Configure TLS Parameters

common/defaults.go

@@ -139,7 +139,7 @@ const (
 	ArgoCDDexServerTokenRenewalThresholdPercent int64 = 33
 
 	// ArgoCDDefaultDexVersion is the Dex container image tag to use when not specified.
-	ArgoCDDefaultDexVersion = "sha256:8499afd690c437f52301efd2b05b2455da5bd2dfc20332cd697dc9937f808462" // v2.45.1
+	ArgoCDDefaultDexVersion = "sha256:f5d77499df7ea3ff0bdc5f9e218e4be8fac3b91a1b29b64a7158a5876850fb20" // v2.45.1
 
 	// ArgoCDDefaultDexRunAsUser is the numeric UID of the "dex" user declared in the Dex image.
 	// Kubernetes requires a numeric runAsUser when runAsNonRoot is true and the image USER is a named string.

controllers/argocd/configmap.go

@@ -464,8 +464,7 @@ func (r *ReconcileArgoCD) reconcileArgoConfigMap(cr *argoproj.ArgoCD) error {
 
 	// create dex config if dex is enabled through `.spec.sso`
 	if UseDex(cr) {
-		dexConfig := getDexConfig(cr)
-
+		dexConfig := getDexConfig(cr, r.CentralTLSConfigProfile)
 		// Append the default OpenShift dex config if the openShiftOAuth is requested through `.spec.sso.dex`.
 		if cr.Spec.SSO != nil && cr.Spec.SSO.Dex != nil && cr.Spec.SSO.Dex.OpenShiftOAuth {
 			cfg, err := r.getOpenShiftDexConfig(cr)

controllers/argocd/dex.go

@@ -24,6 +24,7 @@ import (
 	argoproj "github.com/argoproj-labs/argocd-operator/api/v1beta1"
 	"github.com/argoproj-labs/argocd-operator/common"
 	"github.com/argoproj-labs/argocd-operator/controllers/argoutil"
+	tlsProfile "github.com/argoproj-labs/argocd-operator/pkg/tlsprofile"
 )
 
 // DexConnector represents an authentication connector for Dex.
@@ -216,7 +217,7 @@ func (r *ReconcileArgoCD) reconcileDexLegacySATokenSecrets(cr *argoproj.ArgoCD)
 // reconcileDexConfiguration will ensure that Dex is configured properly.
 func (r *ReconcileArgoCD) reconcileDexConfiguration(cm *corev1.ConfigMap, cr *argoproj.ArgoCD) error {
 	actual := cm.Data[common.ArgoCDKeyDexConfig]
-	desired := getDexConfig(cr)
+	desired := getDexConfig(cr, r.CentralTLSConfigProfile)
 
 	// Append the default OpenShift dex config if the openShiftOAuth is requested through `.spec.sso.dex`.
 	if cr.Spec.SSO != nil && cr.Spec.SSO.Dex != nil && cr.Spec.SSO.Dex.OpenShiftOAuth {
@@ -304,16 +305,16 @@ func (r *ReconcileArgoCD) getOpenShiftDexConfig(cr *argoproj.ArgoCD) (string, er
 	dex["connectors"] = connectors
 
 	// add dex config from the Argo CD CR.
-	if err := addDexConfigFromCR(cr, dex); err != nil {
+	if err := addDexConfigFromCR(cr, dex, r.CentralTLSConfigProfile); err != nil {
 		return "", err
 	}
 
 	bytes, err := yaml.Marshal(dex)
 	return string(bytes), err
 }
 
-func addDexConfigFromCR(cr *argoproj.ArgoCD, dex map[string]any) error {
-	dexCfgStr := getDexConfig(cr)
+func addDexConfigFromCR(cr *argoproj.ArgoCD, dex map[string]any, centralTLSConfig tlsProfile.TLSConfigProfile) error {
+	dexCfgStr := getDexConfig(cr, centralTLSConfig)
 	if dexCfgStr == "" {
 		return nil
 	}

controllers/argocd/dexUtil.go

@@ -9,6 +9,7 @@ import (
 	argoproj "github.com/argoproj-labs/argocd-operator/api/v1beta1"
 	"github.com/argoproj-labs/argocd-operator/common"
 	"github.com/argoproj-labs/argocd-operator/controllers/argoutil"
+	tlsProfile "github.com/argoproj-labs/argocd-operator/pkg/tlsprofile"
 )
 
