From 1d3149ca0da7ba6504c7b8d369fee0cab8a12279 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Wed, 15 Jul 2026 10:04:32 +0530 Subject: [PATCH 1/6] feat(redis-ha-proxy): Configure Redis Ha Proxy TLS settings Signed-off-by: akhil nittala --- build/redis/haproxy.cfg.tpl | 45 +++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 12 deletions(-) diff --git a/build/redis/haproxy.cfg.tpl b/build/redis/haproxy.cfg.tpl index 0952c8c7659..dfc08f7b5c9 100644 --- a/build/redis/haproxy.cfg.tpl +++ b/build/redis/haproxy.cfg.tpl @@ -1,6 +1,27 @@ {{- if eq .UseTLS "true"}} global ca-base /app/config/redis/tls + +{{- if .tlsMinVersion}} + ssl-default-bind-options ssl-min-ver TLSv{{.tlsMinVersion}} + ssl-default-server-options ssl-min-ver TLSv{{.tlsMinVersion}} +{{- end}} + +{{- if .tlsCiphers}} +{{- if eq .tlsMinVersion "1.3"}} + # TLS 1.3 cipher suites + ssl-default-bind-ciphersuites {{.tlsCiphers}} + ssl-default-server-ciphersuites {{.tlsCiphers}} +{{- else}} + # TLS 1.2 and below cipher lists + ssl-default-bind-ciphers {{.tlsCiphers}} + ssl-default-server-ciphers {{.tlsCiphers}} + + # Also configure TLS 1.3 cipher suites when TLS 1.3 is negotiated + ssl-default-bind-ciphersuites {{.tlsCiphers}} + ssl-default-server-ciphersuites {{.tlsCiphers}} +{{- end}} +{{- end}} {{- end}} defaults REDIS @@ -37,9 +58,9 @@ backend check_if_redis_is_master_0 server R1 {{.ServiceName}}-announce-1:26379 check inter 3s server R2 {{.ServiceName}}-announce-2:26379 check inter 3s {{- else}} - server R0 {{.ServiceName}}-announce-0:26379 verify required ca-file tls.crt check inter 3s - server R1 {{.ServiceName}}-announce-1:26379 verify required ca-file tls.crt check inter 3s - server R2 {{.ServiceName}}-announce-2:26379 verify required ca-file tls.crt check inter 3s + server R0 {{.ServiceName}}-announce-0:26379 ssl verify required ca-file tls.crt check inter 3s + server R1 {{.ServiceName}}-announce-1:26379 ssl verify required ca-file tls.crt check inter 3s + server R2 {{.ServiceName}}-announce-2:26379 ssl verify required ca-file tls.crt check inter 3s {{- end}} # Check Sentinel and whether they are nominated master backend check_if_redis_is_master_1 @@ -63,9 +84,9 @@ backend check_if_redis_is_master_1 server R1 {{.ServiceName}}-announce-1:26379 check inter 3s server R2 {{.ServiceName}}-announce-2:26379 check inter 3s {{- else}} - server R0 {{.ServiceName}}-announce-0:26379 verify required ca-file tls.crt check inter 3s - server R1 {{.ServiceName}}-announce-1:26379 verify required ca-file tls.crt check inter 3s - server R2 {{.ServiceName}}-announce-2:26379 verify required ca-file tls.crt check inter 3s + server R0 {{.ServiceName}}-announce-0:26379 ssl verify required ca-file tls.crt check inter 3s + server R1 {{.ServiceName}}-announce-1:26379 ssl verify required ca-file tls.crt check inter 3s + server R2 {{.ServiceName}}-announce-2:26379 ssl verify required ca-file tls.crt check inter 3s {{- end}} # Check Sentinel and whether they are nominated master backend check_if_redis_is_master_2 @@ -89,9 +110,9 @@ backend check_if_redis_is_master_2 server R1 {{.ServiceName}}-announce-1:26379 check inter 3s server R2 {{.ServiceName}}-announce-2:26379 check inter 3s {{- else}} - server R0 {{.ServiceName}}-announce-0:26379 verify required ca-file tls.crt check inter 3s - server R1 {{.ServiceName}}-announce-1:26379 verify required ca-file tls.crt check inter 3s - server R2 {{.ServiceName}}-announce-2:26379 verify required ca-file tls.crt check inter 3s + server R0 {{.ServiceName}}-announce-0:26379 ssl verify required ca-file tls.crt check inter 3s + server R1 {{.ServiceName}}-announce-1:26379 ssl verify required ca-file tls.crt check inter 3s + server R2 {{.ServiceName}}-announce-2:26379 ssl verify required ca-file tls.crt check inter 3s {{- end}} # decide redis backend to use @@ -125,9 +146,9 @@ backend bk_redis_master server R2 {{.ServiceName}}-announce-2:6379 check inter 3s fall 1 rise 1 {{- else}} use-server R0 if { srv_is_up(R0) } { nbsrv(check_if_redis_is_master_0) ge 2 } - server R0 {{.ServiceName}}-announce-0:6379 verify required ca-file tls.crt check inter 3s fall 1 rise 1 + server R0 {{.ServiceName}}-announce-0:6379 ssl verify required ca-file tls.crt check inter 3s fall 1 rise 1 use-server R1 if { srv_is_up(R1) } { nbsrv(check_if_redis_is_master_1) ge 2 } - server R1 {{.ServiceName}}-announce-1:6379 verify required ca-file tls.crt check inter 3s fall 1 rise 1 + server R1 {{.ServiceName}}-announce-1:6379 ssl verify required ca-file tls.crt check inter 3s fall 1 rise 1 use-server R2 if { srv_is_up(R2) } { nbsrv(check_if_redis_is_master_2) ge 2 } - server R2 {{.ServiceName}}-announce-2:6379 verify required ca-file tls.crt check inter 3s fall 1 rise 1 + server R2 {{.ServiceName}}-announce-2:6379 ssl verify required ca-file tls.crt check inter 3s fall 1 rise 1 {{- end}} From fb202c54a76a7d35644a805b5bf656f66a1afa86 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Wed, 22 Jul 2026 10:12:00 +0530 Subject: [PATCH 2/6] feat(redis-ha-proxy): Configure Redis Ha Proxy TLS settings Signed-off-by: akhil nittala --- build/redis/haproxy.cfg.tpl | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/build/redis/haproxy.cfg.tpl b/build/redis/haproxy.cfg.tpl index dfc08f7b5c9..0c4e975c71b 100644 --- a/build/redis/haproxy.cfg.tpl +++ b/build/redis/haproxy.cfg.tpl @@ -2,24 +2,24 @@ global ca-base /app/config/redis/tls -{{- if .tlsMinVersion}} - ssl-default-bind-options ssl-min-ver TLSv{{.tlsMinVersion}} - ssl-default-server-options ssl-min-ver TLSv{{.tlsMinVersion}} +{{- if .TLSMinVersion}} + ssl-default-bind-options ssl-min-ver TLSv{{.TLSMinVersion}} + ssl-default-server-options ssl-min-ver TLSv{{.TLSMinVersion}} {{- end}} -{{- if .tlsCiphers}} -{{- if eq .tlsMinVersion "1.3"}} +{{- if .TLSCiphers}} +{{- if eq .TLSMinVersion "1.3"}} # TLS 1.3 cipher suites - ssl-default-bind-ciphersuites {{.tlsCiphers}} - ssl-default-server-ciphersuites {{.tlsCiphers}} + ssl-default-bind-ciphersuites {{.TLSCiphers}} + ssl-default-server-ciphersuites {{.TLSCiphers}} {{- else}} # TLS 1.2 and below cipher lists - ssl-default-bind-ciphers {{.tlsCiphers}} - ssl-default-server-ciphers {{.tlsCiphers}} + ssl-default-bind-ciphers {{.TLSCiphers}} + ssl-default-server-ciphers {{.TLSCiphers}} # Also configure TLS 1.3 cipher suites when TLS 1.3 is negotiated - ssl-default-bind-ciphersuites {{.tlsCiphers}} - ssl-default-server-ciphersuites {{.tlsCiphers}} + ssl-default-bind-ciphersuites {{.TLSCiphers}} + ssl-default-server-ciphersuites {{.TLSCiphers}} {{- end}} {{- end}} {{- end}} From 6ec3349402b5e100b718d1aee2b61e0013d5c5a2 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Fri, 24 Jul 2026 11:30:28 +0530 Subject: [PATCH 3/6] feat(redis-ha-proxy): Configure Redis Ha Proxy TLS settings Signed-off-by: akhil nittala --- go.mod | 24 ++++++++++++------------ go.sum | 48 ++++++++++++++++++++++++------------------------ 2 files changed, 36 insertions(+), 36 deletions(-) diff --git a/go.mod b/go.mod index 5ffada6c86d..5342f8cc935 100644 --- a/go.mod +++ b/go.mod @@ -5,10 +5,10 @@ go 1.26.2 require ( github.com/argoproj-labs/argo-rollouts-manager v0.0.9-0.20260505092152-3e07addcb2cb github.com/argoproj-labs/argocd-image-updater v1.2.1 - github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260717074027-6a3a78378ff8 + github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260724035843-cf5d1c0236bf github.com/argoproj/argo-cd/gitops-engine v0.7.1-0.20250908182407-97ad5b59a627 github.com/argoproj/argo-cd/v3 v3.4.2 - github.com/go-logr/logr v1.4.3 + github.com/go-logr/logr v1.4.4 github.com/google/go-cmp v0.7.0 github.com/google/uuid v1.6.1-0.20241114170450-2d3c2a9cc518 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 @@ -125,7 +125,7 @@ require ( github.com/json-iterator/go v1.1.12 // indirect github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect github.com/kevinburke/ssh_config v1.2.0 // indirect - github.com/klauspost/compress v1.18.0 // indirect + github.com/klauspost/compress v1.19.0 // indirect github.com/klauspost/cpuid/v2 v2.3.0 // indirect github.com/kylelemons/godebug v1.1.0 // indirect github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect @@ -146,16 +146,16 @@ require ( github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect github.com/pkg/errors v0.9.1 // indirect github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect - github.com/prometheus/client_golang v1.23.2 // indirect + github.com/prometheus/client_golang v1.24.0 // indirect github.com/prometheus/client_model v0.6.2 // indirect - github.com/prometheus/common v0.66.1 // indirect - github.com/prometheus/procfs v0.17.0 // indirect + github.com/prometheus/common v0.70.0 // indirect + github.com/prometheus/procfs v0.21.1 // indirect github.com/r3labs/diff/v3 v3.0.2 // indirect github.com/redis/go-redis/v9 v9.18.0 // indirect github.com/robfig/cron/v3 v3.0.2-0.20210106135023-bc59245fe10e // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/sergi/go-diff v1.4.0 // indirect - github.com/sethvargo/go-password v0.3.1 // indirect + github.com/sethvargo/go-password v0.4.0 // indirect github.com/sirupsen/logrus v1.9.4 // indirect github.com/skeema/knownhosts v1.3.1 // indirect github.com/spf13/cobra v1.10.2 // indirect @@ -178,23 +178,23 @@ require ( go.opentelemetry.io/proto/otlp v1.9.0 // indirect go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect - go.yaml.in/yaml/v2 v2.4.3 // indirect + go.yaml.in/yaml/v2 v2.4.4 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect golang.org/x/crypto v0.53.0 // indirect golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect golang.org/x/net v0.56.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.21.0 // indirect - golang.org/x/sys v0.46.0 // indirect + golang.org/x/sys v0.47.0 // indirect golang.org/x/term v0.44.0 // indirect golang.org/x/text v0.38.0 // indirect golang.org/x/time v0.15.0 // indirect golang.org/x/tools v0.47.0 // indirect gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect google.golang.org/genproto v0.0.0-20240401170217-c3f982113cda // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 // indirect - google.golang.org/grpc v1.80.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect + google.golang.org/grpc v1.82.1 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect diff --git a/go.sum b/go.sum index d7ded98f85d..f6b6acfc9e4 100644 --- a/go.sum +++ b/go.sum @@ -43,8 +43,8 @@ github.com/argoproj-labs/argo-rollouts-manager v0.0.9-0.20260505092152-3e07addcb github.com/argoproj-labs/argo-rollouts-manager v0.0.9-0.20260505092152-3e07addcb2cb/go.mod h1:Ouqjtkj48SPJhW6r00CYqJ4uM7QDy3D4tinKIK9Y69Q= github.com/argoproj-labs/argocd-image-updater v1.2.1 h1:yaJdmpFOOKTkC9688/a7jjOBLpCREj7Wdnmn4A3v1nU= github.com/argoproj-labs/argocd-image-updater v1.2.1/go.mod h1:sBS1JqoM9R0QhIDVD4bdWS/GejDQaFwdFUV+yE9TzjA= -github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260717074027-6a3a78378ff8 h1:8DucwxpkkmPGEYzP/PH2CIE9nax4YurNXlNMSYVoO7U= -github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260717074027-6a3a78378ff8/go.mod h1:vVd7s8gzmMfA3pueuG5ylvvdIk3aFlk+M3uf0xrIvDE= +github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260724035843-cf5d1c0236bf h1:CF/YrClg6ObxEh5fW4RBEIVgTblRkj4mBdiKIZRB46k= +github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260724035843-cf5d1c0236bf/go.mod h1:NPRfhk21+6lqB4q2ASUwnffVklId/L4TrNQszqoQiKc= github.com/argoproj/argo-cd/gitops-engine v0.0.0-20260512203152-0dc6b1b57dd5 h1:IMzPK0gt1lZRDHtiKGzU0VAez0FmT2veytxlmE2AwyU= github.com/argoproj/argo-cd/gitops-engine v0.0.0-20260512203152-0dc6b1b57dd5/go.mod h1:6Q1KZzkeKlnCpzzZ1Fu72+WPMAt+ZeMD9KOO6aMjW68= github.com/argoproj/argo-cd/v3 v3.4.2 h1:S3j0K34uGW4geWiM88+0cHcCEtInn2Sa9U7/Sa18L7Y= @@ -164,8 +164,8 @@ github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ= @@ -301,8 +301,8 @@ github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXw github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk= -github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo= -github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ= +github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ= +github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y= github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= @@ -405,15 +405,15 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.74.0 h1:AHzMWDxNiAVscJL6+4wkvFRTpMnJqiaZFEKA/osaBXE= github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.74.0/go.mod h1:wAR5JopumPtAZnu0Cjv2PSqV4p4QB09LMhc6fZZTXuA= -github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= -github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= +github.com/prometheus/client_golang v1.24.0 h1:5XStIklKuAtJSNpdD3s8XJj/Yv78IQmE1kbNk87JrAI= +github.com/prometheus/client_golang v1.24.0/go.mod h1:QcsNdotprC2nS4BTM2ucbcqxd2CeXTEa9jW7zHO9iDE= github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE= -github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs= -github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA= -github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0= -github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw= +github.com/prometheus/common v0.70.0 h1:bcpru3tWPVnxGnETLgOV5jbp/JRXgYEyv65CuBLAMMI= +github.com/prometheus/common v0.70.0/go.mod h1:S/SFasQmgGiYH6C81LKCtYa8QACgthGg5zxL2udV7SY= +github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI= +github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY= github.com/r3labs/diff/v3 v3.0.2 h1:yVuxAY1V6MeM4+HNur92xkS39kB/N+cFi2hMkY06BbA= github.com/r3labs/diff/v3 v3.0.2/go.mod h1:Cy542hv0BAEmhDYWtGxXRQ4kqRsVIcEjG9gChUlTmkw= github.com/redis/go-redis/v9 v9.0.0-rc.4/go.mod h1:Vo3EsyWnicKnSKCA7HhgnvnyA74wOA69Cd2Meli5mmA= @@ -429,8 +429,8 @@ github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw= github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4= -github.com/sethvargo/go-password v0.3.1 h1:WqrLTjo7X6AcVYfC6R7GtSyuUQR9hGyAj/f1PYQZCJU= -github.com/sethvargo/go-password v0.3.1/go.mod h1:rXofC1zT54N7R8K/h1WDUdkf9BOx5OptoxrMBcrXzvs= +github.com/sethvargo/go-password v0.4.0 h1:eSidVKQw5C7CmTDAtH3RipBTSjdU1ZRxQaynD2GWLVU= +github.com/sethvargo/go-password v0.4.0/go.mod h1:PO3nYHwUpcHPR0F9woy7a4abZPvzRuqJr0GaeIYTm3k= github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0= github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w= github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g= @@ -515,8 +515,8 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo= go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q= -go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= -go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= +go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= +go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= @@ -607,8 +607,8 @@ golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= -golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= -golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/telemetry v0.0.0-20250710130107-8d8967aff50b/go.mod h1:4ZwOYna0/zsOKwuR5X/m0QFOJpSZvAxFfkQT+Erd9D4= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= @@ -652,17 +652,17 @@ google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98 google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= google.golang.org/genproto v0.0.0-20240401170217-c3f982113cda h1:wu/KJm9KJwpfHWhkkZGohVC6KRrc1oJNr4jwtQMOQXw= google.golang.org/genproto v0.0.0-20240401170217-c3f982113cda/go.mod h1:g2LLCvCeCSir/JJSWosk19BR4NVxGqHUC6rxIRsd7Aw= -google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 h1:JLQynH/LBHfCTSbDWl+py8C+Rg/k1OVH3xfcaiANuF0= -google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:kSJwQxqmFXeo79zOmbrALdflXQeAYcUbgS7PbpMknCY= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 h1:ndE4FoJqsIceKP2oYSnUZqhTdYufCYYkqwtFzfrhI7w= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 h1:yQugLulqltosq0B/f8l4w9VryjV+N/5gcW0jQ3N8Qec= +google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478/go.mod h1:C6ADNqOxbgdUUeRTU+LCHDPB9ttAMCTff6auwCVa4uc= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg= google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY= google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0= -google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM= -google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4= +google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= +google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos= From 632dffd212b114ea5e60889adaec343cf4db1aca Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Fri, 24 Jul 2026 14:47:34 +0530 Subject: [PATCH 4/6] feat(redis-ha-proxy): Configure Redis Ha Proxy TLS settings Signed-off-by: akhil nittala --- .../ginkgo/parallel/1-095_validate_dex_clientsecret_test.