Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added ReadOnlyRootFileSystem to the Argo CD components #1659

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

anandf
Copy link
Collaborator

@anandf anandf commented Feb 8, 2025

What type of PR is this?

What does this PR do / why we need it:
Upstream Argo CD has all components running with readOnlyRootFileSystem set to true. For security reasons this needs to be enabled even for the components that are created by the operator.

Application Controller:
https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/application-controller-deployment/argocd-application-controller-deployment.yaml#L263
Note: Stateful set based application controller does not have this flag set. So need to validate if enabling it will cause any breaking change
https://github.com/argoproj/argo-cd/blob/master/manifests/base/application-controller-deployment/argocd-application-controller-statefulset.yaml
AppSet Controller: https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/applicationset-controller/argocd-applicationset-controller-deployment.yaml#L202
Notification Controller :
https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/notification/argocd-notifications-controller-deployment.yaml#L92
Dex:
https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/dex/argocd-dex-server-deployment.yaml#L34
Redis:
https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/redis/argocd-redis-deployment.yaml#L31
https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/redis/argocd-redis-deployment.yaml#L60
RepoServer:
https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/repo-server/argocd-repo-server-deployment.yaml#L261
https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/repo-server/argocd-repo-server-deployment.yaml#L295
Server:
https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/server/argocd-server-deployment.yaml#L340

Have you updated the necessary documentation?

  • Documentation update is required by this PR.
  • Documentation has been updated.

Which issue(s) this PR fixes:

Fixes #?

How to test changes / Special notes to the reviewer:

@anandf anandf requested a review from svghadi February 8, 2025 17:46
@svghadi
Copy link
Collaborator

svghadi commented Feb 10, 2025

Note: Stateful set based application controller does not have this flag set. So need to validate if enabling it will cause any breaking change
https://github.com/argoproj/argo-cd/blob/master/manifests/base/application-controller-deployment/argocd-application-controller-statefulset.yaml

The readonlyfs flag is set for statefulset in install.yaml from github release page. I think it will work, we just need to add some volumes which operator doesn't setup for application-controller.

Also, for argocd-server we are missing some mounts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants