mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
Ruben Hensen
a507282103
The Argo CD v2.14.2 image (Ubuntu 24.04, ca-certificates 20240203) and the dex image still trust the eMudhra intermediates whose keys leaked (https://emudhra.we-have-a-problem.com), and the repo server fetches git and Helm repos over that trust store. A forged certificate there means arbitrary manifests in the cluster. patched-ca-bundle holds the bundle from Alpine ca-certificates-bundle 20261020-r0 and replaces /etc/ssl/certs in every Argo CD container except redis. The whole directory goes, since OpenSSL and Go also read the per-root files next to ca-certificates.crt. It uses server-side apply to keep the bundle out of the last-applied annotation.
112 lines
2.7 KiB
YAML
112 lines
2.7 KiB
YAML
# Mount patched-ca-bundle over /etc/ssl/certs so git, helm and the Go
|
|
# binaries stop trusting the compromised eMudhra intermediates. The whole
|
|
# directory is replaced because OpenSSL and Go also read the per-root files
|
|
# next to ca-certificates.crt. Drop this once Argo CD ships a fixed image.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: argocd-server
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: argocd-server
|
|
volumeMounts:
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: argocd-repo-server
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: argocd-repo-server
|
|
volumeMounts:
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: argocd-application-controller
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: argocd-application-controller
|
|
volumeMounts:
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: argocd-applicationset-controller
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: argocd-applicationset-controller
|
|
volumeMounts:
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: argocd-notifications-controller
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: argocd-notifications-controller
|
|
volumeMounts:
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: argocd-dex-server
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: dex
|
|
volumeMounts:
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|