Bump version to 2.3.17

Merge pull request from GHSA-3jfq-742w-xg8j
2026-03-14 12:28:48 +01:00 · 2023-02-16 14:37:35 +00:00 · 2023-02-16 14:37:22 +00:00 · 2023-02-16 09:07:57 -05:00 · 2023-02-09 12:20:37 -05:00 · 2023-02-03 10:29:33 -05:00
16 changed files with 175 additions and 37 deletions
--- a/.github/workflows/ci-build.yaml
+++ b/.github/workflows/ci-build.yaml
@@ -113,6 +113,10 @@ jobs:
      - name: Install all tools required for building & testing
        run: |
          make install-test-tools-local
+        # We install kustomize in the dist directory
+      - name: Add dist to PATH
+        run: |
+          echo "/home/runner/work/argo-cd/argo-cd/dist" >> $GITHUB_PATH
      - name: Setup git username and email
        run: |
          git config --global user.name "John Doe"
@@ -173,6 +177,10 @@ jobs:
      - name: Install all tools required for building & testing
        run: |
          make install-test-tools-local
+        # We install kustomize in the dist directory
+      - name: Add dist to PATH
+        run: |
+          echo "/home/runner/work/argo-cd/argo-cd/dist" >> $GITHUB_PATH
      - name: Setup git username and email
        run: |
          git config --global user.name "John Doe"
@@ -219,6 +227,10 @@ jobs:
          make install-codegen-tools-local
          make install-go-tools-local
        working-directory: /home/runner/go/src/github.com/argoproj/argo-cd
+        # We install kustomize in the dist directory
+      - name: Add dist to PATH
+        run: |
+          echo "/home/runner/work/argo-cd/argo-cd/dist" >> $GITHUB_PATH
      - name: Initialize local Helm
        run: |
          helm2 init --client-only
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -178,6 +178,10 @@ jobs:
          set -ue
          make install-codegen-tools-local
          helm2 init --client-only
+          
+          # We install kustomize in the dist directory
+          echo "/home/runner/work/argo-cd/argo-cd/dist" >> $GITHUB_PATH
+          
          make manifests-local VERSION=${TARGET_VERSION}
          git diff
          git commit manifests/ -m "Bump version to ${TARGET_VERSION}"
--- a/2
+++ b/2
@@ -1 +1 @@
-2.3.16
+2.3.17
--- a/common/common.go
+++ b/common/common.go
@@ -4,6 +4,9 @@ import (
 	"errors"
 	"os"
 	"time"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )

 // Default service addresses and URLS of Argo CD internal services
@@ -247,3 +250,5 @@ func GetPluginSockFilePath() string {
 const TokenVerificationError = "failed to verify the token"

 var TokenVerificationErr = errors.New(TokenVerificationError)
+
+var PermissionDeniedAPIError = status.Error(codes.PermissionDenied, "permission denied")
--- a/docs/operator-manual/application.yaml
+++ b/docs/operator-manual/application.yaml
@@ -116,7 +116,11 @@ spec:

  # Destination cluster and namespace to deploy the application
  destination:
+    # cluster API URL
    server: https://kubernetes.default.svc
+    # or cluster name
+    # name: in-cluster
+    # The namespace will only be set for namespace-scoped resources that have not set a value for .metadata.namespace
    namespace: guestbook

  # Sync policy
--- a/docs/operator-manual/upgrading/1.8-2.0.md
+++ b/docs/operator-manual/upgrading/1.8-2.0.md
@@ -1,4 +1,4 @@
-# v1.8 to v2.0
+# v1.8 to 2.0