 // getDexContainerImage will return the container image for the Dex server.
@@ -78,8 +79,27 @@ func getDexResources(cr *argoproj.ArgoCD) corev1.ResourceRequirements {
 	return resources
 }
 
-func getDexConfig(cr *argoproj.ArgoCD) string {
+func getDexConfig(cr *argoproj.ArgoCD, centralTLSConfig tlsProfile.TLSConfigProfile) string {
 	config := common.ArgoCDDefaultDexConfig
+	// build TLSMinVersion, TLSCiphers, TLSCurvePreferences
+	if !centralTLSConfig.DisableClusterTLSProfile {
+		config += "\nweb:"
+		if v := argoutil.TLSProtocolVersionString(centralTLSConfig.MinVersion); v != "" {
+			config += fmt.Sprintf("\n  tlsMinVersion: %q", v)
+		}
+		if ciphers := argoutil.MapCipherSuites(centralTLSConfig.Ciphers); len(ciphers) > 0 {
+			config += "\n  tlsCiphers:"
+			for _, cipher := range ciphers {
+				config += fmt.Sprintf("\n    - %q", cipher)
+			}
+		}
+		if len(centralTLSConfig.CurvePreferences) > 0 {
+			config += "\n  tlsCurvePreferences:"
+			for _, curve := range centralTLSConfig.CurvePreferences {
+				config += fmt.Sprintf("\n    - %q", curve)
+			}
+		}
+	}
 
 	// Allow override of config from CR
 	if cr.Spec.ExtraConfig["dex.config"] != "" {

controllers/argocd/dex_test.go

@@ -27,6 +27,7 @@ import (
 	argoproj "github.com/argoproj-labs/argocd-operator/api/v1beta1"
 	"github.com/argoproj-labs/argocd-operator/common"
 	"github.com/argoproj-labs/argocd-operator/controllers/argoutil"
+	tlsProfile "github.com/argoproj-labs/argocd-operator/pkg/tlsprofile"
 )
 