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/test/openshift/e2e/ginkgo/parallel/1-095_validate_dex_clientsecret_test.go b/test/openshift/e2e/ginkgo/parallel/1-095_validate_dex_clientsecret_test.go index 9708e7507e4..50909430222 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-095_validate_dex_clientsecret_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-095_validate_dex_clientsecret_test.go @@ -25,6 +25,7 @@ import ( "github.com/argoproj-labs/argocd-operator/common" . "github.com/onsi/ginkgo/v2" . "github.com/onsi/gomega" + "github.com/redhat-developer/gitops-operator/controllers/util" "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture" argocdFixture "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture/argocd" k8sFixture "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture/k8s" @@ -44,7 +45,8 @@ func newArgoCDForDexOpenShiftOAuthE2E(namespace string) *argov1beta1api.ArgoCD { SSO: &argov1beta1api.ArgoCDSSOSpec{ Provider: argov1beta1api.SSOProviderTypeDex, Dex: &argov1beta1api.ArgoCDDexSpec{ - OpenShiftOAuth: true, + OpenShiftOAuth: true, + EnableSATokenRenewal: util.BoolPtr(true), }, }, Server: argov1beta1api.ArgoCDServerSpec{ From 1ad66c2939458fbe3aee8b885bc129a1f7417495 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Mon, 27 Jul 2026 22:54:02 +0530 Subject: [PATCH 5/6] feat(redis-ha-proxy): Configure Redis Ha Proxy TLS settings Signed-off-by: akhil nittala --- .../manifests/argoproj.io_applications.yaml | 117 +++++----- .../argoproj.io_applicationsets.yaml | 10 + bundle/manifests/argoproj.io_argocds.yaml | 206 +++++++++++++++--- ...gitops-operator.clusterserviceversion.yaml | 2 +- .../crd/bases/argoproj.io_applications.yaml | 117 +++++----- .../bases/argoproj.io_applicationsets.yaml | 10 + config/crd/bases/argoproj.io_argocds.yaml | 206 +++++++++++++++--- 7 files changed, 495 insertions(+), 173 deletions(-) diff --git a/bundle/manifests/argoproj.io_applications.yaml b/bundle/manifests/argoproj.io_applications.yaml index 300c6fdddc7..a00f7eae943 100644 --- a/bundle/manifests/argoproj.io_applications.yaml +++ b/bundle/manifests/argoproj.io_applications.yaml @@ -411,12 +411,12 @@ spec: apply common labels to resource selectors or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps + description: NamePrefix overrides the namePrefix in the + kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps + description: NameSuffix overrides the nameSuffix in the + kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -800,12 +800,12 @@ spec: to apply common labels to resource selectors or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps + description: NamePrefix overrides the namePrefix in + the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps + description: NameSuffix overrides the nameSuffix in + the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -1299,11 +1299,11 @@ spec: common labels to resource selectors or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources + description: NamePrefix overrides the namePrefix in the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources + description: NameSuffix overrides the nameSuffix in the kustomization.yaml for Kustomize apps type: string namespace: @@ -1676,12 +1676,12 @@ spec: apply common labels to resource selectors or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps + description: NamePrefix overrides the namePrefix in the + kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps + description: NameSuffix overrides the nameSuffix in the + kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -2087,12 +2087,12 @@ spec: common labels to resource selectors or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps + description: NamePrefix overrides the namePrefix in the + kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps + description: NameSuffix overrides the nameSuffix in the + kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -2646,12 +2646,12 @@ spec: to apply common labels to resource selectors or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps + description: NamePrefix overrides the namePrefix in + the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps + description: NameSuffix overrides the nameSuffix in + the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -3039,12 +3039,12 @@ spec: not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps + description: NamePrefix overrides the namePrefix in + the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps + description: NameSuffix overrides the nameSuffix in + the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -3191,6 +3191,7 @@ spec: observedAt: description: |- ObservedAt indicates when the application state was updated without querying latest git state + Deprecated: controller no longer updates ObservedAt field format: date-time type: string @@ -3587,12 +3588,12 @@ spec: or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to - resources for Kustomize apps + description: NamePrefix overrides the namePrefix + in the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to - resources for Kustomize apps + description: NameSuffix overrides the nameSuffix + in the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that @@ -4000,12 +4001,12 @@ spec: selectors or not type: boolean namePrefix: - description: NamePrefix is a prefix appended - to resources for Kustomize apps + description: NamePrefix overrides the namePrefix + in the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended - to resources for Kustomize apps + description: NameSuffix overrides the nameSuffix + in the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that @@ -4530,12 +4531,12 @@ spec: not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps + description: NamePrefix overrides the namePrefix in + the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps + description: NameSuffix overrides the nameSuffix in + the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -4934,12 +4935,12 @@ spec: not type: boolean namePrefix: - description: NamePrefix is a prefix appended to - resources for Kustomize apps + description: NamePrefix overrides the namePrefix + in the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to - resources for Kustomize apps + description: NameSuffix overrides the nameSuffix + in the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -5459,12 +5460,12 @@ spec: or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to - resources for Kustomize apps + description: NamePrefix overrides the namePrefix + in the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to - resources for Kustomize apps + description: NameSuffix overrides the nameSuffix + in the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that @@ -5912,12 +5913,12 @@ spec: or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to - resources for Kustomize apps + description: NamePrefix overrides the namePrefix + in the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to - resources for Kustomize apps + description: NameSuffix overrides the nameSuffix + in the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that @@ -6425,12 +6426,12 @@ spec: not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps + description: NamePrefix overrides the namePrefix in + the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps + description: NameSuffix overrides the nameSuffix in + the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -6829,12 +6830,12 @@ spec: not type: boolean namePrefix: - description: NamePrefix is a prefix appended to - resources for Kustomize apps + description: NamePrefix overrides the namePrefix + in the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to - resources for Kustomize apps + description: NameSuffix overrides the nameSuffix + in the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize diff --git a/bundle/manifests/argoproj.io_applicationsets.yaml b/bundle/manifests/argoproj.io_applicationsets.yaml index 7342504075a..bc6e0dee947 100644 --- a/bundle/manifests/argoproj.io_applicationsets.yaml +++ b/bundle/manifests/argoproj.io_applicationsets.yaml @@ -23116,6 +23116,16 @@ spec: - type type: object type: array + health: + properties: + lastTransitionTime: + format: date-time + type: string + message: + type: string + status: + type: string + type: object resources: items: properties: diff --git a/bundle/manifests/argoproj.io_argocds.yaml b/bundle/manifests/argoproj.io_argocds.yaml index da1cf638ff0..5bcf4a3a34d 100644 --- a/bundle/manifests/argoproj.io_argocds.yaml +++ b/bundle/manifests/argoproj.io_argocds.yaml @@ -427,6 +427,8 @@ spec: chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + The router service account needs to be granted with read-only access to this secret, + please refer to openshift docs for additional details. properties: name: description: |- @@ -440,8 +442,12 @@ spec: insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. - * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). - * None - no traffic is allowed on the insecure port. + If a route does not specify insecureEdgeTerminationPolicy, then the default behavior is "None". + + * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only). + + * None - no traffic is allowed on the insecure port (default). + * Redirect - clients are redirected to the secure port. enum: - Allow @@ -454,10 +460,12 @@ spec: type: string termination: description: |- - termination indicates termination type. + termination indicates the TLS