Skip to content

Commit a031ab4

Browse files
rolfedhrolfedh
authored
Merge pull request #55464 from shipsing/RHDEVDOCS-4940-firstPR
RHDEVDOCS-4940-firstPR: Covers CVE update for GitOps 1.7.1, 1.6.4, and 1.5.9
2 parents 2f2cd60 + 95397dc commit a031ab4

10 files changed

+91
-6
lines changed

‎cicd/gitops/gitops-release-notes.adoc

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,14 +23,20 @@ include::modules/go-compatibility-and-support-matrix.adoc[leveloffset=+1]
2323
include::modules/making-open-source-more-inclusive.adoc[leveloffset=+1]
2424

2525
// Modules included, most to least recent
26+
include::modules/gitops-release-notes-1-7-1.adoc[leveloffset=+1]
27+
2628
include::modules/gitops-release-notes-1-7-0.adoc[leveloffset=+1]
2729

30+
include::modules/gitops-release-notes-1-6-4.adoc[leveloffset=+1]
31+
2832
include::modules/gitops-release-notes-1-6-2.adoc[leveloffset=+1]
2933

3034
include::modules/gitops-release-notes-1-6-1.adoc[leveloffset=+1]
3135

3236
include::modules/gitops-release-notes-1-6-0.adoc[leveloffset=+1]
3337

38+
include::modules/gitops-release-notes-1-5-9.adoc[leveloffset=+1]
39+
3440
include::modules/gitops-release-notes-1-5-7.adoc[leveloffset=+1]
3541

3642
include::modules/gitops-release-notes-1-5-6.adoc[leveloffset=+1]
@@ -69,14 +75,14 @@ include::modules/gitops-release-notes-1-3-7.adoc[leveloffset=+1]
6975

7076
include::modules/gitops-release-notes-1-3-6.adoc[leveloffset=+1]
7177

72-
include::modules/gitops-release-notes-1-3-3.adoc[leveloffset=+1]
73-
7478
include::modules/gitops-release-notes-1-3-2.adoc[leveloffset=+1]
7579

7680
include::modules/gitops-release-notes-1-3-1.adoc[leveloffset=+1]
7781

7882
include::modules/gitops-release-notes-1-3-0.adoc[leveloffset=+1]
7983

84+
include::modules/gitops-release-notes-1-2-2.adoc[leveloffset=+1]
85+
8086
include::modules/gitops-release-notes-1-2-1.adoc[leveloffset=+1]
8187

8288
include::modules/gitops-release-notes-1-2.adoc[leveloffset=+1]

‎modules/gitops-release-notes-1-2-2.adoc

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Module included in the following assembly:
2+
//
3+
// * gitops/gitops-release-notes.adoc
4+
5+
[id="gitops-release-notes-1-2-2_{context}"]
6+
= Release notes for {gitops-title} 1.2.2
7+
8+
{gitops-title} 1.2.2 is now available on {product-title} 4.8.
9+
10+
[id="fixed-issues-1-2-2_{context}"]
11+
== Fixed issues
12+
The following issue was resolved in the current release:
13+
14+
* All versions of Argo CD are vulnerable to a path traversal bug that allows to pass arbitrary values to be consumed by Helm charts. This update fixes the CVE-2022-24348 gitops error, path traversal and dereference of symlinks when passing Helm value files.
15+
link:https://issues.redhat.com/browse/GITOPS-1756[GITOPS-1756]

‎modules/gitops-release-notes-1-4-12.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ spec:
4747
enabled: true
4848
----
4949

50-
* Before this update, a terminating namespace that was managed by Argo CD would block the creation of roles and other configuration of other managed namespaces. This update fixes this issue. link:https://issues.redhat.com/browse/GITOPS-2277[GITOPS-2277]
50+
* Before this update, a terminating namespace that was managed by Argo CD would block the creation of roles and other configuration of other managed namespaces. This update fixes this issue. link:https://issues.redhat.com/browse/GITOPS-2276[GITOPS-2276]
5151

5252
* Before this update, the Dex pods failed to start with `CreateContainerConfigError` when an SCC of `anyuid` was assigned to the Dex `ServiceAccount` resource. This update fixes this issue by assigning a default user id to the Dex container. link:https://issues.redhat.com/browse/GITOPS-2235[GITOPS-2235]
5353

‎modules/gitops-release-notes-1-4-2.adoc

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,4 @@
1313

1414
The following issue has been resolved in the current release:
1515

16-
* All versions of Argo CD are vulnerable to a path traversal bug that allows to pass arbitrary values to be consumed by Helm charts. This update fixes the `CVE-2022-24348 gitops` error, path traversal and dereference of symlinks when passing Helm value files. link:https://issues.redhat.com/browse/GITOPS-1756[GITOPS-1756]
17-
1816
* Before this update, the *Route* resources got stuck in `Progressing` Health status if more than one `Ingress` were attached to the route. This update fixes the health check and reports the correct health status of the *Route* resources. link:https://issues.redhat.com/browse/GITOPS-1751[GITOPS-1751]

‎modules/gitops-release-notes-1-5-6.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ spec:
4747
enabled: true
4848
----
4949

50-
* Before this update, a terminating namespace that was managed by Argo CD would block the creation of roles and other configuration of other managed namespaces. This update fixes this issue. link:https://issues.redhat.com/browse/GITOPS-2277[GITOPS-2277]
50+
* Before this update, a terminating namespace that was managed by Argo CD would block the creation of roles and other configuration of other managed namespaces. This update fixes this issue. link:https://issues.redhat.com/browse/GITOPS-2278[GITOPS-2278]
5151

5252
* Before this update, the Dex pods failed to start with `CreateContainerConfigError` when an SCC of `anyuid` was assigned to the Dex `ServiceAccount` resource. This update fixes this issue by assigning a default user id to the Dex container. link:https://issues.redhat.com/browse/GITOPS-2235[GITOPS-2235]
5353

‎modules/gitops-release-notes-1-5-9.adoc

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Module included in the following assembly:
2+
//
3+
// * gitops/gitops-release-notes.adoc
4+
5+
:_content-type: REFERENCE
6+
7+
[id="gitops-release-notes-1-5-9_{context}"]
8+
= Release notes for {gitops-title} 1.5.9
9+
10+
{gitops-title} 1.5.9 is now available on {product-title} 4.8, 4.9, 4.10, 4.11, and 4.12.
11+
12+
[id="fixed-issues-1-5-9_{context}"]
13+
== Fixed issues
14+
15+
* Before this update, all versions of Argo CD v1.8.2 and later were vulnerable to an improper authorization bug. As a result, Argo CD would accept tokens for users who might not be authorized to access the cluster. This issue is now fixed. link:https://bugzilla.redhat.com/show_bug.cgi?id=2160492[CVE-2023-22482]

‎modules/gitops-release-notes-1-6-2.adoc

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,11 @@
99

1010
{gitops-title} 1.6.2 is now available on {product-title} 4.8, 4.9, 4.10 and 4.11.
1111

12+
[id="new-features-1-6-2_{context}"]
13+
== New features
14+
15+
* This release removes the `DISABLE_DEX` environment variable from the `openshift-gitops-operator` CSV file. As a result, this environment variable is no longer set when you perform a fresh installation of {gitops-title}. link:https://issues.redhat.com/browse/GITOPS-2360[GITOPS-2360]
16+
1217
[id="fixed-issues-1-6-2_{context}"]
1318
== Fixed issues
1419

‎modules/gitops-release-notes-1-6-4.adoc

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Module included in the following assembly:
2+
//
3+
// * gitops/gitops-release-notes.adoc
4+
5+
:_content-type: REFERENCE
6+
7+
[id="gitops-release-notes-1-6-4_{context}"]
8+
= Release notes for {gitops-title} 1.6.4
9+
10+
{gitops-title} 1.6.4 is now available on {product-title} 4.8, 4.9, 4.10, 4.11, and 4.12.
11+
12+
[id="fixed-issues-1-6-4_{context}"]
13+
== Fixed issues
14+
15+
* Before this update, all versions of Argo CD v1.8.2 and later were vulnerable to an improper authorization bug. As a result, Argo CD would accept tokens for audiences who might not be intended to access the cluster. This issue is now fixed. link:https://bugzilla.redhat.com/show_bug.cgi?id=2160492[CVE-2023-22482]

‎modules/gitops-release-notes-1-7-0.adoc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,12 @@ In future releases, there is a possibility to deprecate the old method of custom
4545
:FeatureName: Argo CD Applications controller
4646
include::snippets/technology-preview.adoc[]
4747

48+
* With this update, Argo CD supports the Server-Side Apply feature, which helps users to perform the following tasks:
49+
** Manage large resources which are too big for the allowed annotation size of 262144 bytes.
50+
** Patch an existing resource that is not managed or deployed by Argo CD.
51+
+
52+
You can configure this feature at application or resource level. link:https://issues.redhat.com/browse/GITOPS-2340[GITOPS-2340]
53+
4854
[id="fixed-issues-1-7-0_{context}"]
4955
== Fixed issues
5056

‎modules/gitops-release-notes-1-7-1.adoc

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// Module included in the following assembly:
2+
//
3+
// * gitops/gitops-release-notes.adoc
4+
:_content-type: REFERENCE
5+
6+
[id="gitops-release-notes-1-7-1_{context}"]
7+
= Release notes for {gitops-title} 1.7.1
8+
9+
{gitops-title} 1.7.1 is now available on {product-title} 4.8, 4.9, 4.10, 4.11, and 4.12.
10+
11+
[id="errata-updates-1-7-1_{context}"]
12+
== Errata updates
13+
14+
=== RHSA-2023:0467 - {gitops-title} 1.7.1 security update advisory
15+
16+
Issued: 2023-01-25
17+
18+
The list of security fixes that are included in this release is documented in the link:https://access.redhat.com/errata/RHSA-2023:0467[RHSA-2023:0467] advisory.
19+
20+
If you have installed the {gitops-title} Operator, run the following command to view the container images in this release:
21+
22+
[source,terminal]
23+
----
24+
$ oc describe deployment gitops-operator-controller-manager -n openshift-operators
25+
----

0 commit comments

Comments
 (0)