github.com/argoproj/argo-cd/v2@v2.10.9/docs/operator-manual/upgrading/2.1-2.2.md (about)

     1  # v2.1 to 2.2
     2  
     3  ## Upgraded Helm Version
     4  
     5  Note that bundled Helm has been upgraded from 3.6.0 to v3.7+. This includes following breaking changes:
     6  
     7  - Repository credentials are no longer passed to download charts that
     8    are being served from a different domain than the repository.
     9  
    10    You can still force older behavior with `--helm-pass-credentials` option to `argocd app create`.
    11  
    12    More information in the [Helm v3.6.1 release notes](https://github.com/helm/helm/releases/tag/v3.6.1).
    13  
    14  - Experimental OCI support has been rewritten.
    15  
    16    More information in the [Helm v3.7.0 release notes](https://github.com/helm/helm/releases/tag/v3.7.0).
    17  
    18  ## Support for private repo SSH keys using the SHA-1 signature hash algorithm is removed in 2.2.12
    19  
    20  Argo CD 2.2.12 upgraded its base image from Ubuntu 21.10 to Ubuntu 22.04, which upgraded OpenSSH to 8.9. OpenSSH starting
    21  with 8.8 [dropped support for the `ssh-rsa` SHA-1 key signature algorithm](https://www.openssh.com/txt/release-8.8).
    22  
    23  The signature algorithm is _not_ the same as the algorithm used when generating the key. There is no need to update
    24  keys.
    25  
    26  The signature algorithm is negotiated with the SSH server when the connection is being set up. The client offers its
    27  list of accepted signature algorithms, and if the server has a match, the connection proceeds. For most SSH servers on
    28  up-to-date git providers, acceptable algorithms other than `ssh-rsa` should be available.
    29  
    30  Before upgrading to Argo CD 2.2.12, check whether your git provider(s) using SSH authentication support algorithms newer
    31  than `rsa-ssh`.
    32  
    33  1. Make sure your version of SSH >= 8.9 (the version used by Argo CD). If not, upgrade it before proceeding.
    34  
    35     ```shell
    36     ssh -V
    37     ```
    38  
    39     Example output: `OpenSSH_8.9p1 Ubuntu-3, OpenSSL 3.0.2 15 Mar 2022`
    40  
    41  2. Once you have a recent version of OpenSSH, follow the directions from the [OpenSSH 8.8 release notes](https://www.openssh.com/txt/release-8.7):
    42  
    43     > To check whether a server is using the weak ssh-rsa public key
    44     > algorithm, for host authentication, try to connect to it after
    45     > removing the ssh-rsa algorithm from ssh(1)'s allowed list:
    46     >
    47     > ```shell
    48     > ssh -oHostKeyAlgorithms=-ssh-rsa user@host
    49     > ```
    50     >
    51     > If the host key verification fails and no other supported host key
    52     > types are available, the server software on that host should be
    53     > upgraded.
    54  
    55     If the server does not support an acceptable version, you will get an error similar to this;
    56  
    57     ```
    58     $ ssh -oHostKeyAlgorithms=-ssh-rsa vs-ssh.visualstudio.com
    59     Unable to negotiate with 20.42.134.1 port 22: no matching host key type found. Their offer: ssh-rsa
    60     ```
    61  
    62     This indicates that the server needs to update its supported key signature algorithms, and Argo CD will not connect
    63     to it.
    64  
    65  ### Workaround
    66  
    67  The [OpenSSH 8.8 release notes](https://www.openssh.com/txt/release-8.8) describe a workaround if you cannot change the
    68  server's key signature algorithms configuration.
    69  
    70  > Incompatibility is more likely when connecting to older SSH
    71  > implementations that have not been upgraded or have not closely tracked
    72  > improvements in the SSH protocol. For these cases, it may be necessary
    73  > to selectively re-enable RSA/SHA1 to allow connection and/or user
    74  > authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
    75  > options. For example, the following stanza in ~/.ssh/config will enable
    76  > RSA/SHA1 for host and user authentication for a single destination host:
    77  >
    78  > ```
    79  > Host old-host
    80  >     HostkeyAlgorithms +ssh-rsa
    81  >     PubkeyAcceptedAlgorithms +ssh-rsa
    82  > ```
    83  >
    84  > We recommend enabling RSA/SHA1 only as a stopgap measure until legacy
    85  > implementations can be upgraded or reconfigured with another key type
    86  > (such as ECDSA or Ed25519).
    87  
    88  To apply this to Argo CD, you could create a ConfigMap with the desired ssh config file and then mount it at
    89  `/home/argocd/.ssh/config`.