 ## Redis Upgraded to v6.2.1

--- a/manifests/base/kustomization.yaml
+++ b/manifests/base/kustomization.yaml
@@ -5,7 +5,7 @@ kind: Kustomization
 images:
 - name: quay.io/argoproj/argocd
  newName: quay.io/argoproj/argocd
-  newTag: v2.3.16
+  newTag: v2.3.17
 resources:
 - ./application-controller
 - ./dex
--- a/manifests/core-install.yaml
+++ b/manifests/core-install.yaml
@@ -9698,7 +9698,7 @@ spec:
          value: /helm-working-dir
        - name: HELM_DATA_HOME
          value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -9747,7 +9747,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /var/run/argocd/argocd-cmp-server
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        name: copyutil
        volumeMounts:
        - mountPath: /var/run/argocd
@@ -9912,7 +9912,7 @@ spec:
              key: controller.default.cache.expiration
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
--- a/manifests/core-install/kustomization.yaml
+++ b/manifests/core-install/kustomization.yaml
@@ -11,4 +11,4 @@ resources:
 images:
 - name: quay.io/argoproj/argocd
  newName: quay.io/argoproj/argocd
-  newTag: v2.3.16
+  newTag: v2.3.17
--- a/manifests/ha/base/kustomization.yaml
+++ b/manifests/ha/base/kustomization.yaml
@@ -11,7 +11,7 @@ patchesStrategicMerge:
 images:
 - name: quay.io/argoproj/argocd
  newName: quay.io/argoproj/argocd
-  newTag: v2.3.16
+  newTag: v2.3.17
 resources:
 - ../../base/application-controller
 - ../../base/dex
--- a/manifests/ha/install.yaml
+++ b/manifests/ha/install.yaml
@@ -10516,7 +10516,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        name: copyutil
        volumeMounts:
@@ -10549,7 +10549,7 @@ spec:
      containers:
      - command:
        - argocd-notifications
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          tcpSocket:
@@ -10788,7 +10788,7 @@ spec:
          value: /helm-working-dir
        - name: HELM_DATA_HOME
          value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -10837,7 +10837,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /var/run/argocd/argocd-cmp-server
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        name: copyutil
        volumeMounts:
        - mountPath: /var/run/argocd
@@ -11064,7 +11064,7 @@ spec:
              key: server.http.cookie.maxnumber
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
@@ -11260,7 +11260,7 @@ spec:
              key: controller.default.cache.expiration
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
--- a/manifests/ha/namespace-install.yaml
+++ b/manifests/ha/namespace-install.yaml
@@ -7812,7 +7812,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        name: copyutil
        volumeMounts:
@@ -7845,7 +7845,7 @@ spec:
      containers:
      - command:
        - argocd-notifications
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          tcpSocket:
@@ -8084,7 +8084,7 @@ spec:
          value: /helm-working-dir
        - name: HELM_DATA_HOME
          value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -8133,7 +8133,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /var/run/argocd/argocd-cmp-server
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        name: copyutil
        volumeMounts:
        - mountPath: /var/run/argocd
@@ -8360,7 +8360,7 @@ spec:
              key: server.http.cookie.maxnumber
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
@@ -8556,7 +8556,7 @@ spec:
              key: controller.default.cache.expiration
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
--- a/manifests/install.yaml
+++ b/manifests/install.yaml
@@ -9886,7 +9886,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        name: copyutil
        volumeMounts:
@@ -9919,7 +9919,7 @@ spec:
      containers:
      - command:
        - argocd-notifications
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          tcpSocket:
@@ -10122,7 +10122,7 @@ spec:
          value: /helm-working-dir
        - name: HELM_DATA_HOME
          value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -10171,7 +10171,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /var/run/argocd/argocd-cmp-server
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        name: copyutil
        volumeMounts:
        - mountPath: /var/run/argocd
@@ -10394,7 +10394,7 @@ spec:
              key: server.http.cookie.maxnumber
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
@@ -10584,7 +10584,7 @@ spec:
              key: controller.default.cache.expiration
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
--- a/manifests/namespace-install.yaml
+++ b/manifests/namespace-install.yaml
@@ -7182,7 +7182,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        name: copyutil
        volumeMounts:
@@ -7215,7 +7215,7 @@ spec:
      containers:
      - command:
        - argocd-notifications
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          tcpSocket:
@@ -7418,7 +7418,7 @@ spec:
          value: /helm-working-dir
        - name: HELM_DATA_HOME
          value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
@@ -7467,7 +7467,7 @@ spec:
        - -n
        - /usr/local/bin/argocd
        - /var/run/argocd/argocd-cmp-server
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        name: copyutil
        volumeMounts:
        - mountPath: /var/run/argocd
@@ -7690,7 +7690,7 @@ spec:
              key: server.http.cookie.maxnumber
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
@@ -7880,7 +7880,7 @@ spec:
              key: controller.default.cache.expiration
              name: argocd-cmd-params-cm
              optional: true
-        image: quay.io/argoproj/argocd:v2.3.16
+        image: quay.io/argoproj/argocd:v2.3.17
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
--- a/server/cluster/cluster.go
+++ b/server/cluster/cluster.go
@@ -13,6 +13,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/client-go/kubernetes"

+	"github.com/argoproj/argo-cd/v2/common"
 	"github.com/argoproj/argo-cd/v2/pkg/apiclient/cluster"
 	appv1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
 	servercache "github.com/argoproj/argo-cd/v2/server/cache"
@@ -134,7 +135,7 @@ func (s *Server) Get(ctx context.Context, q *cluster.ClusterQuery) (*appv1.Clust
 func (s *Server) getClusterWith403IfNotExist(ctx context.Context, q *cluster.ClusterQuery) (*appv1.Cluster, error) {
 	repo, err := s.getCluster(ctx, q)
 	if err != nil || repo == nil {
-		return nil, status.Error(codes.PermissionDenied, "permission denied")
+		return nil, common.PermissionDeniedAPIError
 	}
 	return repo, nil
 }
@@ -220,14 +221,14 @@ func (s *Server) Update(ctx context.Context, q *cluster.ClusterUpdateRequest) (*
 	}

 	// verify that user can do update inside project where cluster is located
-	if err := s.enf.EnforceErr(ctx.Value("claims"), rbacpolicy.ResourceClusters, rbacpolicy.ActionUpdate, createRBACObject(c.Project, q.Cluster.Server)); err != nil {
-		return nil, err
+	if !s.enf.Enforce(ctx.Value("claims"), rbacpolicy.ResourceClusters, rbacpolicy.ActionUpdate, createRBACObject(c.Project, c.Server)) {
+		return nil, common.PermissionDeniedAPIError
 	}

 	if len(q.UpdatedFields) == 0 || sets.NewString(q.UpdatedFields...).Has("project") {
 		// verify that user can do update inside project where cluster will be located
-		if err := s.enf.EnforceErr(ctx.Value("claims"), rbacpolicy.ResourceClusters, rbacpolicy.ActionUpdate, createRBACObject(q.Cluster.Project, q.Cluster.Server)); err != nil {
-			return nil, err
+		if !s.enf.Enforce(ctx.Value("claims"), rbacpolicy.ResourceClusters, rbacpolicy.ActionUpdate, createRBACObject(q.Cluster.Project, c.Server)) {
+			return nil, common.PermissionDeniedAPIError
 		}
 	}

--- a/server/cluster/cluster_test.go
+++ b/server/cluster/cluster_test.go
@@ -2,6 +2,7 @@ package cluster

 import (
 	"context"
+	"fmt"
 	"testing"
 	"time"

