Ruben Hensen a507282103 argocd: mount a CA bundle without the compromised eMudhra roots ...

The Argo CD v2.14.2 image (Ubuntu 24.04, ca-certificates 20240203) and the
dex image still trust the eMudhra intermediates whose keys leaked
(https://emudhra.we-have-a-problem.com), and the repo server fetches git
and Helm repos over that trust store. A forged certificate there means
arbitrary manifests in the cluster.

patched-ca-bundle holds the bundle from Alpine ca-certificates-bundle
20261020-r0 and replaces /etc/ssl/certs in every Argo CD container except
redis. The whole directory goes, since OpenSSL and Go also read the
per-root files next to ca-certificates.crt. It uses server-side apply to
keep the bundle out of the last-applied annotation.

2026-10-21 12:09:41 +02:00

..

argocd-cm.patch copy.yaml

Add traccar client ingress

2025-03-09 13:00:02 +01:00

argocd-cm.patch.yaml

Add OIDC to argocd

2026-04-06 18:44:32 +02:00

argocd-notifications-controller-patch.yaml

Add overlay patches 17

2024-09-14 22:12:34 +02:00

argocd-rbac-cm.patch.yaml

Add OIDC to argocd

2026-04-06 18:44:32 +02:00

patched-ca-bundle.patch.yaml

argocd: mount a CA bundle without the compromised eMudhra roots

2026-10-21 12:09:41 +02:00