termination type. * edge - TLS termination is done by the router and http is used to communicate with the backend (default) + * passthrough - Traffic is sent straight to the destination without the router providing TLS termination + * reencrypt - TLS termination is done by the router and https is used to communicate with the backend Note: passthrough termination is incompatible with httpHeader actions @@ -691,6 +699,11 @@ spec: image: description: Image is the name of Argo CD Agent image type: string + labelSelector: + description: |- + LabelSelector is a Kubernetes label selector that restricts which resources the agent watches. + Only resources matching this selector will be listed, watched, and processed by the agent. + type: string logFormat: description: LogFormat refers to the log format used by the Agent component. @@ -929,6 +942,11 @@ spec: the JWT signing key. type: string type: object + labelSelector: + description: |- + LabelSelector is a Kubernetes label selector that restricts which resources the principal watches. + Only resources matching this selector will be listed, watched, and processed by the principal. + type: string logFormat: description: LogFormat refers to the log format used by the Principal component. @@ -1386,8 +1404,9 @@ spec: minimum: 1 type: integer dynamicScalingEnabled: - description: DynamicScalingEnabled defines whether dynamic - scaling should be enabled for Application Controller component + description: |- + Deprecated: dynamicScalingEnabled is deprecated and will be removed in a future release. + DynamicScalingEnabled defines whether dynamic scaling should be enabled for Application Controller component. type: boolean enabled: description: Enabled defines whether sharding should be enabled @@ -1420,6 +1439,11 @@ spec: Deprecated field. Support dropped in v1beta1 version. Dex defines the Dex server options for ArgoCD. properties: + annotations: + additionalProperties: + type: string + description: Custom annotations to pods deployed by the operator + type: object config: description: Config is the dex connector configuration. type: string @@ -1432,6 +1456,11 @@ spec: image: description: Image is the Dex container image. type: string + labels: + additionalProperties: + type: string + description: Custom labels to pods deployed by the operator + type: object openShiftOAuth: description: OpenShiftOAuth enables OpenShift OAuth authentication for the Dex server. @@ -1700,6 +1729,8 @@ spec: chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + The router service account needs to be granted with read-only access to this secret, + please refer to openshift docs for additional details. properties: name: description: |- @@ -1713,8 +1744,12 @@ spec: insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. - * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). - * None - no traffic is allowed on the insecure port. + If a route does not specify insecureEdgeTerminationPolicy, then the default behavior is "None". + + * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only). + + * None - no traffic is allowed on the insecure port (default). + * Redirect - clients are redirected to the secure port. enum: - Allow @@ -1727,10 +1762,12 @@ spec: type: string termination: description: |- - termination indicates termination type. + termination indicates the TLS termination type. * edge - TLS termination is done by the router and http is used to communicate with the backend (default) + * passthrough - Traffic is sent straight to the destination without the router providing TLS termination + * reencrypt - TLS termination is done by the router and https is used to communicate with the backend Note: passthrough termination is incompatible with httpHeader actions @@ -2299,6 +2336,10 @@ spec: description: OIDCConfig is the OIDC configuration as an alternative to dex. type: string + priorityClassName: + description: PriorityClassName is the name of the PriorityClass resource + to be assigned to all ArgoCD component pods. + type: string prometheus: description: Prometheus defines the Prometheus server options for ArgoCD. @@ -2421,6 +2462,8 @@ spec: chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + The router service account needs to be granted with read-only access to this secret, + please refer to openshift docs for additional details. properties: name: description: |- @@ -2434,8 +2477,12 @@ spec: insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. - * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). - * None - no traffic is allowed on the insecure port. + If a route does not specify insecureEdgeTerminationPolicy, then the default behavior is "None". + + * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only). + + * None - no traffic is allowed on the insecure port (default). + * Redirect - clients are redirected to the secure port. enum: - Allow @@ -2448,10 +2495,12 @@ spec: type: string termination: description: |- - termination indicates termination type. + termination indicates the TLS termination type. * edge - TLS termination is done by the router and http is used to communicate with the backend (default) + * passthrough - Traffic is sent straight to the destination without the router providing TLS termination + * reencrypt - TLS termination is done by the router and https is used to communicate with the backend Note: passthrough termination is incompatible with httpHeader actions @@ -2517,6 +2566,11 @@ spec: redis: description: Redis defines the Redis server options for ArgoCD. properties: + annotations: + additionalProperties: + type: string + description: Custom annotations to pods deployed by the operator + type: object autotls: description: |- AutoTLS specifies the method to use for automatic TLS configuration for the redis server @@ -2530,6 +2584,11 @@ spec: image: description: Image is the Redis container image. type: string + labels: + additionalProperties: + type: string + description: Custom labels to pods deployed by the operator + type: object resources: description: Resources defines the Compute Resources required by the container for Redis. @@ -8497,6 +8556,8 @@ spec: chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + The router service account needs to be granted with read-only access to this secret, + please refer to openshift docs for additional details. properties: name: description: |- @@ -8510,8 +8571,12 @@ spec: insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. - * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). - * None - no traffic is allowed on the insecure port. + If a route does not specify insecureEdgeTerminationPolicy, then the default behavior is "None". + + * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only). + + * None - no traffic is allowed on the insecure port (default). + * Redirect - clients are redirected to the secure port. enum: - Allow @@ -8524,10 +8589,12 @@ spec: type: string termination: description: |- - termination indicates termination type. + termination indicates the TLS termination type. * edge - TLS termination is done by the router and http is used to communicate with the backend (default) + * passthrough - Traffic is sent straight to the destination without the router providing TLS termination + * reencrypt - TLS termination is done by the router and https is used to communicate with the backend Note: passthrough termination is incompatible with httpHeader actions @@ -8577,6 +8644,11 @@ spec: dex: description: Dex contains the configuration for Argo CD dex authentication properties: + annotations: + additionalProperties: + type: string + description: Custom annotations to pods deployed by the operator + type: object config: description: Config is the dex connector configuration. type: string @@ -8589,6 +8661,11 @@ spec: image: description: Image is the Dex container image. type: string + labels: + additionalProperties: + type: string + description: Custom labels to pods deployed by the operator + type: object openShiftOAuth: description: OpenShiftOAuth enables OpenShift OAuth authentication for the Dex server. @@ -11536,6 +11613,8 @@ spec: chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + The router service account needs to be granted with read-only access to this secret, + please refer to openshift docs for additional details. properties: name: description: |- @@ -11549,8 +11628,12 @@ spec: insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. - * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). - * None - no traffic is allowed on the insecure port. + If a route does not specify insecureEdgeTerminationPolicy, then the default behavior is "None". + + * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only). + + * None - no