Unknown" +hs.message = "Cluster status is unknown" +return hs diff --git a/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/health_test.yaml b/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/health_test.yaml new file mode 100644 index 0000000000000..7949e34ec4ce9 --- /dev/null +++ b/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/health_test.yaml @@ -0,0 +1,25 @@ +tests: +- healthStatus: + status: Progressing + message: "0/9 node(s) are ready" + inputPath: testdata/initializing.yaml +- healthStatus: + status: Healthy + message: "9/9 node(s) are ready" + inputPath: testdata/ready.yaml +- healthStatus: + status: Suspended + message: "0/9 node(s) are ready" + inputPath: testdata/paused.yaml +- healthStatus: + status: Progressing + message: "6/9 node(s) are ready" + inputPath: testdata/stopping.yaml +- healthStatus: + status: Degraded + message: "0/9 node(s) are ready" + inputPath: testdata/error.yaml +- healthStatus: + status: Unknown + message: "0/0 node(s) are ready" + inputPath: testdata/unknown.yaml diff --git a/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/error.yaml b/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/error.yaml new file mode 100644 index 0000000000000..74914f3c55ca8 --- /dev/null +++ b/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/error.yaml @@ -0,0 +1,25 @@ +apiVersion: psmdb.percona.com/v1 +kind: PerconaServerMongoDB +metadata: + name: cluster +spec: {} +status: + mongos: + ready: 0 + size: 3 + status: error + observedGeneration: 1 + ready: 0 + replsets: + cfg: + initialized: true + ready: 0 + size: 3 + status: error + rs0: + initialized: true + ready: 0 + size: 3 + status: error + size: 9 + state: error diff --git a/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/initializing.yaml b/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/initializing.yaml new file mode 100644 index 0000000000000..a59e055f3d7e7 --- /dev/null +++ b/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/initializing.yaml @@ -0,0 +1,25 @@ +apiVersion: psmdb.percona.com/v1 +kind: PerconaServerMongoDB +metadata: + name: cluster +spec: {} +status: + mongos: + ready: 0 + size: 3 + status: initializing + observedGeneration: 1 + ready: 0 + replsets: + cfg: + initialized: false + ready: 0 + size: 3 + status: initializing + rs0: + initialized: false + ready: 0 + size: 3 + status: initializing + size: 9 + state: initializing diff --git a/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/paused.yaml b/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/paused.yaml new file mode 100644 index 0000000000000..722cc2536fbce --- /dev/null +++ b/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/paused.yaml @@ -0,0 +1,25 @@ +apiVersion: psmdb.percona.com/v1 +kind: PerconaServerMongoDB +metadata: + name: cluster +spec: {} +status: + mongos: + ready: 0 + size: 3 + status: paused + observedGeneration: 1 + ready: 0 + replsets: + cfg: + initialized: true + ready: 0 + size: 3 + status: paused + rs0: + initialized: true + ready: 0 + size: 3 + status: paused + size: 9 + state: paused diff --git a/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/ready.yaml b/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/ready.yaml new file mode 100644 index 0000000000000..9d3b62a7fb640 --- /dev/null +++ b/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/ready.yaml @@ -0,0 +1,25 @@ +apiVersion: psmdb.percona.com/v1 +kind: PerconaServerMongoDB +metadata: + name: cluster +spec: {} +status: + mongos: + ready: 3 + size: 3 + status: ready + observedGeneration: 1 + ready: 9 + replsets: + cfg: + initialized: true + ready: 3 + size: 