Compare commits

...

7 Commits

Author SHA1 Message Date
argo-bot
6e02f8b232 Bump version to 2.6.2 2023-02-16 14:52:52 +00:00
argo-bot
e2b280c3dd Bump version to 2.6.2 2023-02-16 14:52:45 +00:00
Michael Crenshaw
74726cf11e Merge pull request from GHSA-3jfq-742w-xg8j
fix test name

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>
2023-02-16 09:07:57 -05:00
Michael Crenshaw
d4a0c252b8 chore: add dist to path to use our kustomize version (#12352)
* chore: add dist to path to use our kustomize version

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>

* correct path

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>

* missed a spot

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>

---------

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>
2023-02-09 12:18:06 -05:00
argo-bot
3f143c9307 Bump version to 2.6.1 2023-02-08 18:35:36 +00:00
argo-bot
7fadddcba9 Bump version to 2.6.1 2023-02-08 18:35:30 +00:00
Michael Crenshaw
cac327cf64 fix: sanitize repo creds in error messages (#12309) (#12320)
* fix: sanitize repo creds in error messages (#12309)

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>

* simplify

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>

* comment

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>

* include error message

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>

---------

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>
2023-02-08 10:48:03 -05:00
16 changed files with 185 additions and 44 deletions

View File

@@ -123,6 +123,10 @@ jobs:
- name: Install all tools required for building & testing
run: |
make install-test-tools-local
# We install kustomize in the dist directory
- name: Add dist to PATH
run: |
echo "/home/runner/work/argo-cd/argo-cd/dist" >> $GITHUB_PATH
- name: Setup git username and email
run: |
git config --global user.name "John Doe"
@@ -186,6 +190,10 @@ jobs:
- name: Install all tools required for building & testing
run: |
make install-test-tools-local
# We install kustomize in the dist directory
- name: Add dist to PATH
run: |
echo "/home/runner/work/argo-cd/argo-cd/dist" >> $GITHUB_PATH
- name: Setup git username and email
run: |
git config --global user.name "John Doe"
@@ -232,6 +240,10 @@ jobs:
make install-codegen-tools-local
make install-go-tools-local
working-directory: /home/runner/go/src/github.com/argoproj/argo-cd
# We install kustomize in the dist directory
- name: Add dist to PATH
run: |
echo "/home/runner/work/argo-cd/argo-cd/dist" >> $GITHUB_PATH
- name: Run codegen
run: |
set -x

View File

@@ -177,6 +177,10 @@ jobs:
run: |
set -ue
make install-codegen-tools-local
# We install kustomize in the dist directory
echo "/home/runner/work/argo-cd/argo-cd/dist" >> $GITHUB_PATH
make manifests-local VERSION=${TARGET_VERSION}
git diff
git commit manifests/ -m "Bump version to ${TARGET_VERSION}"

View File

@@ -1 +1 @@
2.6.0
2.6.2

View File

@@ -8,6 +8,8 @@ import (
"time"
"github.com/sirupsen/logrus"
"google.golang.org/grpc/codes"
"google.golang.org/grpc/status"
)
// Default service addresses and URLS of Argo CD internal services
@@ -316,3 +318,5 @@ const (
const TokenVerificationError = "failed to verify the token"
var TokenVerificationErr = errors.New(TokenVerificationError)
var PermissionDeniedAPIError = status.Error(codes.PermissionDenied, "permission denied")

View File

@@ -5,7 +5,7 @@ kind: Kustomization
images:
- name: quay.io/argoproj/argocd
newName: quay.io/argoproj/argocd
newTag: v2.6.0
newTag: v2.6.2
resources:
- ./application-controller
- ./dex

View File

@@ -15557,7 +15557,7 @@ spec:
key: applicationsetcontroller.enable.progressive.syncs
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
name: argocd-applicationset-controller
ports:
@@ -15821,7 +15821,7 @@ spec:
value: /helm-working-dir
- name: HELM_DATA_HOME
value: /helm-working-dir
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
livenessProbe:
failureThreshold: 3
@@ -15873,7 +15873,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /var/run/argocd/argocd-cmp-server
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
name: copyutil
securityContext:
allowPrivilegeEscalation: false
@@ -16080,7 +16080,7 @@ spec:
key: application.namespaces
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
name: argocd-application-controller
ports:

