when we install multiple argocd instances within a cluster. CRDs are shared resources across argocd instances within a cluster. The crd has to be installed in one bootstrap namespace, and argocd-extension has to be installed on the remaining account of argocd. Due to this reason, we need to separate the crd manifest from the argocd-extension patch manifest.

Summary

What happened/what you expected to happen?

When clicking on the More tab on a rollout object, we are expected to see the rollout page, however it shows error: Something went wrong with Extension for Rollout instead

Diagnostics

What Kubernetes provider are you using? GKE, 1.20

What version of Argo CD and Argo CD Extensions are you running? ArgoCD v2.2.5+8f981cc ArgoCD Extensions v0.1.0 rollout extension v0.1.0

# Paste the logs from the extensions controller

I0225 01:04:27.631432       1 request.go:665] Waited for 1.040301432s due to client-side throttling, not priority and fairness, request: GET:https://10.6.75.1:443/apis/networking.k8s.io/v1?timeout=32s
2022-02-25T01:04:27.835Z    INFO    setup    starting manager
2022-02-25T01:04:27.836Z    INFO    controller.argocdextension    Starting EventSource    {"reconciler group": "argoproj.io", "reconciler kind": "ArgoCDExtension", "source": "kind source: /, Kind="}
2022-02-25T01:04:27.836Z    INFO    controller.argocdextension    Starting Controller    {"reconciler group": "argoproj.io", "reconciler kind": "ArgoCDExtension"}
2022-02-25T01:04:27.937Z    INFO    controller.argocdextension    Starting workers    {"reconciler group": "argoproj.io", "reconciler kind": "ArgoCDExtension", "worker count": 1}
2022-02-25T01:04:27.938Z    INFO    controller.argocdextension    Sources has not been downloaded yet, redownloading...    {"reconciler group": "argoproj.io", "reconciler kind": "ArgoCDExtension", "name": "argo-rollouts", "namespace": "argocd"}
2022-02-25T01:04:29.346Z    INFO    controller.argocdextension    Successfully downloaded all sources.    {"reconciler group": "argoproj.io", "reconciler kind": "ArgoCDExtension", "name": "argo-rollouts", "namespace": "argocd"}

Also seeing this error in developer tools:

Just a guess: could this be caused by the fact that we are using WorkloadRef ?

Message from the maintainers:

Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.

Summary

Integrate argocd-extensions into official argocd helm chart (put it behind variable?)

Use Cases

Kustomize is PITA. Please make it easier to install extensions ;)

Message from the maintainers:

Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.

Summary

I deploy the Argo-CD helm chart and enable extensions :

server:
  extensions:
      enabled: true

Diagnostics

What Kubernetes provider are you using? k3s

What version of Argo CD and Argo CD Extensions are you running?