3 + status: ready + rs0: + initialized: true + ready: 3 + size: 3 + status: ready + size: 9 + state: ready diff --git a/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/stopping.yaml b/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/stopping.yaml new file mode 100644 index 0000000000000..d4f7f3ae03eba --- /dev/null +++ b/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/stopping.yaml @@ -0,0 +1,25 @@ +apiVersion: psmdb.percona.com/v1 +kind: PerconaServerMongoDB +metadata: + name: cluster +spec: {} +status: + mongos: + ready: 2 + size: 3 + status: stopping + observedGeneration: 1 + ready: 6 + replsets: + cfg: + initialized: true + ready: 2 + size: 3 + status: stopping + rs0: + initialized: true + ready: 2 + size: 3 + status: stopping + size: 9 + state: stopping diff --git a/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/unknown.yaml b/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/unknown.yaml new file mode 100644 index 0000000000000..7b06350e18023 --- /dev/null +++ b/resource_customizations/psmdb.percona.com/PerconaServerMongoDB/testdata/unknown.yaml @@ -0,0 +1,10 @@ +apiVersion: psmdb.percona.com/v1 +kind: PerconaServerMongoDB +metadata: + name: cluster +spec: {} +status: + observedGeneration: 1 + ready: 0 + size: 0 + state: "" diff --git a/server/repository/repository.go b/server/repository/repository.go index 001818490f37e..903b87dafacf2 100644 --- a/server/repository/repository.go +++ b/server/repository/repository.go @@ -166,18 +166,21 @@ func (s *Server) ListRepositories(ctx context.Context, q *repositorypkg.RepoQuer } // remove secrets items = append(items, &appsv1.Repository{ - Repo: repo.Repo, - Type: rType, - Name: repo.Name, - Username: repo.Username, - Insecure: repo.IsInsecure(), - EnableLFS: repo.EnableLFS, - EnableOCI: repo.EnableOCI, - Proxy: repo.Proxy, - NoProxy: repo.NoProxy, - Project: repo.Project, - ForceHttpBasicAuth: repo.ForceHttpBasicAuth, - InheritedCreds: repo.InheritedCreds, + Repo: repo.Repo, + Type: rType, + Name: repo.Name, + Username: repo.Username, + Insecure: repo.IsInsecure(), + EnableLFS: repo.EnableLFS, + EnableOCI: repo.EnableOCI, + Proxy: repo.Proxy, + NoProxy: repo.NoProxy, + Project: repo.Project, + ForceHttpBasicAuth: repo.ForceHttpBasicAuth, + InheritedCreds: repo.InheritedCreds, + GithubAppId: repo.GithubAppId, + GithubAppInstallationId: repo.GithubAppInstallationId, + GitHubAppEnterpriseBaseURL: repo.GitHubAppEnterpriseBaseURL, }) } } diff --git a/server/repository/repository_test.go b/server/repository/repository_test.go index 91c2e016ab3d4..490961f2b27ce 100644 --- a/server/repository/repository_test.go +++ b/server/repository/repository_test.go @@ -377,7 +377,7 @@ func TestRepositoryServer(t *testing.T) { url := "https://test" db := &dbmocks.ArgoDB{} - db.On("ListRepositories", context.TODO()).Return([]*appsv1.Repository{{Repo: url, Username: "test", Password: "it's a secret"}}, nil) + db.On("ListRepositories", context.TODO()).Return([]*appsv1.Repository{{Repo: url, Username: "test", Password: "it's a secret", GitHubAppEnterpriseBaseURL: "https://ghe.example.com/api/v3", GithubAppId: 123456, GithubAppInstallationId: 789}}, nil) db.On("GetRepository", context.TODO(), url, "").Return(&appsv1.Repository{Repo: url, Username: "test", Password: "it's a secret"}, nil) db.On("RepositoryExists", context.TODO(), url, "").Return(true, nil) @@ -387,6 +387,9 @@ func TestRepositoryServer(t *testing.T) { }) require.NoError(t, err) assert.Equal(t, "https://test", repo.Repo) + assert.Equal(t, "https://ghe.example.com/api/v3", repo.GitHubAppEnterpriseBaseURL) + assert.Equal(t, int64(123456), repo.GithubAppId) + assert.Equal(t, int64(789), repo.GithubAppInstallationId) assert.Empty(t, repo.Password) }) diff --git a/ui/src/app/applications/components/application-create-panel/application-create-panel.tsx b/ui/src/app/applications/components/application-create-panel/application-create-panel.tsx index b786d4c504da0..2a56246ad0c08 100644 --- a/ui/src/app/applications/components/application-create-panel/application-create-panel.tsx +++ b/ui/src/app/applications/components/application-create-panel/application-create-panel.tsx @@ -117,6 +117,9 @@ export const ApplicationCreatePanel = (props: { React.useEffect(() => { comboSwitchedFromPanel.current = false; + }, []); + + React.useEffect(() => { return () => { debouncedOnAppChanged.cancel(); }; diff --git a/util/argo/argo.go b/util/argo/argo.go index 8fb4eba2f3430..676a059db4761 100644 --- a/util/argo/argo.go +++ b/util/argo/argo.go @@ -1038,7 +1038,7 @@ func GenerateSpecIsDifferentErrorMessage(entity string, a, b interface{}) string if len(difference) == 0 { return basicMsg } - return fmt.Sprintf("%s; difference in keys \"%s\"", basicMsg, strings.Join(difference, ",")) + return fmt.Sprintf("%s; difference in keys %q", basicMsg, strings.Join(difference, ",")) } func GetDifferentPathsBetweenStructs(a, b interface{}) ([]string, error) { diff --git a/util/session/sessionmanager_test.go b/util/session/sessionmanager_test.go index 1ef496706feb9..8b9c0ba59a860 100644 --- a/util/session/sessionmanager_test.go +++ b/util/session/sessionmanager_test.go @@ -101,7 +101,7 @@ func TestSessionManager_AdminToken(t *testing.T) { mapClaims := *(claims.(*jwt.MapClaims)) subject := mapClaims["sub"].(string) if subject != "admin" { - t.Errorf("Token claim subject \"%s\" does not match expected subject \"%s\".", subject, "admin") + t.Errorf("Token claim subject %q does not match expected subject %q.", subject, "admin") } } diff --git a/util/settings/settings.go b/util/settings/settings.go index 60b78f405d4eb..cde340c40df69 100644 --- a/util/settings/settings.go +++ b/util/settings/settings.go @@ -537,8 +537,8 @@ const ( ) const ( - // default max webhook payload size is 1GB - defaultMaxWebhookPayloadSize = int64(1) * 1024 * 1024 * 1024 + // default max webhook payload size is 50MB + defaultMaxWebhookPayloadSize = int64(50) * 1024 * 1024 // application sync with impersonation feature is disabled by default. defaultImpersonationEnabledFlag = false diff --git a/util/webhook/webhook_test.go b/util/webhook/webhook_test.go index 892fbea2038f6..9dd4695918e30 100644 --- a/util/webhook/webhook_test.go +++ b/util/webhook/webhook_test.go @@ -60,7 +60,7 @@ type reactorDef struct { } func NewMockHandler(reactor *reactorDef, applicationNamespaces []string, objects ...runtime.Object) *ArgoCDWebhookHandler { - defaultMaxPayloadSize := int64(1) * 1024 * 1024 * 1024 + defaultMaxPayloadSize := int64(50) * 1024 * 1024 return NewMockHandlerWithPayloadLimit(reactor, applicationNamespaces, defaultMaxPayloadSize, objects...) } @@ -428,7 +428,7 @@ func TestInvalidEvent(t *testing.T) { close(h.queue) h.Wait() assert.Equal(t, http.StatusBadRequest, w.Code) - expectedLogResult := "Webhook processing failed: The payload is either too large or corrupted. Please check the payload size (must be under 1024 MB) and ensure it is valid JSON" + expectedLogResult := "Webhook processing failed: The payload is either too large or corrupted. Please check the payload size (must be under 50 MB) and ensure it is valid JSON" assert.Equal(t, expectedLogResult, hook.LastEntry().Message) assert.Equal(t, expectedLogResult+"\n", w.Body.String()) hook.Reset()