tag: Gitops · 14 items
- Platform/SRE — Plan: Four CRITICAL CVEs patched — including RCE via Kustomize remote refs and Jsonnet imports in the repo-server, plus an AppProject restriction bypass — with no KEV listing or confirmed active exploitation. Schedule upgrade to v3.4.10 this sprint; none of the exploits have a forced deadline, but CRITICAL severity in a GitOps control plane warrants prompt action.
- CI/CD — Plan: The HIGH-severity command injection via SSH Git repository proxy URL (CVE-2026-55797) and the AppProject hook bypass directly affect the deploy path managed through Argo CD. No active exploitation is confirmed, but teams running Argo CD for GitOps deployments should plan an upgrade to v3.4.10 before end of current sprint.
- Leader — Skip
- Signals: Argo CD 3.4 supported · CVE-2025-61560 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-55797 — CISA KEV: not listed, EPSS 0.02 · CVE-2026-77459 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Four CRITICAL-severity vulnerabilities patched, including repo-server command execution via Kustomize and AppProject restriction bypass — none are KEV-listed and EPSS scores are near zero, so no confirmed exploitation, but schedule upgrade of Argo CD to v3.3.15 this sprint given the RCE class of findings.
- CI/CD — Plan: Argo CD v3.3.15 patches CRITICAL command-execution flaws in the GitOps deployment tool; coordinate with the platform team to schedule a cluster upgrade to v3.3.15, prioritizing any environments where untrusted Kustomize or Jsonnet sources are in use.
- Leader — Skip
- Signals: Argo CD 3.3 supported · CVE-2025-61560 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-55797 — CISA KEV: not listed, EPSS 0.02 · CVE-2026-77459 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Argo CD 3.5.4 fixes four CRITICAL CVEs including arbitrary command execution in the repo-server via Kustomize and Jsonnet, plus an AppProject restriction bypass. None are KEV-listed and EPSS is very low, but CRITICAL severity in a core GitOps component warrants patching this sprint — upgrade clusters to 3.5.4 promptly.
- CI/CD — Plan: The CRITICAL command-injection paths (Kustomize remote refs, Helm home, Jsonnet imports) run inside the repo-server that processes your GitOps manifests, making this directly relevant to the deploy path. Schedule an upgrade to 3.5.4; no active exploitation confirmed yet but the attack surface is in build artifact processing.
- Leader — Skip
- Signals: Argo CD 3.5 supported · CVE-2025-61560 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-55797 — CISA KEV: not listed, EPSS 0.02 · CVE-2026-77459 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Learn: Argo CD 4.0 is in early visioning, not yet GA — worth tracking as a future platform roadmap input, but no action or migration needed now.
- CI/CD — Learn: If your deployment pipeline relies on Argo CD, the 4.0 vision process is worth watching for potential breaking changes, but nothing is actionable yet.
- Leader — Skip
- Signals: major release (4.0)
- Platform/SRE — Learn: A terminal UI layered over Argo CD worth evaluating if your team uses Argo CD daily, but no production change required — no GA release signal or deprecation anchor.
- CI/CD — Learn: Useful for release engineers monitoring GitOps deployments via Argo CD, but no pipeline change required; evaluate as a team productivity tool.
- Leader — Skip
- Platform/SRE — Plan: Teams running Argo CD should schedule an upgrade to 3.4.8 this sprint: it patches three CVEs in UI JS dependencies (none KEV-listed, EPSS ≤ 0.01) and fixes an auto-sync regression that silently skips syncs when a newer commit arrives during an active sync. No hard deadline, but the sync bug is a silent correctness risk on busy clusters.
- CI/CD — Skip
- Leader — Skip
- Signals: Argo CD 3.4 supported · CVE-2026-14257 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-49978 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-59869 — CISA KEV: not listed, EPSS 0.01
- Platform/SRE — Plan: The managed EKS Argo CD capability now accepts argocd-cm ConfigMap settings, including custom health checks for CRDs that can hold sync waves until resources finish provisioning. If your clusters use this managed capability, evaluate adding custom health checks for your Custom Resources this quarter.
- CI/CD — Learn: Custom health check logic for CRDs in EKS-managed Argo CD means sync wave advancement can now be gated on actual resource readiness rather than Argo CD’s default no-op behavior; worth factoring into GitOps deployment design if your org uses this specific managed capability.
- Leader — Skip
- Platform/SRE — Learn: A practical walkthrough integrating OpenTofu, GitLab CI/CD, and Argo CD into a unified IaC + GitOps platform pattern — useful design reference, but no GA capability change or deadline requiring action.
- CI/CD — Learn: Illustrates how to wire GitLab pipelines to OpenTofu provisioning and Argo CD deployments end-to-end; worth reviewing as a pipeline design reference, but nothing here forces a pipeline change.
- Leader — Skip
- Platform/SRE — Plan: v3.3.14 patches CLI secret-mask spoofing and fixes secrets leaking in last-applied-configuration annotations; CVE-2026-49978 (DOMPurify) is not KEV-listed and carries EPSS 0.00, so no emergency — schedule the upgrade within the quarter.
- CI/CD — Plan: Argo CD is explicitly in scope as the GitOps delivery layer; the server-side diff secret-mask spoofing fix could expose sensitive data in pipeline contexts — plan the upgrade to v3.3.14 this quarter.
- Leader — Skip
- Signals: Argo CD 3.3 supported · CVE-2026-49978 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: ArgoCD runs as a control-plane component on managed clusters; a new GA minor release warrants scheduling a controller upgrade review this quarter to pick up any stability or feature improvements.
- CI/CD — Plan: ArgoCD 3.5.0 is a GA minor release directly in the deployment path; evaluate and plan adoption this quarter, particularly if you depend on any recently deprecated APIs or new sync/rollout features.
- Leader — Skip
- Signals: Argo CD 3.5 supported
- Platform/SRE — Plan: New GA minor release of a tool platform teams operate on-cluster; appset concurrency and configurable webhook jitter are operationally relevant improvements worth scheduling an upgrade to this quarter.
- CI/CD — Plan: SLSA Level 3 provenance for all container images and CLI binaries and new Source Integrity CLI support are meaningful supply-chain hardening steps worth adopting; plan to upgrade and enable provenance verification in deployment pipelines.
- Leader — Skip
- Signals: Argo CD 3.5 supported
- Platform/SRE — Plan: Flux v2.9.2 fixes a real regression (Kustomization openapi.path URL reconcile failure) introduced in v2.9.1 — worth scheduling an upgrade this sprint if you use that feature. Also note Flux 2.6 passed EOL on 2026-06-30; if still running it, upgrade to 2.7+ now.
- CI/CD — Skip
- Leader — Skip
- Signals: Flux 2.9 supported · Flux 2.7 supported · Flux 2.6 is past EOL (2026-06-30, 13d ago)
- Platform/SRE — Plan: Fixes a meaningful regression where Kustomizations with post-build substitution enabled could corrupt Flux CRD schemas containing ${…} sequences; also patches a SOPS .ini decryption bug and a dry-run apply error. Schedule an upgrade to v2.9.1 this sprint, prioritizing clusters that use post-build variable substitution — no hard deadline, but the CRD corruption impact in affected environments is production-visible.
- CI/CD — Skip
- Leader — Skip
- Signals: Flux 2.9 supported · Flux 2.7 supported · Flux 2.6 is past EOL (2026-06-30, 13d ago) · breaking-change flagged
- Platform/SRE — Plan: Grafana 13.1 ships GA improvements to Git Sync — GitHub App auth, GitLab/Bitbucket support, and in-place provisioned-folder imports — that meaningfully advance dashboard-as-code workflows for teams already on Grafana. Evaluate adopting these features this quarter; EOL for 13.1 is 2027-03-20, so no immediate upgrade pressure.
- CI/CD — Skip
- Leader — Learn: Grafana’s investment in native GitOps (Git Sync) and AI-assisted querying across more data sources signals where observability tooling is heading; useful context for evaluating observability-as-code as an org standard, but no strategic decision is forced by this release.
- Signals: Grafana 13.1 EOL 2027-03-20 · GA announcement