  server:
    Container ID:  containerd://4fe6fba7f318b161c23df5098ebe98b7436a5fec9fbb1d2be3c11eef2d2461dc
    Image:         quay.io/argoproj/argocd:v2.4.14
    Image ID:      quay.io/argoproj/argocd@sha256:841adcd977c51c263aa29d3aa0cbe045c69abe7533c03c3fbbfd4dbd8ecff85f
    Ports:         8080/TCP, 8083/TCP
    Host Ports:    0/TCP, 0/TCP
    Command:
      argocd-server
      --insecure
    State:          Running
      Started:      Thu, 20 Oct 2022 13:11:41 +0200
    Ready:          True
    Restart Count:  0
    Limits:
      memory:  512Mi
    Requests:
      cpu:      100m
      memory:   128Mi
    Liveness:   http-get http://:8080/healthz delay=10s timeout=1s period=10s #success=1 #failure=3
    Readiness:  http-get http://:8080/healthz delay=10s timeout=1s period=10s #success=1 #failure=3
    Environment:
      ARGOCD_SERVER_INSECURE:                            <set to the key 'server.insecure' of config map 'argocd-cmd-params-cm'>                            Optional: true
      ARGOCD_SERVER_BASEHREF:                            <set to the key 'server.basehref' of config map 'argocd-cmd-params-cm'>                            Optional: true
      ARGOCD_SERVER_ROOTPATH:                            <set to the key 'server.rootpath' of config map 'argocd-cmd-params-cm'>                            Optional: true
      ARGOCD_SERVER_LOGFORMAT:                           <set to the key 'server.log.format' of config map 'argocd-cmd-params-cm'>                          Optional: true
      ARGOCD_REPO_SERVER_LOGLEVEL:                       <set to the key 'server.log.level' of config map 'argocd-cmd-params-cm'>                           Optional: true
      ARGOCD_SERVER_REPO_SERVER:                         <set to the key 'repo.server' of config map 'argocd-cmd-params-cm'>                                Optional: true
      ARGOCD_SERVER_DEX_SERVER:                          <set to the key 'server.dex.server' of config map 'argocd-cmd-params-cm'>                          Optional: true
      ARGOCD_SERVER_DISABLE_AUTH:                        <set to the key 'server.disable.auth' of config map 'argocd-cmd-params-cm'>                        Optional: true
      ARGOCD_SERVER_ENABLE_GZIP:                         <set to the key 'server.enable.gzip' of config map 'argocd-cmd-params-cm'>                         Optional: true
      ARGOCD_SERVER_REPO_SERVER_TIMEOUT_SECONDS:         <set to the key 'server.repo.server.timeout.seconds' of config map 'argocd-cmd-params-cm'>         Optional: true
      ARGOCD_SERVER_X_FRAME_OPTIONS:                     <set to the key 'server.x.frame.options' of config map 'argocd-cmd-params-cm'>                     Optional: true
      ARGOCD_SERVER_CONTENT_SECURITY_POLICY:             <set to the key 'server.content.security.policy' of config map 'argocd-cmd-params-cm'>             Optional: true
      ARGOCD_SERVER_REPO_SERVER_PLAINTEXT:               <set to the key 'server.repo.server.plaintext' of config map 'argocd-cmd-params-cm'>               Optional: true
      ARGOCD_SERVER_REPO_SERVER_STRICT_TLS:              <set to the key 'server.repo.server.strict.tls' of config map 'argocd-cmd-params-cm'>              Optional: true
      ARGOCD_TLS_MIN_VERSION:                            <set to the key 'server.tls.minversion' of config map 'argocd-cmd-params-cm'>                      Optional: true
      ARGOCD_TLS_MAX_VERSION:                            <set to the key 'server.tls.maxversion' of config map 'argocd-cmd-params-cm'>                      Optional: true
      ARGOCD_TLS_CIPHERS:                                <set to the key 'server.tls.ciphers' of config map 'argocd-cmd-params-cm'>                         Optional: true
      ARGOCD_SERVER_CONNECTION_STATUS_CACHE_EXPIRATION:  <set to the key 'server.connection.status.cache.expiration' of config map 'argocd-cmd-params-cm'>  Optional: true
      ARGOCD_SERVER_OIDC_CACHE_EXPIRATION:               <set to the key 'server.oidc.cache.expiration' of config map 'argocd-cmd-params-cm'>               Optional: true
      ARGOCD_SERVER_LOGIN_ATTEMPTS_EXPIRATION:           <set to the key 'server.login.attempts.expiration' of config map 'argocd-cmd-params-cm'>           Optional: true
      ARGOCD_SERVER_STATIC_ASSETS:                       <set to the key 'server.staticassets' of config map 'argocd-cmd-params-cm'>                        Optional: true
      ARGOCD_APP_STATE_CACHE_EXPIRATION:                 <set to the key 'server.app.state.cache.expiration' of config map 'argocd-cmd-params-cm'>          Optional: true
      REDIS_SERVER:                                      <set to the key 'redis.server' of config map 'argocd-cmd-params-cm'>                               Optional: true
      REDISDB:                                           <set to the key 'redis.db' of config map 'argocd-cmd-params-cm'>                                   Optional: true
      REDIS_USERNAME:                                    <set to the key 'redis-username' in secret 'argo-cd-argocd-redis'>                                 Optional: true
      REDIS_PASSWORD:                                    <set to the key 'redis-password' in secret 'argo-cd-argocd-redis'>                                 Optional: true
      ARGOCD_DEFAULT_CACHE_EXPIRATION:                   <set to the key 'server.default.cache.expiration' of config map 'argocd-cmd-params-cm'>            Optional: true
      ARGOCD_MAX_COOKIE_NUMBER:                          <set to the key 'server.http.cookie.maxnumber' of config map 'argocd-cmd-params-cm'>               Optional: true
      ARGOCD_SERVER_OTLP_ADDRESS:                        <set to the key 'otlp.address' of config map 'argocd-cmd-params-cm'>                               Optional: true
    Mounts:
      /app/config/server/tls from argocd-repo-server-tls (rw)
      /app/config/ssh from ssh-known-hosts (rw)
      /app/config/tls from tls-certs (rw)
      /home/argocd from plugins-home (rw)
      /tmp from tmp-dir (rw)
      /tmp/extensions/ from extensions (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-hbqhz (ro)

and

  argocd-extensions:
    Container ID:   containerd://7a3cdb1e50e70536183c2d192e5ebd9d313994034d45100e8a5659d80cfbf238
    Image:          ghcr.io/argoproj-labs/argocd-extensions:v0.1.0
    Image ID:       ghcr.io/argoproj-labs/argocd-extensions@sha256:df18de9c611684a95b1593d2a703f49fa6213b6fad92c550b34f55404f0b7568
    Port:           <none>
    Host Port:      <none>
    State:          Waiting
      Reason:       CrashLoopBackOff
    Last State:     Terminated
      Reason:       Error
      Exit Code:    1
      Started:      Thu, 20 Oct 2022 13:13:25 +0200
      Finished:     Thu, 20 Oct 2022 13:13:25 +0200
    Ready:          False
    Restart Count:  4
    Limits:
      memory:  128Mi
    Requests:
      cpu:        10m
      memory:     64Mi
    Environment:  <none>
    Mounts:
      /tmp/extensions/ from extensions (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-hbqhz (ro)

Paste the logs from the extensions controller

Logs for the entire controller:

kubectl logs -n argocd deployment/argocd-extensions-controller

kubectl -n argocd logs -f argo-cd-argocd-server-66b874fcd9-2zq7v -c argocd-extensions
exec /manager: exec format error

Message from the maintainers:

Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.

Summary

Currently it seems that

capabilites:
  drop:
    - ALL

is missing from the container security context. If the container does not require those capabilities, would it be possible to drop them by default?

Use Cases

When would you use this?

If this is implemented by default I believe that it would increase the security posture of every cluster that uses this.

Message from the maintainers:

Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.

Summary

Automate updating image tags in the kustomization.yaml files.

Use Cases

Otherwise we'll forget. And when we don't forget, we have to manually do this: https://github.com/argoproj-labs/argocd-extensions/pull/22

Message from the maintainers:

Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.

When you pull a resource down, you should check the resources hash against a known good value, in case the third-party is compromised and an attacker replaces the resource (Javascript) with something bad.

Basically this:

https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

<script src="https://example.com/example-framework.js"
        integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
        crossorigin="anonymous"></script>

Could be done like this:

apiVersion: argoproj.io/v1alpha1
kind: ArgoCDExtension
metadata:
  name: hello-world
  finalizers:
    - extensions-finalizer.argocd.argoproj.io
spec:
  sources:
    - git:
        url: https://github.com/argoproj-labs/argocd-example-extension.git
    - web:
        url: https://github.com/argoproj-labs/argocd-example-extension/releases/download/v0.1.0/extension.tar
        integrity: sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC

Summary

The current ArgoCD extension supports only one extension per resource. extension.js will overwrite the previous one.

What change needs making?

Use Cases

When would you use this?

Message from the maintainers:

Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.

The Argo maintainers recently agreed to require all Argoproj Labs project repositories to contain a SECURITY.md file which documents:

• Contact information for reporting security vulnerabilities
• Some minimal information about policies, practices, with possibly links to further documentation with more details

This will help direct vulnerability reporting to the right parties which can fix the issue.

You are free to use the following as examples/templates:

• Argoproj
• Workflows
• CD

Also, please note that in the future we are exploring a requirement that argoproj-labs projects perform a CII self-assessment to better inform its users about which security best practices are being followed.