mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
a507282103
The Argo CD v2.14.2 image (Ubuntu 24.04, ca-certificates 20240203) and the dex image still trust the eMudhra intermediates whose keys leaked (https://emudhra.we-have-a-problem.com), and the repo server fetches git and Helm repos over that trust store. A forged certificate there means arbitrary manifests in the cluster. patched-ca-bundle holds the bundle from Alpine ca-certificates-bundle 20261020-r0 and replaces /etc/ssl/certs in every Argo CD container except redis. The whole directory goes, since OpenSSL and Go also read the per-root files next to ca-certificates.crt. It uses server-side apply to keep the bundle out of the last-applied annotation.
23 lines
643 B
YAML
23 lines
643 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: argocd
|
|
|
|
|
|
# additional resources like ingress rules, cluster and repository secrets.
|
|
resources:
|
|
- https://raw.githubusercontent.com/argoproj/argo-cd/refs/tags/v2.14.2/manifests/install.yaml
|
|
- ingress.yaml
|
|
- oidc-secret.yaml
|
|
- patched-ca-bundle.yaml
|
|
|
|
patches:
|
|
- target:
|
|
group: apps
|
|
version: v1
|
|
kind: ReplicaSet
|
|
name: argocd-notifications-controller
|
|
path: overlays/argocd-notifications-controller-patch.yaml
|
|
- path: overlays/argocd-cm.patch.yaml
|
|
- path: overlays/argocd-rbac-cm.patch.yaml
|
|
- path: overlays/patched-ca-bundle.patch.yaml |