Compare commits

...

6 Commits

Author SHA1 Message Date
argo-bot
e86cf5d705 Bump version to 2.4.23 2023-02-16 14:40:28 +00:00
argo-bot
8f0d27705e Bump version to 2.4.23 2023-02-16 14:40:22 +00:00
Michael Crenshaw
5831a573aa Merge pull request from GHSA-3jfq-742w-xg8j
fix test name

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>
2023-02-16 09:07:57 -05:00
Michael Crenshaw
90869357fb chore: add dist to path to use our kustomize version (#12352)
* chore: add dist to path to use our kustomize version

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>

* correct path

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>

* missed a spot

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>

---------

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>
2023-02-09 12:18:33 -05:00
Josh Soref
d0551e4c1a docs: Fix heading to not include a v for the second version (#12218)
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
2023-02-03 10:29:27 -05:00
Thomas Decaux
402b38dc7d docs: add destination.name example (#12242)
I had trouble finding the documentation to use the cluster name for destination, instead of the full URL. This is really useful.

Use case: we manage multiple clusters, destination.name is a better way to set destination.

Signed-off-by: Thomas Decaux <ebuildy@gmail.com>
Signed-off-by: ebuildy <ebuildy@gmail.com>
2023-02-02 12:56:27 -05:00
16 changed files with 178 additions and 42 deletions

View File

@@ -123,6 +123,10 @@ jobs:
- name: Install all tools required for building & testing
run: |
make install-test-tools-local
# We install kustomize in the dist directory
- name: Add dist to PATH
run: |
echo "/home/runner/work/argo-cd/argo-cd/dist" >> $GITHUB_PATH
- name: Setup git username and email
run: |
git config --global user.name "John Doe"
@@ -186,6 +190,10 @@ jobs:
- name: Install all tools required for building & testing
run: |
make install-test-tools-local
# We install kustomize in the dist directory
- name: Add dist to PATH
run: |
echo "/home/runner/work/argo-cd/argo-cd/dist" >> $GITHUB_PATH
- name: Setup git username and email
run: |
git config --global user.name "John Doe"
@@ -232,6 +240,10 @@ jobs:
make install-codegen-tools-local
make install-go-tools-local
working-directory: /home/runner/go/src/github.com/argoproj/argo-cd
# We install kustomize in the dist directory
- name: Add dist to PATH
run: |
echo "/home/runner/work/argo-cd/argo-cd/dist" >> $GITHUB_PATH
- name: Run codegen
run: |
set -x

View File

@@ -177,6 +177,10 @@ jobs:
run: |
set -ue
make install-codegen-tools-local
# We install kustomize in the dist directory
echo "/home/runner/work/argo-cd/argo-cd/dist" >> $GITHUB_PATH
make manifests-local VERSION=${TARGET_VERSION}
git diff
git commit manifests/ -m "Bump version to ${TARGET_VERSION}"

View File

@@ -1 +1 @@
2.4.22
2.4.23

View File

@@ -8,6 +8,8 @@ import (
"time"
"github.com/sirupsen/logrus"
"google.golang.org/grpc/codes"
"google.golang.org/grpc/status"
)
// Default service addresses and URLS of Argo CD internal services
@@ -299,3 +301,5 @@ const (
const TokenVerificationError = "failed to verify the token"
var TokenVerificationErr = errors.New(TokenVerificationError)
var PermissionDeniedAPIError = status.Error(codes.PermissionDenied, "permission denied")

View File

@@ -125,7 +125,10 @@ spec:
# Destination cluster and namespace to deploy the application
destination:
# cluster API URL
server: https://kubernetes.default.svc
# or cluster name
# name: in-cluster
# The namespace will only be set for namespace-scoped resources that have not set a value for .metadata.namespace
namespace: guestbook

View File

@@ -1,4 +1,4 @@
# v1.8 to v2.0
# v1.8 to 2.0
## Redis Upgraded to v6.2.1

View File

@@ -5,7 +5,7 @@ kind: Kustomization
images:
- name: quay.io/argoproj/argocd
newName: quay.io/argoproj/argocd
newTag: v2.4.22
newTag: v2.4.23
resources:
- ./application-controller
- ./dex

View File

@@ -9384,7 +9384,7 @@ spec:
valueFrom:
fieldRef:
fieldPath: metadata.namespace
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
name: argocd-applicationset-controller
ports:
@@ -9614,7 +9614,7 @@ spec:
value: /helm-working-dir
- name: HELM_DATA_HOME
value: /helm-working-dir
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
failureThreshold: 3
@@ -9663,7 +9663,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /var/run/argocd/argocd-cmp-server
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
name: copyutil
securityContext:
allowPrivilegeEscalation: false
@@ -9850,7 +9850,7 @@ spec:
key: otlp.address
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
httpGet:

View File

@@ -12,4 +12,4 @@ resources:
images:
- name: quay.io/argoproj/argocd
newName: quay.io/argoproj/argocd
newTag: v2.4.22
newTag: v2.4.23

View File

@@ -11,7 +11,7 @@ patchesStrategicMerge:
images:
- name: quay.io/argoproj/argocd
newName: quay.io/argoproj/argocd
newTag: v2.4.22
newTag: v2.4.23
resources:
- ../../base/application-controller
- ../../base/applicationset-controller

View File

@@ -10319,7 +10319,7 @@ spec:
valueFrom:
fieldRef:
fieldPath: metadata.namespace
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
name: argocd-applicationset-controller
ports:
@@ -10416,7 +10416,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /shared/argocd-dex
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
name: copyutil
securityContext:
@@ -10456,7 +10456,7 @@ spec:
containers:
- command:
- argocd-notifications
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
tcpSocket:
@@ -10713,7 +10713,7 @@ spec:
value: /helm-working-dir
- name: HELM_DATA_HOME
value: /helm-working-dir
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
failureThreshold: 3
@@ -10762,7 +10762,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /var/run/argocd/argocd-cmp-server
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
name: copyutil
securityContext:
allowPrivilegeEscalation: false
@@ -11009,7 +11009,7 @@ spec:
key: otlp.address
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
httpGet:
@@ -11217,7 +11217,7 @@ spec:
key: otlp.address
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
httpGet:

View File

@@ -1244,7 +1244,7 @@ spec:
valueFrom:
fieldRef:
fieldPath: metadata.namespace
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
name: argocd-applicationset-controller
ports:
@@ -1341,7 +1341,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /shared/argocd-dex
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
name: copyutil
securityContext:
@@ -1381,7 +1381,7 @@ spec:
containers:
- command:
- argocd-notifications
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
tcpSocket:
@@ -1638,7 +1638,7 @@ spec:
value: /helm-working-dir
- name: HELM_DATA_HOME
value: /helm-working-dir
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
failureThreshold: 3
@@ -1687,7 +1687,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /var/run/argocd/argocd-cmp-server
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
name: copyutil
securityContext:
allowPrivilegeEscalation: false
@@ -1934,7 +1934,7 @@ spec:
key: otlp.address
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
httpGet:
@@ -2142,7 +2142,7 @@ spec:
key: otlp.address
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
httpGet:

View File

@@ -9691,7 +9691,7 @@ spec:
valueFrom:
fieldRef:
fieldPath: metadata.namespace
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
name: argocd-applicationset-controller
ports:
@@ -9788,7 +9788,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /shared/argocd-dex
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
name: copyutil
securityContext:
@@ -9828,7 +9828,7 @@ spec:
containers:
- command:
- argocd-notifications
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
tcpSocket:
@@ -10053,7 +10053,7 @@ spec:
value: /helm-working-dir
- name: HELM_DATA_HOME
value: /helm-working-dir
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
failureThreshold: 3
@@ -10102,7 +10102,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /var/run/argocd/argocd-cmp-server
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
name: copyutil
securityContext:
allowPrivilegeEscalation: false
@@ -10345,7 +10345,7 @@ spec:
key: otlp.address
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
httpGet:
@@ -10547,7 +10547,7 @@ spec:
key: otlp.address
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
httpGet:

View File

@@ -616,7 +616,7 @@ spec:
valueFrom:
fieldRef:
fieldPath: metadata.namespace
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
name: argocd-applicationset-controller
ports:
@@ -713,7 +713,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /shared/argocd-dex
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
name: copyutil
securityContext:
@@ -753,7 +753,7 @@ spec:
containers:
- command:
- argocd-notifications
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
tcpSocket:
@@ -978,7 +978,7 @@ spec:
value: /helm-working-dir
- name: HELM_DATA_HOME
value: /helm-working-dir
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
failureThreshold: 3
@@ -1027,7 +1027,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /var/run/argocd/argocd-cmp-server
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
name: copyutil
securityContext:
allowPrivilegeEscalation: false
@@ -1270,7 +1270,7 @@ spec:
key: otlp.address
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
httpGet:
@@ -1472,7 +1472,7 @@ spec:
key: otlp.address
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.4.22
image: quay.io/argoproj/argocd:v2.4.23
imagePullPolicy: Always
livenessProbe:
httpGet:

View File

@@ -13,6 +13,7 @@ import (
"k8s.io/apimachinery/pkg/util/sets"
"k8s.io/client-go/kubernetes"
"github.com/argoproj/argo-cd/v2/common"
"github.com/argoproj/argo-cd/v2/pkg/apiclient/cluster"
appv1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
servercache "github.com/argoproj/argo-cd/v2/server/cache"
@@ -134,7 +135,7 @@ func (s *Server) Get(ctx context.Context, q *cluster.ClusterQuery) (*appv1.Clust
func (s *Server) getClusterWith403IfNotExist(ctx context.Context, q *cluster.ClusterQuery) (*appv1.Cluster, error) {
repo, err := s.getCluster(ctx, q)
if err != nil || repo == nil {
return nil, status.Error(codes.PermissionDenied, "permission denied")
return nil, common.PermissionDeniedAPIError
}
return repo, nil
}
@@ -220,14 +221,14 @@ func (s *Server) Update(ctx context.Context, q *cluster.ClusterUpdateRequest) (*
}
// verify that user can do update inside project where cluster is located
if err := s.enf.EnforceErr(ctx.Value("claims"), rbacpolicy.ResourceClusters, rbacpolicy.ActionUpdate, createRBACObject(c.Project, q.Cluster.Server)); err != nil {
return nil, err
if !s.enf.Enforce(ctx.Value("claims"), rbacpolicy.ResourceClusters, rbacpolicy.ActionUpdate, createRBACObject(c.Project, c.Server)) {
return nil, common.PermissionDeniedAPIError
}
if len(q.UpdatedFields) == 0 || sets.NewString(q.UpdatedFields...).Has("project") {
// verify that user can do update inside project where cluster will be located
if err := s.enf.EnforceErr(ctx.Value("claims"), rbacpolicy.ResourceClusters, rbacpolicy.ActionUpdate, createRBACObject(q.Cluster.Project, q.Cluster.Server)); err != nil {
return nil, err
if !s.enf.Enforce(ctx.Value("claims"), rbacpolicy.ResourceClusters, rbacpolicy.ActionUpdate, createRBACObject(q.Cluster.Project, c.Server)) {
return nil, common.PermissionDeniedAPIError
}
}

View File

@@ -2,6 +2,7 @@ package cluster
import (
"context"
"fmt"
"testing"
"time"
@@ -48,6 +49,117 @@ func newNoopEnforcer() *rbac.Enforcer {
return enf
}
func TestUpdateCluster_RejectInvalidParams(t *testing.T) {
testCases := []struct {
name string
request clusterapi.ClusterUpdateRequest
}{
{
name: "allowed cluster URL in body, disallowed cluster URL in query",
request: clusterapi.ClusterUpdateRequest{Cluster: &v1alpha1.Cluster{Name: "", Server: "https://127.0.0.1", Project: "", ClusterResources: true}, Id: &clusterapi.ClusterID{Type: "", Value: "https://127.0.0.2"}, UpdatedFields: []string{"clusterResources", "project"}},
},
{
name: "allowed cluster URL in body, disallowed cluster name in query",
request: clusterapi.ClusterUpdateRequest{Cluster: &v1alpha1.Cluster{Name: "", Server: "https://127.0.0.1", Project: "", ClusterResources: true}, Id: &clusterapi.ClusterID{Type: "name", Value: "disallowed-unscoped"}, UpdatedFields: []string{"clusterResources", "project"}},
},
{
name: "allowed cluster URL in body, disallowed cluster name in query, changing unscoped to scoped",
request: clusterapi.ClusterUpdateRequest{Cluster: &v1alpha1.Cluster{Name: "", Server: "https://127.0.0.1", Project: "allowed-project", ClusterResources: true}, Id: &clusterapi.ClusterID{Type: "", Value: "https://127.0.0.2"}, UpdatedFields: []string{"clusterResources", "project"}},
},
{
name: "allowed cluster URL in body, disallowed cluster URL in query, changing unscoped to scoped",
request: clusterapi.ClusterUpdateRequest{Cluster: &v1alpha1.Cluster{Name: "", Server: "https://127.0.0.1", Project: "allowed-project", ClusterResources: true}, Id: &clusterapi.ClusterID{Type: "name", Value: "disallowed-unscoped"}, UpdatedFields: []string{"clusterResources", "project"}},
},
}
db := &dbmocks.ArgoDB{}
clusters := []v1alpha1.Cluster{
{
Name: "allowed-unscoped",
Server: "https://127.0.0.1",
},
{
Name: "disallowed-unscoped",
Server: "https://127.0.0.2",
},
{
Name: "allowed-scoped",
Server: "https://127.0.0.3",
Project: "allowed-project",
},
{
Name: "disallowed-scoped",
Server: "https://127.0.0.4",
Project: "disallowed-project",
},
}
db.On("ListClusters", mock.Anything).Return(
func(ctx context.Context) *v1alpha1.ClusterList {
return &v1alpha1.ClusterList{
ListMeta: v1.ListMeta{},
Items: clusters,
}
},
func(ctx context.Context) error {
return nil
},
)
db.On("UpdateCluster", mock.Anything, mock.Anything).Return(
func(ctx context.Context, c *v1alpha1.Cluster) *v1alpha1.Cluster {
for _, cluster := range clusters {
if c.Server == cluster.Server {
return c
}
}
return nil
},
func(ctx context.Context, c *v1alpha1.Cluster) error {
for _, cluster := range clusters {
if c.Server == cluster.Server {
return nil
}
}
return fmt.Errorf("cluster '%s' not found", c.Server)
},
)
db.On("GetCluster", mock.Anything, mock.Anything).Return(
func(ctx context.Context, server string) *v1alpha1.Cluster {
for _, cluster := range clusters {
if server == cluster.Server {
return &cluster
}
}
return nil
},
func(ctx context.Context, server string) error {
for _, cluster := range clusters {
if server == cluster.Server {
return nil
}
}
return fmt.Errorf("cluster '%s' not found", server)
},
)
enf := rbac.NewEnforcer(fake.NewSimpleClientset(test.NewFakeConfigMap()), test.FakeArgoCDNamespace, common.ArgoCDConfigMapName, nil)
_ = enf.SetBuiltinPolicy(`p, role:test, clusters, *, https://127.0.0.1, allow
p, role:test, clusters, *, allowed-project/*, allow`)
enf.SetDefaultRole("role:test")
server := NewServer(db, enf, newServerInMemoryCache(), &kubetest.MockKubectlCmd{})
for _, c := range testCases {
cc := c
t.Run(cc.name, func(t *testing.T) {
t.Parallel()
out, err := server.Update(context.Background(), &cc.request)
require.Nil(t, out)
assert.ErrorIs(t, err, common.PermissionDeniedAPIError)
})
}
}
func TestGetCluster_UrlEncodedName(t *testing.T) {
db := &dbmocks.ArgoDB{}