@@ -43,6 +44,117 @@ func newNoopEnforcer() *rbac.Enforcer {
 	return enf
 }

+func TestUpdateCluster_RejectInvalidParams(t *testing.T) {
+	testCases := []struct {
+		name    string
+		request clusterapi.ClusterUpdateRequest
+	}{
+		{
+			name:    "allowed cluster URL in body, disallowed cluster URL in query",
+			request: clusterapi.ClusterUpdateRequest{Cluster: &v1alpha1.Cluster{Name: "", Server: "https://127.0.0.1", Project: "", ClusterResources: true}, Id: &clusterapi.ClusterID{Type: "", Value: "https://127.0.0.2"}, UpdatedFields: []string{"clusterResources", "project"}},
+		},
+		{
+			name:    "allowed cluster URL in body, disallowed cluster name in query",
+			request: clusterapi.ClusterUpdateRequest{Cluster: &v1alpha1.Cluster{Name: "", Server: "https://127.0.0.1", Project: "", ClusterResources: true}, Id: &clusterapi.ClusterID{Type: "name", Value: "disallowed-unscoped"}, UpdatedFields: []string{"clusterResources", "project"}},
+		},
+		{
+			name:    "allowed cluster URL in body, disallowed cluster name in query, changing unscoped to scoped",
+			request: clusterapi.ClusterUpdateRequest{Cluster: &v1alpha1.Cluster{Name: "", Server: "https://127.0.0.1", Project: "allowed-project", ClusterResources: true}, Id: &clusterapi.ClusterID{Type: "", Value: "https://127.0.0.2"}, UpdatedFields: []string{"clusterResources", "project"}},
+		},
+		{
+			name:    "allowed cluster URL in body, disallowed cluster URL in query, changing unscoped to scoped",
+			request: clusterapi.ClusterUpdateRequest{Cluster: &v1alpha1.Cluster{Name: "", Server: "https://127.0.0.1", Project: "allowed-project", ClusterResources: true}, Id: &clusterapi.ClusterID{Type: "name", Value: "disallowed-unscoped"}, UpdatedFields: []string{"clusterResources", "project"}},
+		},
+	}
+
+	db := &dbmocks.ArgoDB{}
+
+	clusters := []v1alpha1.Cluster{
+		{
+			Name:   "allowed-unscoped",
+			Server: "https://127.0.0.1",
+		},
+		{
+			Name:   "disallowed-unscoped",
+			Server: "https://127.0.0.2",
+		},
+		{
+			Name:    "allowed-scoped",
+			Server:  "https://127.0.0.3",
+			Project: "allowed-project",
+		},
+		{
+			Name:    "disallowed-scoped",
+			Server:  "https://127.0.0.4",
+			Project: "disallowed-project",
+		},
+	}
+
+	db.On("ListClusters", mock.Anything).Return(
+		func(ctx context.Context) *v1alpha1.ClusterList {
+			return &v1alpha1.ClusterList{
+				ListMeta: v1.ListMeta{},
+				Items:    clusters,
+			}
+		},
+		func(ctx context.Context) error {
+			return nil
+		},
+	)
+	db.On("UpdateCluster", mock.Anything, mock.Anything).Return(
+		func(ctx context.Context, c *v1alpha1.Cluster) *v1alpha1.Cluster {
+			for _, cluster := range clusters {
+				if c.Server == cluster.Server {
+					return c
+				}
+			}
+			return nil
+		},
+		func(ctx context.Context, c *v1alpha1.Cluster) error {
+			for _, cluster := range clusters {
+				if c.Server == cluster.Server {
+					return nil
+				}
+			}
+			return fmt.Errorf("cluster '%s' not found", c.Server)
+		},
+	)
+	db.On("GetCluster", mock.Anything, mock.Anything).Return(
+		func(ctx context.Context, server string) *v1alpha1.Cluster {
+			for _, cluster := range clusters {
+				if server == cluster.Server {
+					return &cluster
+				}
+			}
+			return nil
+		},
+		func(ctx context.Context, server string) error {
+			for _, cluster := range clusters {
+				if server == cluster.Server {
+					return nil
+				}
+			}
+			return fmt.Errorf("cluster '%s' not found", server)
+		},
+	)
+
+	enf := rbac.NewEnforcer(fake.NewSimpleClientset(test.NewFakeConfigMap()), test.FakeArgoCDNamespace, common.ArgoCDConfigMapName, nil)
+	_ = enf.SetBuiltinPolicy(`p, role:test, clusters, *, https://127.0.0.1, allow
+p, role:test, clusters, *, allowed-project/*, allow`)
+	enf.SetDefaultRole("role:test")
+	server := NewServer(db, enf, newServerInMemoryCache(), &kubetest.MockKubectlCmd{})
+
+	for _, c := range testCases {
+		cc := c
+		t.Run(cc.name, func(t *testing.T) {
+			t.Parallel()
+			out, err := server.Update(context.Background(), &cc.request)
+			require.Nil(t, out)
+			assert.ErrorIs(t, err, common.PermissionDeniedAPIError)
+		})
+	}
+}
+
 func TestGetCluster_UrlEncodedName(t *testing.T) {
 	db := &dbmocks.ArgoDB{}
Author	SHA1	Message	Date
argo-bot	2de6920da4	Bump version to 2.3.17	2023-02-16 14:37:35 +00:00
argo-bot	70fef5b5a8	Bump version to 2.3.17	2023-02-16 14:37:22 +00:00
Michael Crenshaw	9d092ddff8	Merge pull request from GHSA-3jfq-742w-xg8j fix test name Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>	2023-02-16 09:07:57 -05:00
Michael Crenshaw	ab907e1154	chore: add dist to path to use our kustomize version (#12352 ) * chore: add dist to path to use our kustomize version Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> * correct path Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> * missed a spot Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> --------- Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>	2023-02-09 12:20:37 -05:00
Josh Soref	9061ae2495	docs: Fix heading to not include a v for the second version (#12218 ) Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>	2023-02-03 10:29:33 -05:00
Thomas Decaux	6ee8d1cda8	docs: add destination.name example (#12242 ) I had trouble finding the documentation to use the cluster name for destination, instead of the full URL. This is really useful. Use case: we manage multiple clusters, destination.name is a better way to set destination. Signed-off-by: Thomas Decaux <ebuildy@gmail.com> Signed-off-by: ebuildy <ebuildy@gmail.com>	2023-02-02 12:57:03 -05:00
@@ -1 +1 @@
 .3.16
 .3.17