traffic is allowed on the insecure port (default). + * Redirect - clients are redirected to the secure port. enum: - Allow @@ -11563,10 +11646,12 @@ spec: type: string termination: description: |- - termination indicates termination type. + termination indicates the TLS termination type. * edge - TLS termination is done by the router and http is used to communicate with the backend (default) + * passthrough - Traffic is sent straight to the destination without the router providing TLS termination + * reencrypt - TLS termination is done by the router and https is used to communicate with the backend Note: passthrough termination is incompatible with httpHeader actions @@ -11821,6 +11906,11 @@ spec: image: description: Image is the name of Argo CD Agent image type: string + labelSelector: + description: |- + LabelSelector is a Kubernetes label selector that restricts which resources the agent watches. + Only resources matching this selector will be listed, watched, and processed by the agent. + type: string logFormat: description: LogFormat refers to the log format used by the Agent component. @@ -12123,6 +12213,11 @@ spec: the JWT signing key. type: string type: object + labelSelector: + description: |- + LabelSelector is a Kubernetes label selector that restricts which resources the principal watches. + Only resources matching this selector will be listed, watched, and processed by the principal. + type: string logFormat: description: LogFormat refers to the log format used by the Principal component. @@ -14213,8 +14308,9 @@ spec: minimum: 1 type: integer dynamicScalingEnabled: - description: DynamicScalingEnabled defines whether dynamic - scaling should be enabled for Application Controller component + description: |- + Deprecated: dynamicScalingEnabled is deprecated and will be removed in a future release. + DynamicScalingEnabled defines whether dynamic scaling should be enabled for Application Controller component. type: boolean enabled: description: Enabled defines whether sharding should be enabled @@ -17929,6 +18025,8 @@ spec: chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + The router service account needs to be granted with read-only access to this secret, + please refer to openshift docs for additional details. properties: name: description: |- @@ -17942,8 +18040,12 @@ spec: insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. - * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). - * None - no traffic is allowed on the insecure port. + If a route does not specify insecureEdgeTerminationPolicy, then the default behavior is "None". + + * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only). + + * None - no traffic is allowed on the insecure port (default). + * Redirect - clients are redirected to the secure port. enum: - Allow @@ -17956,10 +18058,12 @@ spec: type: string termination: description: |- - termination indicates termination type. + termination indicates the TLS termination type. * edge - TLS termination is done by the router and http is used to communicate with the backend (default) + * passthrough - Traffic is sent straight to the destination without the router providing TLS termination + * reencrypt - TLS termination is done by the router and https is used to communicate with the backend Note: passthrough termination is incompatible with httpHeader actions @@ -18797,6 +18901,10 @@ spec: description: OIDCConfig is the OIDC configuration as an alternative to dex. type: string + priorityClassName: + description: PriorityClassName is the name of the PriorityClass resource + to be assigned to all ArgoCD component pods. + type: string prometheus: description: Prometheus defines the Prometheus server options for ArgoCD. @@ -18919,6 +19027,8 @@ spec: chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + The router service account needs to be granted with read-only access to this secret, + please refer to openshift docs for additional details. properties: name: description: |- @@ -18932,8 +19042,12 @@ spec: insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. - * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). - * None - no traffic is allowed on the insecure port. + If a route does not specify insecureEdgeTerminationPolicy, then the default behavior is "None". + + * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only). + + * None - no traffic is allowed on the insecure port (default). + * Redirect - clients are redirected to the secure port. enum: - Allow @@ -18946,10 +19060,12 @@ spec: type: string termination: description: |- - termination indicates termination type. + termination indicates the TLS termination type. * edge - TLS termination is done by the router and http is used to communicate with the backend (default) + * passthrough - Traffic is sent straight to the destination without the router providing TLS termination + * reencrypt - TLS termination is done by the router and https is used to communicate with the backend Note: passthrough termination is incompatible with httpHeader actions @@ -19015,6 +19131,11 @@ spec: redis: description: Redis defines the Redis server options for ArgoCD. properties: + annotations: + additionalProperties: + type: string + description: Custom annotations to pods deployed by the operator + type: object autotls: description: |- AutoTLS specifies the method to use for automatic TLS configuration for the redis server @@ -19032,6 +19153,11 @@ spec: image: description: Image is the Redis container image. type: string + labels: + additionalProperties: + type: string + description: Custom labels to pods deployed by the operator + type: object remote: description: Remote specifies the remote URL of the Redis container. (optional, by default, a local instance managed by the operator @@ -26794,6 +26920,8 @@ spec: chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + The router service account needs to be granted with read-only access to this secret, + please refer to openshift docs for additional details. properties: name: description: |- @@ -26807,8 +26935,12 @@ spec: insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. - * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). - * None - no traffic is allowed on the insecure port. + If a route does not specify insecureEdgeTerminationPolicy, then the default behavior is "None". + + * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only). + + * None - no traffic is allowed on the insecure port (default). + * Redirect - clients are redirected to the secure port. enum: - Allow @@ -26821,10 +26953,12 @@ spec: type: string termination: description: |- - termination indicates termination type. + termination indicates the TLS termination type. * edge - TLS termination is done by the router and http is used to communicate with the backend (default) + * passthrough - Traffic is sent straight to the destination without the router providing TLS termination + * reencrypt - TLS termination is done by the router and https is used to communicate with the backend Note: passthrough termination is incompatible with httpHeader actions @@ -30361,9 +30495,20 @@ spec: dex: description: Dex contains the configuration for Argo CD dex authentication properties: + annotations: + additionalProperties: + type: string + description: Custom annotations to pods deployed by the operator + type: object config: description: Config is the dex connector configuration. type: string + enableSATokenRenewal: + description: |- + EnableSATokenRenewal enables the short-lived Dex token renewal feature. + When true, the operator uses TokenRequest API for time-limited tokens. + When false (default), the operator uses the legacy non-expiring token approach. + type: boolean env: description: Env lets you specify environment variables for Dex. @@ -30532,6 +30677,11 @@ spec: image: description: Image is the Dex container image. type: string + labels: + additionalProperties: + type: string + description: Custom labels to pods deployed by the operator + type: object openShiftOAuth: description: OpenShiftOAuth enables OpenShift OAuth authentication for the Dex server. diff --git a/bundle/manifests/gitops-operator.clusterserviceversion.yaml b/bundle/manifests/gitops-operator.clusterserviceversion.yaml index cb42eba81eb..3b21e6aaf4d 100644 --- a/bundle/manifests/gitops-operator.clusterserviceversion.yaml +++ b/bundle/manifests/gitops-operator.clusterserviceversion.yaml @@ -190,7 +190,7 @@ metadata: capabilities: Deep Insights console.openshift.io/plugins: '["gitops-plugin"]' containerImage: quay.io/redhat-developer/gitops-operator - createdAt: "2026-07-02T15:48:02Z" + createdAt: "2026-07-27T17:23:34Z" description: Enables teams to adopt GitOps principles for managing cluster configurations and application delivery across hybrid multi-cluster Kubernetes environments. features.operators.openshift.io/disconnected: "true" diff --git a/config/crd/bases/argoproj.io_applications.yaml b/config/crd/bases/argoproj.io_applications.yaml index 022fb1d48b3..cb47657f75d 100644 --- a/config/crd/bases/argoproj.io_applications.yaml +++ b/config/crd/bases/argoproj.io_applications.yaml @@ -410,12 +410,12 @@ spec: apply common labels to resource selectors or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps + description: NamePrefix overrides the namePrefix in the + kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps + description: NameSuffix overrides the nameSuffix in the + kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -799,12 +799,12 @@ spec: to apply common labels to resource selectors or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps + description: NamePrefix overrides the namePrefix in + the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps + description: NameSuffix overrides the nameSuffix in + the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -1298,11 +1298,11 @@ spec: common labels to resource selectors or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources + description: NamePrefix overrides the namePrefix in the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources + description: NameSuffix overrides the nameSuffix in the kustomization.yaml for Kustomize apps type: string namespace: @@ -1675,12 +1675,12 @@ spec: apply common labels to resource selectors or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps + description: NamePrefix overrides the namePrefix in the + kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps + description: NameSuffix overrides the nameSuffix in the + kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -2086,12 +2086,12 @@ spec: common labels to resource selectors or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps + description: NamePrefix overrides the namePrefix in the + kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps + description: NameSuffix overrides the nameSuffix in the + kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -2645,12 +2645,12 @@ spec: to apply common labels to resource selectors or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps + description: NamePrefix overrides the namePrefix in + the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps + description: NameSuffix overrides the nameSuffix in + the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -3038,12 +3038,12 @@ spec: not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps + description: NamePrefix overrides the namePrefix in + the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps + description: NameSuffix overrides the nameSuffix in + the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -3190,6 +3190,7 @@ spec: observedAt: description: |- ObservedAt indicates when the application state was updated without querying latest git state + Deprecated: controller no longer updates ObservedAt field format: date-time type: string @@ -3586,12 +3587,12 @@ spec: or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to - resources for Kustomize apps + description: NamePrefix overrides the namePrefix + in the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to - resources for Kustomize apps + description: NameSuffix overrides the nameSuffix + in the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that @@ -3999,12 +4000,12 @@ spec: selectors or not type: boolean namePrefix: - description: NamePrefix is a prefix appended - to resources for Kustomize apps + description: NamePrefix overrides the namePrefix + in the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended - to resources for Kustomize apps + description: NameSuffix overrides the nameSuffix + in the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that @@ -4529,12 +4530,12 @@ spec: not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps + description: NamePrefix overrides the namePrefix in + the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps + description: NameSuffix overrides the nameSuffix in + the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -4933,12 +4934,12 @@ spec: not type: boolean namePrefix: - description: NamePrefix is a prefix appended to - resources for Kustomize apps + description: NamePrefix overrides the namePrefix + in the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to - resources for Kustomize apps + description: NameSuffix overrides the nameSuffix + in the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -5458,12 +5459,12 @@ spec: or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to - resources for Kustomize apps + description: NamePrefix overrides the namePrefix + in the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to - resources for Kustomize apps + description: NameSuffix overrides the nameSuffix + in the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that @@ -5911,12 +5912,12 @@ spec: or not type: boolean namePrefix: - description: NamePrefix is a prefix appended to - resources for Kustomize apps + description: NamePrefix overrides the namePrefix + in the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to - resources for Kustomize apps + description: NameSuffix overrides the nameSuffix + in the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that @@ -6424,12 +6425,12 @@ spec: not type: boolean namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps + description: NamePrefix overrides the namePrefix in + the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps + description: NameSuffix overrides the nameSuffix in + the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize @@ -6828,12 +6829,12 @@ spec: not type: boolean namePrefix: - description: NamePrefix is a prefix appended to - resources for Kustomize apps + description: NamePrefix overrides the namePrefix + in the kustomization.yaml for Kustomize apps type: string nameSuffix: - description: NameSuffix is a suffix appended to - resources for Kustomize apps + description: NameSuffix overrides the nameSuffix + in the kustomization.yaml for Kustomize apps type: string namespace: description: Namespace sets the namespace that Kustomize diff --git a/config/crd/bases/argoproj.io_applicationsets.yaml b/config/crd/bases/argoproj.io_applicationsets.yaml index ad3fe3cac18..5932f99479d 100644 --- a/config/crd/bases/argoproj.io_applicationsets.yaml +++ b/config/crd/bases/argoproj.io_applicationsets.yaml @@ -23115,6 +23115,16 @@ spec: - type type: object type: array + health: + properties: + lastTransitionTime: + format: date-time + type: string + message: + type: string + status: + type: string + type: object resources: items: properties: diff --git a/config/crd/bases/argoproj.io_argocds.yaml b/config/crd/bases/argoproj.io_argocds.yaml index 09c6829ba7d..eb3364fb203 100644 --- a/config/crd/bases/argoproj.io_argocds.yaml +++ b/config/crd/bases/argoproj.io_argocds.yaml @@ -416,6 +416,8 @@ spec: chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + The router service account needs to be granted with read-only access to this secret, + please refer to openshift docs for additional details. properties: name: description: |- @@ -429,8 +431,12 @@ spec: insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. - * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). - * None - no traffic is allowed on the insecure port. + If a route does not specify insecureEdgeTerminationPolicy, then the default behavior is "None". + + * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only). + + * None - no traffic is allowed on the insecure port (default). + * Redirect - clients are redirected to the secure port. enum: - Allow @@ -443,10 +449,12 @@ spec: type: string termination: description: |- - termination indicates termination type. + termination indicates the TLS termination type. * edge - TLS termination is done by the router and http is used to communicate with the backend (default) + * passthrough - Traffic is sent straight to the destination without the router providing TLS termination + * reencrypt - TLS termination is done by the router and https is used to communicate with the backend Note: passthrough termination is incompatible with httpHeader actions @@ -680,6 +688,11 @@ spec: image: description: Image is the name of Argo CD Agent image type: string + labelSelector: + description: |- + LabelSelector is a Kubernetes label selector that restricts which resources the agent watches. + Only resources matching this selector will be listed, watched, and processed by the agent. + type: string logFormat: description: LogFormat refers to the log format used by the Agent component. @@ -918,6 +931,11 @@ spec: the JWT signing key. type: string type: object + labelSelector: + description: |- + LabelSelector is a Kubernetes label selector that restricts which resources the principal watches. + Only resources matching this selector will be listed, watched, and processed by the principal. + type: string logFormat: description: LogFormat refers to the log format used by the Principal component. @@ -1375,8 +1393,9 @@ spec: minimum: 1 type: integer dynamicScalingEnabled: - description: DynamicScalingEnabled defines whether dynamic - scaling should be enabled for Application Controller component + description: |- + Deprecated: dynamicScalingEnabled is deprecated and will be removed in a future release. + DynamicScalingEnabled defines whether dynamic scaling should be enabled for Application Controller component. type: boolean enabled: description: Enabled defines whether sharding should be enabled @@ -1409,6 +1428,11 @@ spec: Deprecated field. Support dropped in v1beta1 version. Dex defines the Dex server options for ArgoCD. properties: + annotations: + additionalProperties: + type: string + description: Custom annotations to pods deployed by the operator + type: object config: description: Config is the dex connector configuration. type: string @@ -1421,6 +1445,11 @@ spec: image: description: Image is the Dex container image. type: string + labels: + additionalProperties: + type: string + description: Custom labels to pods deployed by the operator + type: object openShiftOAuth: description: OpenShiftOAuth enables OpenShift OAuth authentication for the Dex server. @@ -1689,6 +1718,8 @@ spec: chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + The router service account needs to be granted with read-only access to this secret, + please refer to openshift docs for additional details. properties: name: description: |- @@ -1702,8 +1733,12 @@ spec: insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. - * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). - * None - no traffic is allowed on the insecure port. + If a route does not specify insecureEdgeTerminationPolicy, then the default behavior is "None". + + * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only). + + * None - no traffic is allowed on the insecure port (default). + * Redirect - clients are redirected to the secure port. enum: - Allow @@ -1716,10 +1751,12 @@ spec: type: string termination: description: |- - termination indicates termination type. + termination indicates the TLS termination type. * edge - TLS termination is done by the router and http is used to communicate with the backend (default) + * passthrough - Traffic is sent straight to the destination without the router providing TLS termination + * reencrypt - TLS termination is done by the router and https is used to communicate with the backend Note: passthrough termination is incompatible with httpHeader actions @@ -2288,6 +2325,10 @@ spec: description: OIDCConfig is the OIDC configuration as an alternative to dex. type: string + priorityClassName: + description: PriorityClassName is the name of the PriorityClass resource + to be assigned to all ArgoCD component pods. + type: string prometheus: description: Prometheus defines the Prometheus server options for ArgoCD. @@ -2410,6 +2451,8 @@ spec: chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + The router service account needs to be granted with read-only access to this secret, + please refer to openshift docs for additional details. properties: name: description: |- @@ -2423,8 +2466,12 @@ spec: insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. - * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). - * None - no traffic is allowed on the insecure port. + If a route does not specify insecureEdgeTerminationPolicy, then the default behavior is "None". + + * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only). + + * None - no traffic is allowed on the insecure port (default). + * Redirect - clients are redirected to the secure port. enum: - Allow @@ -2437,10 +2484,12 @@ spec: type: string termination: description: |- - termination indicates termination type. + termination indicates the TLS termination type. * edge - TLS termination is done by the router and http is used to communicate with the backend (default) + * passthrough - Traffic is sent straight to the destination without the router providing TLS termination + * reencrypt - TLS termination is done by the router and https is used to communicate with the backend Note: passthrough termination is incompatible with httpHeader actions @@ -2506,6 +2555,11 @@ spec: redis: description: Redis defines the Redis server options for ArgoCD. properties: + annotations: + additionalProperties: + type: string + description: Custom annotations to pods deployed by the operator + type: object autotls: description: |- AutoTLS specifies the method to use for automatic TLS configuration for the redis server @@ -2519,6 +2573,11 @@ spec: image: description: Image is the Redis container image. type: string + labels: + additionalProperties: + type: string + description: Custom labels to pods deployed by the operator + type: object resources: description: Resources defines the Compute Resources required by the container for Redis. @@ -8486,6 +8545,8 @@ spec: chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + The router service account needs to be granted with read-only access to this secret, + please refer to openshift docs for additional details. properties: name: description: |- @@ -8499,8 +8560,12 @@ spec: insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. - * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). - * None - no traffic is allowed on the insecure port. + If a route does not specify insecureEdgeTerminationPolicy, then the default behavior is "None". + + * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only). + + * None - no traffic is allowed on the insecure port (default). + * Redirect - clients are redirected to the secure port. enum: - Allow @@ -8513,10 +8578,12 @@ spec: type: string termination: description: |- - termination indicates termination type. + termination indicates the TLS termination type. * edge - TLS termination is done by the router and http is used to communicate with the backend (default) + * passthrough - Traffic is sent straight to the destination without the router providing TLS termination + * reencrypt - TLS termination is done by the router and https is used to communicate with the backend Note: passthrough termination is incompatible with httpHeader actions @@ -8566,6 +8633,11 @@ spec: dex: description: Dex contains the configuration for Argo CD dex authentication properties: + annotations: + additionalProperties: + type: string + description: Custom annotations to pods deployed by the operator + type: object config: description: Config is the dex connector configuration. type: string @@ -8578,6 +8650,11 @@ spec: image: description: Image is the Dex container image. type: string + labels: + additionalProperties: + type: string + description: Custom labels to pods deployed by the operator + type: object openShiftOAuth: description: OpenShiftOAuth enables OpenShift OAuth authentication for the Dex server. @@ -11525,6 +11602,8 @@ spec: chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + The router service account needs to be granted with read-only access to this secret, + please refer to openshift docs for additional details. properties: name: description: |- @@ -11538,8 +11617,12 @@ spec: insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. - * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). - * None - no traffic is allowed on the insecure port. + If a route does not specify insecureEdgeTerminationPolicy, then the default behavior is "None". + + * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only). + + * None - no traffic is allowed on the insecure port (default). + * Redirect - clients are redirected to the secure port. enum: - Allow @@ -11552,10 +11635,12 @@ spec: type: string termination: description: |- - termination indicates termination type. + termination indicates the TLS termination type. * edge - TLS termination is done by the router and http is used to communicate with the backend (default) + * passthrough - Traffic is sent straight to the destination without the router providing TLS termination + * reencrypt - TLS termination is done by the router and https is used to communicate with the backend Note: passthrough termination is incompatible with httpHeader actions @@ -11810,6 +11895,11 @@ spec: image: description: Image is the name of Argo CD Agent image type: string + labelSelector: + description: |- + LabelSelector is a