Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(argo-cd): Fix secret name for applicationset webhook ingress #2511

Merged
merged 2 commits into from
Feb 14, 2024

Conversation

pdrastil
Copy link
Member

Checklist:

  • I have bumped the chart version according to versioning
  • I have updated the documentation according to documentation
  • I have updated the chart changelog with all the changes that come with this pull request according to changelog.
  • Any new values are backwards compatible and/or have sensible default.
  • I have signed off all my commits as required by DCO.
  • My build is green (troubleshooting builds).

Signed-off-by: Petr Drastil <petr.drastil@gmail.com>
@yu-croco yu-croco merged commit 5915340 into argoproj:main Feb 14, 2024
6 checks passed
@pdrastil pdrastil deleted the fix/secret branch February 14, 2024 12:55
@volker-raschek
Copy link

Hi @pdrastil, @mbevc1 and @yu-croco,
this pull request means that a custom secret can no longer be used.

In version 7.5.2 of the helm chart, I am happy that the cert-manager is now primarily used to create certificates, but you have not taken one thing into account.

There are users like me who generate wildcard certificates from let's encrypt. The certificate, stored in a secret, is synchronized via reflector in all necessary namespaces. There it can then be referenced as a secret in the ingress resource.

Because you have now defined this hard coded, the workflow or setup is no longer possible at all and that's very bad.

secretName: argocd-applicationset-controller-tls

Questions and answers that may arise.

  1. Why must a wildcard certificate be used?
    Because otherwise the Let's Encrypt API will reveal public DNS names: https://crt.sh/

  2. Why can't you create a second wildcard certificate with the same CommonName / SAN?
    Because the client (API's, browsers and so on) would always make a new TLS handshake with HSTS. These TLS handshakes are quite expensive. In my opinion to expensive!

Please provide a fix, so that it's possible to use a custom secret of all ingress resources.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants