feat(repo-server): Build system CA trust from user configured sources

.ci-operator.yaml

@@ -1,4 +1,4 @@
 build_root_image:
   name: openshift-gitops-go-toolset
   namespace: ci
-  tag: 1.25.5
+  tag: 1.25.5

Makefile

@@ -271,7 +271,6 @@ deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in
 undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config.
 	$(KUSTOMIZE) build config/default | kubectl delete --ignore-not-found=true -f -
 
-
 CONTROLLER_GEN = $(shell pwd)/bin/controller-gen
 .PHONY: controller-gen
 controller-gen: ## Download controller-gen locally if necessary.

controllers/argocd/openshift/openshift.go

@@ -4,13 +4,14 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"slices"
 	"strings"
 
-	"golang.org/x/mod/semver"
-
 	argoapp "github.com/argoproj-labs/argocd-operator/api/v1beta1"
 	"github.com/argoproj-labs/argocd-operator/controllers/argocd"
-
+	"github.com/argoproj-labs/argocd-operator/controllers/argoutil"
+	"github.com/go-logr/logr"
+	"golang.org/x/mod/semver"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
@@ -59,6 +60,13 @@ func ReconcilerHook(cr *argoapp.ArgoCD, v interface{}, hint string) error {
 			} else {
 				o.Spec.Template.Spec.Containers[0].SecurityContext.Capabilities = nil
 			}
+		case cr.Name + "-repo-server":
+
+			prodImage := o.Spec.Template.Spec.Containers[0].Image
+			usingReleasedImages := strings.Contains(prodImage, "registry.redhat.io/openshift-gitops-1/argocd-rhel")
+			if cr.Spec.Repo.SystemCATrust != nil && usingReleasedImages {
+				updateSystemCATrustBuilding(cr, o, prodImage, logv)
+			}
 		}
 	case *appsv1.StatefulSet:
 		if o.Name == cr.Name+"-redis-ha-server" {
@@ -106,6 +114,96 @@ func ReconcilerHook(cr *argoapp.ArgoCD, v interface{}, hint string) error {
 	return nil
 }
 
+// updateSystemCATrustBuilding replaces the procedure based on ubuntu container with one based on rhel containers.
+// This requires changing the init container image, its script and the mount points to all consuming containers.
+func updateSystemCATrustBuilding(cr *argoapp.ArgoCD, o *appsv1.Deployment, prodImage string, logv logr.Logger) {
+	// These volumes are created by argocd-operator
+	volumeSource := "argocd-ca-trust-source"
+	volumeTarget := "argocd-ca-trust-target"
+
+	// Drop upstream init container and replace it with rhel specific logic
+	o.Spec.Template.Spec.InitContainers = slices.DeleteFunc(
+		o.Spec.Template.Spec.InitContainers,
+		func(container corev1.Container) bool {
+			return container.Name == "update-ca-certificates"
+		},
+	)
+
+	initContainer := corev1.Container{
+		Name:            "update-ca-certificates",
+		Image:           prodImage,
+		SecurityContext: argoutil.DefaultSecurityContext(),
+		VolumeMounts: []corev1.VolumeMount{
+			{Name: volumeSource, MountPath: "/var/run/secrets/ca-trust-source", ReadOnly: true},
+			{Name: volumeTarget, MountPath: "/etc/pki/ca-trust"},
+		},
+		Command: []string{"/bin/bash", "-c"},
+		Args: []string{`
+set -eEuo pipefail
+trap 's=$?; echo >&2 "$0: Error on line "$LINENO": $BASH_COMMAND"; exit $s' ERR
+
+# Populate the empty volume with the expected structure
+mkdir -p /etc/pki/ca-trust/{extracted/{openssl,pem,java,edk2},source/{anchors,blacklist}}
+
+# Copy user anchors where update-ca-trust expects it
+# Using loop over 'cp *' to work well with no CA files provided (all optional, none configured, etc.)
+ls /var/run/secrets/ca-trust-source/ | while read -r f; do
+    cp -L "/var/run/secrets/ca-trust-source/$f" /etc/pki/ca-trust/source/anchors/
+done
+
+echo "User defined trusted CA files:"
+ls /etc/pki/ca-trust/source/anchors/
+
+update-ca-trust
+
+echo "Trusted anchors:"
+trust list
+
+echo "Done!"
+			`},
+	}
+
+	// Replace distro CA certs with empty volume when the image CA's are supposed to be dropped
+	if cr.Spec.Repo.SystemCATrust.DropImageCertificates {
+		o.Spec.Template.Spec.Volumes = append(o.Spec.Template.Spec.Volumes, corev1.Volume{
+			Name: "distro-ca-trust-source",
+			VolumeSource: corev1.VolumeSource{
+				EmptyDir: &corev1.EmptyDirVolumeSource{},
+			},
+		})
+		initContainer.VolumeMounts = append(initContainer.VolumeMounts, corev1.VolumeMount{
+			Name:      "distro-ca-trust-source",
+			MountPath: "/usr/share/pki/ca-trust-source/",
+		})
+	}
+	o.Spec.Template.Spec.InitContainers = append(o.Spec.Template.Spec.InitContainers, initContainer)
+
+	// Update where to mount for prod containers
+	var mountedTo []string
+	for ci, container := range o.Spec.Template.Spec.Containers {
+		// Only mount to production container or sidecars using the same image
+		if container.Image != prodImage {
+			continue
+		}
+		mountedTo = append(mountedTo, container.Name)
+
+		// The source volume is not needed on RHEL
+		o.Spec.Template.Spec.Containers[ci].VolumeMounts = slices.DeleteFunc(
+			o.Spec.Template.Spec.Containers[ci].VolumeMounts,
+			func(mount corev1.VolumeMount) bool {
+				return mount.Name == volumeSource
+			},
+		)
+		// Use the RHEL-specific mount point for the target trust volume
+		for vi, volume := range o.Spec.Template.Spec.Containers[ci].VolumeMounts {
+			if volume.Name == volumeTarget {
+				o.Spec.Template.Spec.Containers[ci].VolumeMounts[vi].MountPath = "/etc/pki/ca-trust"
+			}
+		}
+	}
+	logv.Info(fmt.Sprintf("injected systemCATrust to repo-server containers: %s", strings.Join(mountedTo, ",")))
+}
+
 // BuilderHook updates the Argo CD controller builder to watch for changes to the "admin" ClusterRole
 func BuilderHook(_ *argoapp.ArgoCD, v interface{}, _ string) error {
 	logv := log.WithValues("module", "builder-hook")