View File

@@ -12,4 +12,4 @@ resources:
images:
- name: quay.io/argoproj/argocd
newName: quay.io/argoproj/argocd
newTag: v2.6.0
newTag: v2.6.2

View File

@@ -11,7 +11,7 @@ patchesStrategicMerge:
images:
- name: quay.io/argoproj/argocd
newName: quay.io/argoproj/argocd
newTag: v2.6.0
newTag: v2.6.2
resources:
- ../../base/application-controller
- ../../base/applicationset-controller

View File

@@ -16758,7 +16758,7 @@ spec:
key: applicationsetcontroller.enable.progressive.syncs
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
name: argocd-applicationset-controller
ports:
@@ -16868,7 +16868,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /shared/argocd-dex
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
name: copyutil
securityContext:
@@ -16921,7 +16921,7 @@ spec:
containers:
- command:
- argocd-notifications
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
livenessProbe:
tcpSocket:
@@ -17224,7 +17224,7 @@ spec:
value: /helm-working-dir
- name: HELM_DATA_HOME
value: /helm-working-dir
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
livenessProbe:
failureThreshold: 3
@@ -17276,7 +17276,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /var/run/argocd/argocd-cmp-server
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
name: copyutil
securityContext:
allowPrivilegeEscalation: false
@@ -17555,7 +17555,7 @@ spec:
key: server.enable.proxy.extension
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
livenessProbe:
httpGet:
@@ -17791,7 +17791,7 @@ spec:
key: application.namespaces
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
name: argocd-application-controller
ports:

View File

@@ -1562,7 +1562,7 @@ spec:
key: applicationsetcontroller.enable.progressive.syncs
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
name: argocd-applicationset-controller
ports:
@@ -1672,7 +1672,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /shared/argocd-dex
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
name: copyutil
securityContext:
@@ -1725,7 +1725,7 @@ spec:
containers:
- command:
- argocd-notifications
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
livenessProbe:
tcpSocket:
@@ -2028,7 +2028,7 @@ spec:
value: /helm-working-dir
- name: HELM_DATA_HOME
value: /helm-working-dir
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
livenessProbe:
failureThreshold: 3
@@ -2080,7 +2080,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /var/run/argocd/argocd-cmp-server
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
name: copyutil
securityContext:
allowPrivilegeEscalation: false
@@ -2359,7 +2359,7 @@ spec:
key: server.enable.proxy.extension
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
livenessProbe:
httpGet:
@@ -2595,7 +2595,7 @@ spec:
key: application.namespaces
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
name: argocd-application-controller
ports:

View File

@@ -15877,7 +15877,7 @@ spec:
key: applicationsetcontroller.enable.progressive.syncs
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
name: argocd-applicationset-controller
ports:
@@ -15987,7 +15987,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /shared/argocd-dex
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
name: copyutil
securityContext:
@@ -16040,7 +16040,7 @@ spec:
containers:
- command:
- argocd-notifications
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
livenessProbe:
tcpSocket:
@@ -16299,7 +16299,7 @@ spec:
value: /helm-working-dir
- name: HELM_DATA_HOME
value: /helm-working-dir
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
livenessProbe:
failureThreshold: 3
@@ -16351,7 +16351,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /var/run/argocd/argocd-cmp-server
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
name: copyutil
securityContext:
allowPrivilegeEscalation: false
@@ -16626,7 +16626,7 @@ spec:
key: server.enable.proxy.extension
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
livenessProbe:
httpGet:
@@ -16860,7 +16860,7 @@ spec:
key: application.namespaces
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
name: argocd-application-controller
ports:

View File

@@ -681,7 +681,7 @@ spec:
key: applicationsetcontroller.enable.progressive.syncs
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
name: argocd-applicationset-controller
ports:
@@ -791,7 +791,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /shared/argocd-dex
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
name: copyutil
securityContext:
@@ -844,7 +844,7 @@ spec:
containers:
- command:
- argocd-notifications
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
livenessProbe:
tcpSocket:
@@ -1103,7 +1103,7 @@ spec:
value: /helm-working-dir
- name: HELM_DATA_HOME
value: /helm-working-dir
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
livenessProbe:
failureThreshold: 3
@@ -1155,7 +1155,7 @@ spec:
- -n
- /usr/local/bin/argocd
- /var/run/argocd/argocd-cmp-server
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
name: copyutil
securityContext:
allowPrivilegeEscalation: false
@@ -1430,7 +1430,7 @@ spec:
key: server.enable.proxy.extension
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
livenessProbe:
httpGet:
@@ -1664,7 +1664,7 @@ spec:
key: application.namespaces
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.6.0
image: quay.io/argoproj/argocd:v2.6.2
imagePullPolicy: Always
name: argocd-application-controller
ports:

View File

@@ -1,6 +1,7 @@
package v1alpha1
import (
"fmt"
"net/url"
"github.com/argoproj/argo-cd/v2/util/cert"
@@ -265,6 +266,14 @@ func (m *Repository) CopySettingsFrom(source *Repository) {
}
}
// StringForLogging gets a string representation of the Repository which is safe to log or return to the user.
func (m *Repository) StringForLogging() string {
if m == nil {
return ""
}
return fmt.Sprintf("&Repository{Repo: %q, Type: %q, Name: %q, Project: %q}", m.Repo, m.Type, m.Name, m.Project)
}
// Repositories defines a list of Repository configurations
type Repositories []*Repository

View File

@@ -1,11 +1,10 @@
package cluster
import (
"context"
"net/url"
"time"
"context"
"github.com/argoproj/gitops-engine/pkg/utils/kube"
log "github.com/sirupsen/logrus"
"google.golang.org/grpc/codes"
@@ -14,6 +13,7 @@ import (
"k8s.io/apimachinery/pkg/util/sets"
"k8s.io/client-go/kubernetes"
"github.com/argoproj/argo-cd/v2/common"
"github.com/argoproj/argo-cd/v2/pkg/apiclient/cluster"
appv1 "github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
servercache "github.com/argoproj/argo-cd/v2/server/cache"
@@ -135,7 +135,7 @@ func (s *Server) Get(ctx context.Context, q *cluster.ClusterQuery) (*appv1.Clust
func (s *Server) getClusterWith403IfNotExist(ctx context.Context, q *cluster.ClusterQuery) (*appv1.Cluster, error) {
repo, err := s.getCluster(ctx, q)
if err != nil || repo == nil {
return nil, status.Error(codes.PermissionDenied, "permission denied")
return nil, common.PermissionDeniedAPIError
}
return repo, nil
}
@@ -221,14 +221,14 @@ func (s *Server) Update(ctx context.Context, q *cluster.ClusterUpdateRequest) (*
}
// verify that user can do update inside project where cluster is located
if err := s.enf.EnforceErr(ctx.Value("claims"), rbacpolicy.ResourceClusters, rbacpolicy.ActionUpdate, createRBACObject(c.Project, q.Cluster.Server)); err != nil {
return nil, err
if !s.enf.Enforce(ctx.Value("claims"), rbacpolicy.ResourceClusters, rbacpolicy.ActionUpdate, createRBACObject(c.Project, c.Server)) {
return nil, common.PermissionDeniedAPIError
}
if len(q.UpdatedFields) == 0 || sets.NewString(q.UpdatedFields...).Has("project") {
// verify that user can do update inside project where cluster will be located
if err := s.enf.EnforceErr(ctx.Value("claims"), rbacpolicy.ResourceClusters, rbacpolicy.ActionUpdate, createRBACObject(q.Cluster.Project, q.Cluster.Server)); err != nil {
return nil, err
if !s.enf.Enforce(ctx.Value("claims"), rbacpolicy.ResourceClusters, rbacpolicy.ActionUpdate, createRBACObject(q.Cluster.Project, c.Server)) {
return nil, common.PermissionDeniedAPIError
}
}

View File

@@ -3,6 +3,7 @@ package cluster
import (
"context"
"encoding/json"
"fmt"
"testing"
"time"
@@ -49,6 +50,117 @@ func newNoopEnforcer() *rbac.Enforcer {
return enf
}
func TestUpdateCluster_RejectInvalidParams(t *testing.T) {
testCases := []struct {
name string
request clusterapi.ClusterUpdateRequest
}{
{
name: "allowed cluster URL in body, disallowed cluster URL in query",
request: clusterapi.ClusterUpdateRequest{Cluster: &v1alpha1.Cluster{Name: "", Server: "https://127.0.0.1", Project: "", ClusterResources: true}, Id: &clusterapi.ClusterID{Type: "", Value: "https://127.0.0.2"}, UpdatedFields: []string{"clusterResources", "project"}},
},
{
name: "allowed cluster URL in body, disallowed cluster name in query",
request: clusterapi.ClusterUpdateRequest{Cluster: &v1alpha1.Cluster{Name: "", Server: "https://127.0.0.1", Project: "", ClusterResources: true}, Id: &clusterapi.ClusterID{Type: "name", Value: "disallowed-unscoped"}, UpdatedFields: []string{"clusterResources", "project"}},
},
{
name: "allowed cluster URL in body, disallowed cluster name in query, changing unscoped to scoped",
request: clusterapi.ClusterUpdateRequest{Cluster: &v1alpha1.Cluster{Name: "", Server: "https://127.0.0.1", Project: "allowed-project", ClusterResources: true}, Id: &clusterapi.ClusterID{Type: "", Value: "https://127.0.0.2"}, UpdatedFields: []string{"clusterResources", "project"}},
},
{
name: "allowed cluster URL in body, disallowed cluster URL in query, changing unscoped to scoped",
request: clusterapi.ClusterUpdateRequest{Cluster: &v1alpha1.Cluster{Name: "", Server: "https://127.0.0.1", Project: "allowed-project", ClusterResources: true}, Id: &clusterapi.ClusterID{Type: "name", Value: "disallowed-unscoped"}, UpdatedFields: []string{"clusterResources", "project"}},
},
}
db := &dbmocks.ArgoDB{}
clusters := []v1alpha1.Cluster{
{
Name: "allowed-unscoped",
Server: "https://127.0.0.1",
},
{
Name: "disallowed-unscoped",
Server: "https://127.0.0.2",
},
{
Name: "allowed-scoped",
Server: "https://127.0.0.3",
Project: "allowed-project",
},
{
Name: "disallowed-scoped",
Server: "https://127.0.0.4",
Project: "disallowed-project",
},
}
db.On("ListClusters", mock.Anything).Return(
func(ctx context.Context) *v1alpha1.ClusterList {
return &v1alpha1.ClusterList{
ListMeta: v1.ListMeta{},
Items: clusters,
}
},
func(ctx context.Context) error {
return nil
},
)
db.On("UpdateCluster", mock.Anything, mock.Anything).Return(
func(ctx context.Context, c *v1alpha1.Cluster) *v1alpha1.Cluster {
for _, cluster := range clusters {
if c.Server == cluster.Server {
return c
}
}
return nil
},
func(ctx context.Context, c *v1alpha1.Cluster) error {
for _, cluster := range clusters {
if c.Server == cluster.Server {
return nil
}
}
return fmt.Errorf("cluster '%s' not found", c.Server)
},
)
db.On("GetCluster", mock.Anything, mock.Anything).Return(
func(ctx context.Context, server string) *v1alpha1.Cluster {
for _, cluster := range clusters {
if server == cluster.Server {
return &cluster
}
}
return nil
},
func(ctx context.Context, server string) error {
for _, cluster := range clusters {
if server == cluster.Server {
return nil
}
}
return fmt.Errorf("cluster '%s' not found", server)
},
)
enf := rbac.NewEnforcer(fake.NewSimpleClientset(test.NewFakeConfigMap()), test.FakeArgoCDNamespace, common.ArgoCDConfigMapName, nil)
_ = enf.SetBuiltinPolicy(`p, role:test, clusters, *, https://127.0.0.1, allow
p, role:test, clusters, *, allowed-project/*, allow`)
enf.SetDefaultRole("role:test")
server := NewServer(db, enf, newServerInMemoryCache(), &kubetest.MockKubectlCmd{})
for _, c := range testCases {
cc := c
t.Run(cc.name, func(t *testing.T) {
t.Parallel()
out, err := server.Update(context.Background(), &cc.request)
require.Nil(t, out)
assert.ErrorIs(t, err, common.PermissionDeniedAPIError)
})
}
}
func TestGetCluster_UrlEncodedName(t *testing.T) {
db := &dbmocks.ArgoDB{}

View File

@@ -288,7 +288,7 @@ func validateRepo(ctx context.Context,
return nil, err
}
if err := TestRepoWithKnownType(ctx, repoClient, repo, source.IsHelm(), source.IsHelmOci()); err != nil {
errMessage = fmt.Sprintf("repositories not accessible: %v", repo)
errMessage = fmt.Sprintf("repositories not accessible: %v: %v", repo.StringForLogging(), err)
}
repoAccessible := false