 func TestReconcileArgoCD_reconcileDexDeployment_with_dex_disabled(t *testing.T) {
@@ -592,7 +593,7 @@ func TestReconcileArgoCD_reconcileDexDeployment_withUpdate(t *testing.T) {
 				Containers: []corev1.Container{
 					{
 						Name:  "dex",
-						Image: "ghcr.io/dexidp/dex@sha256:8499afd690c437f52301efd2b05b2455da5bd2dfc20332cd697dc9937f808462", // (v2.45.1) NOTE: this value is modified by dependency update script
+						Image: "ghcr.io/dexidp/dex@sha256:f5d77499df7ea3ff0bdc5f9e218e4be8fac3b91a1b29b64a7158a5876850fb20", // (v2.45.1) NOTE: this value is modified by dependency update script
 						Command: []string{
 							"/shared/argocd-dex",
 							"rundex",
@@ -1617,3 +1618,136 @@ func TestReconcileArgoCD_reconcileDexDeployment_customLabelsAndAnnotations(t *te
 	assert.False(t, hasCustomAnnotation)
 	assert.False(t, hasCustomLabel)
 }
+
+func TestGetDexConfig(t *testing.T) {
+	cr := &argoproj.ArgoCD{
+		Spec: argoproj.ArgoCDSpec{
+			ExtraConfig: map[string]string{},
+		},
+	}
+	tests := []struct {
+		name               string
+		centralTLSConfig   tlsProfile.TLSConfigProfile
+		expectedContains   []string
+		expectedNotContain []string
+	}{
+		{
+			name: "TLS profile disabled",
+			centralTLSConfig: tlsProfile.TLSConfigProfile{
+				DisableClusterTLSProfile: true,
+				MinVersion:               configv1.TLSProtocolVersion("VersionTLS13"),
+				Ciphers: []string{
+					"TLS_AES_128_GCM_SHA256",
+				},
+				CurvePreferences: []string{
+					"X25519MLKEM768",
+				},
+			},
+			expectedNotContain: []string{
+				"web:",
+				"tlsMinVersion:",
+				"tlsCiphers:",
+				"tlsCurvePreferences:",
+			},
+		},
+		{
+			name: "TLS minimum version",
+			centralTLSConfig: tlsProfile.TLSConfigProfile{
+				MinVersion: configv1.TLSProtocolVersion("VersionTLS12"),
+			},
+			expectedContains: []string{
+				"web:",
+				`tlsMinVersion: "1.2"`,
+			},
+			expectedNotContain: []string{
+				"tlsCiphers:",
+				"tlsCurvePreferences:",
+			},
+		},
+		{
+			name: "TLS cipher suites",
+			centralTLSConfig: tlsProfile.TLSConfigProfile{
+				Ciphers: []string{
+					"TLS_AES_128_GCM_SHA256",
+					"TLS_AES_256_GCM_SHA384",
+				},
+			},
+			expectedContains: []string{
+				"web:",
+				"tlsCiphers:",
+				`- "TLS_AES_128_GCM_SHA256"`,
+				`- "TLS_AES_256_GCM_SHA384"`,
+			},
+			expectedNotContain: []string{
+				"tlsMinVersion:",
+				"tlsCurvePreferences:",
+			},
+		},
+		{
+			name: "TLS curve preferences",
+			centralTLSConfig: tlsProfile.TLSConfigProfile{
+				CurvePreferences: []string{
+					"X25519MLKEM768",
+					"X25519",
+				},
+			},
+			expectedContains: []string{
+				"web:",
+				"tlsCurvePreferences:",
+				`- "X25519MLKEM768"`,
+				`- "X25519"`,
+			},
+			expectedNotContain: []string{
+				"tlsMinVersion:",
+				"tlsCiphers:",
+			},
+		},
+		{
+			name: "all TLS settings",
+			centralTLSConfig: tlsProfile.TLSConfigProfile{
+				MinVersion: configv1.TLSProtocolVersion("VersionTLS13"),
+				Ciphers: []string{
+					"TLS_AES_128_GCM_SHA256",
+					"TLS_AES_256_GCM_SHA384",
+				},
+				CurvePreferences: []string{
+					"X25519MLKEM768",
+					"X25519",
+				},
+			},
+			expectedContains: []string{
+				"web:",
+				`tlsMinVersion: "1.3"`,
+				"tlsCiphers:",
+				`- "TLS_AES_128_GCM_SHA256"`,
+				`- "TLS_AES_256_GCM_SHA384"`,
+				"tlsCurvePreferences:",
+				`- "X25519MLKEM768"`,
+				`- "X25519"`,
+			},
+		},
+		{
+			name:             "empty TLS configuration",
+			centralTLSConfig: tlsProfile.TLSConfigProfile{},
+			expectedNotContain: []string{
+				"tlsMinVersion:",
+				"tlsCiphers:",
+				"tlsCurvePreferences:",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			config := getDexConfig(cr, tt.centralTLSConfig)
+
+			for _, expected := range tt.expectedContains {
+				assert.Contains(t, config, expected)
+			}
+
+			for _, notExpected := range tt.expectedNotContain {
+				assert.NotContains(t, config, notExpected)
+			}
+		})
+	}
+}

controllers/argocd/testing.go

@@ -25,6 +25,7 @@ import (
 	"github.com/go-logr/logr"
 
 	"github.com/argoproj-labs/argocd-operator/common"
+	tlsProfile "github.com/argoproj-labs/argocd-operator/pkg/tlsprofile"
 
 	"github.com/stretchr/testify/assert"
 	appsv1 "k8s.io/api/apps/v1"
@@ -67,6 +68,9 @@ func makeTestReconciler(client client.Client, sch *runtime.Scheme, k8sClient kub
 		LocalUsers: &LocalUsersInfo{
 			tokenRenewalTimers: map[string]*tokenRenewalTimer{},
 		},
+		CentralTLSConfigProfile: tlsProfile.TLSConfigProfile{
+			DisableClusterTLSProfile: true,
+		},
 	}
 }
 

pkg/tlsprofile/profile.go

@@ -8,4 +8,6 @@ type TLSConfigProfile struct {
 	MinVersion configv1.TLSProtocolVersion
 	// Ciphers specifies the list of supported TLS cipher suites in cluster.
 	Ciphers []string
+	// CurvePreferences specifies the list of supported TLS curve preferences in cluster.
+	CurvePreferences []string
 }