Kubernetes label selector that restricts which resources the agent watches. + Only resources matching this selector will be listed, watched, and processed by the agent. + type: string logFormat: description: LogFormat refers to the log format used by the Agent component. @@ -12112,6 +12202,11 @@ spec: the JWT signing key. type: string type: object + labelSelector: + description: |- + LabelSelector is a Kubernetes label selector that restricts which resources the principal watches. + Only resources matching this selector will be listed, watched, and processed by the principal. + type: string logFormat: description: LogFormat refers to the log format used by the Principal component. @@ -14202,8 +14297,9 @@ spec: minimum: 1 type: integer dynamicScalingEnabled: - description: DynamicScalingEnabled defines whether dynamic - scaling should be enabled for Application Controller component + description: |- + Deprecated: dynamicScalingEnabled is deprecated and will be removed in a future release. + DynamicScalingEnabled defines whether dynamic scaling should be enabled for Application Controller component. type: boolean enabled: description: Enabled defines whether sharding should be enabled @@ -17918,6 +18014,8 @@ spec: chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + The router service account needs to be granted with read-only access to this secret, + please refer to openshift docs for additional details. properties: name: description: |- @@ -17931,8 +18029,12 @@ spec: insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. - * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). - * None - no traffic is allowed on the insecure port. + If a route does not specify insecureEdgeTerminationPolicy, then the default behavior is "None". + + * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only). + + * None - no traffic is allowed on the insecure port (default). + * Redirect - clients are redirected to the secure port. enum: - Allow @@ -17945,10 +18047,12 @@ spec: type: string termination: description: |- - termination indicates termination type. + termination indicates the TLS termination type. * edge - TLS termination is done by the router and http is used to communicate with the backend (default) + * passthrough - Traffic is sent straight to the destination without the router providing TLS termination + * reencrypt - TLS termination is done by the router and https is used to communicate with the backend Note: passthrough termination is incompatible with httpHeader actions @@ -18786,6 +18890,10 @@ spec: description: OIDCConfig is the OIDC configuration as an alternative to dex. type: string + priorityClassName: + description: PriorityClassName is the name of the PriorityClass resource + to be assigned to all ArgoCD component pods. + type: string prometheus: description: Prometheus defines the Prometheus server options for ArgoCD. @@ -18908,6 +19016,8 @@ spec: chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + The router service account needs to be granted with read-only access to this secret, + please refer to openshift docs for additional details. properties: name: description: |- @@ -18921,8 +19031,12 @@ spec: insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. - * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). - * None - no traffic is allowed on the insecure port. + If a route does not specify insecureEdgeTerminationPolicy, then the default behavior is "None". + + * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only). + + * None - no traffic is allowed on the insecure port (default). + * Redirect - clients are redirected to the secure port. enum: - Allow @@ -18935,10 +19049,12 @@ spec: type: string termination: description: |- - termination indicates termination type. + termination indicates the TLS termination type. * edge - TLS termination is done by the router and http is used to communicate with the backend (default) + * passthrough - Traffic is sent straight to the destination without the router providing TLS termination + * reencrypt - TLS termination is done by the router and https is used to communicate with the backend Note: passthrough termination is incompatible with httpHeader actions @@ -19004,6 +19120,11 @@ spec: redis: description: Redis defines the Redis server options for ArgoCD. properties: + annotations: + additionalProperties: + type: string + description: Custom annotations to pods deployed by the operator + type: object autotls: description: |- AutoTLS specifies the method to use for automatic TLS configuration for the redis server @@ -19021,6 +19142,11 @@ spec: image: description: Image is the Redis container image. type: string + labels: + additionalProperties: + type: string + description: Custom labels to pods deployed by the operator + type: object remote: description: Remote specifies the remote URL of the Redis container. (optional, by default, a local instance managed by the operator @@ -26783,6 +26909,8 @@ spec: chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + The router service account needs to be granted with read-only access to this secret, + please refer to openshift docs for additional details. properties: name: description: |- @@ -26796,8 +26924,12 @@ spec: insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. - * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). - * None - no traffic is allowed on the insecure port. + If a route does not specify insecureEdgeTerminationPolicy, then the default behavior is "None". + + * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only). + + * None - no traffic is allowed on the insecure port (default). + * Redirect - clients are redirected to the secure port. enum: - Allow @@ -26810,10 +26942,12 @@ spec: type: string termination: description: |- - termination indicates termination type. + termination indicates the TLS termination type. * edge - TLS termination is done by the router and http is used to communicate with the backend (default) + * passthrough - Traffic is sent straight to the destination without the router providing TLS termination + * reencrypt - TLS termination is done by the router and https is used to communicate with the backend Note: passthrough termination is incompatible with httpHeader actions @@ -30350,9 +30484,20 @@ spec: dex: description: Dex contains the configuration for Argo CD dex authentication properties: + annotations: + additionalProperties: + type: string + description: Custom annotations to pods deployed by the operator + type: object config: description: Config is the dex connector configuration. type: string + enableSATokenRenewal: + description: |- + EnableSATokenRenewal enables the short-lived Dex token renewal feature. + When true, the operator uses TokenRequest API for time-limited tokens. + When false (default), the operator uses the legacy non-expiring token approach. + type: boolean env: description: Env lets you specify environment variables for Dex. @@ -30521,6 +30666,11 @@ spec: image: description: Image is the Dex container image. type: string + labels: + additionalProperties: + type: string + description: Custom labels to pods deployed by the operator + type: object openShiftOAuth: description: OpenShiftOAuth enables OpenShift OAuth authentication for the Dex server. From 879113137470fd23187b8385fc999a5730d4b844 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Tue, 28 Jul 2026 16:44:17 +0530 Subject: [PATCH 6/6] feat(redis-ha-proxy): Configure Redis Ha Proxy TLS settings Signed-off-by: akhil nittala --- .../parallel/1-098_validate_dex_clientsecret_deprecated.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/test/openshift/e2e/ginkgo/parallel/1-098_validate_dex_clientsecret_deprecated.go b/test/openshift/e2e/ginkgo/parallel/1-098_validate_dex_clientsecret_deprecated.go index 2eaa3c002c7..db1cfa7f35f 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-098_validate_dex_clientsecret_deprecated.go +++ b/test/openshift/e2e/ginkgo/parallel/1-098_validate_dex_clientsecret_deprecated.go @@ -23,6 +23,7 @@ import ( argov1beta1api "github.com/argoproj-labs/argocd-operator/api/v1beta1" . "github.com/onsi/ginkgo/v2" . "github.com/onsi/gomega" + "github.com/redhat-developer/gitops-operator/controllers/util" "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture" argocdFixture "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture/argocd" k8sFixture "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture/k8s" @@ -64,7 +65,8 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { SSO: &argov1beta1api.ArgoCDSSOSpec{ Provider: argov1beta1api.SSOProviderTypeDex, Dex: &argov1beta1api.ArgoCDDexSpec{ - OpenShiftOAuth: true, + OpenShiftOAuth: true, + EnableSATokenRenewal: util.BoolPtr(true), }, }, },