go.mod

@@ -43,6 +43,7 @@ require (
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/ProtonMail/go-crypto v1.1.6 // indirect
+	github.com/argoproj-labs/argocd-image-updater v1.1.0 // indirect
 	github.com/argoproj/pkg v0.13.7-0.20250305113207-cbc37dc61de5 // indirect
 	github.com/argoproj/pkg/v2 v2.0.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -58,6 +59,7 @@ require (
 	github.com/chai2010/gettext-go v1.0.3 // indirect
 	github.com/chainguard-dev/git-urls v1.0.2 // indirect
 	github.com/cloudflare/circl v1.6.1 // indirect
+	github.com/coreos/go-oidc/v3 v3.14.1 // indirect
 	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
@@ -68,12 +70,15 @@ require (
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
 	github.com/fatih/camelcase v1.0.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.6.2 // indirect
 	github.com/go-git/go-git/v5 v5.16.5 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-openapi/jsonpointer v0.22.1 // indirect
 	github.com/go-openapi/jsonreference v0.21.3 // indirect
@@ -86,6 +91,7 @@ require (
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-github/v69 v69.2.0 // indirect
@@ -94,6 +100,10 @@ require (
 	github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
+	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/jonboulle/clockwork v0.5.0 // indirect
@@ -125,6 +135,7 @@ require (
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.66.1 // indirect
 	github.com/prometheus/procfs v0.16.1 // indirect
+	github.com/r3labs/diff/v3 v3.0.2 // indirect
 	github.com/redis/go-redis/v9 v9.8.0 // indirect
 	github.com/robfig/cron/v3 v3.0.2-0.20210106135023-bc59245fe10e // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
@@ -140,7 +151,10 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
 	go.opentelemetry.io/otel v1.38.0 // indirect
+	go.opentelemetry.io/otel/metric v1.38.0 // indirect
 	go.opentelemetry.io/otel/trace v1.38.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
@@ -155,6 +169,8 @@ require (
 	golang.org/x/time v0.14.0 // indirect
 	golang.org/x/tools v0.41.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
+	google.golang.org/genproto v0.0.0-20240401170217-c3f982113cda // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251022142026-3a174f9686a8 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251022142026-3a174f9686a8 // indirect
 	google.golang.org/grpc v1.77.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect