github.com/argoproj/argo-cd/v2@v2.10.9/docs/operator-manual/upgrading/2.2-2.3.md (about)

     1  # v2.2 to 2.3
     2  
     3  ## Argo CD Notifications and ApplicationSet Are Bundled into Argo CD
     4  
     5  The Argo CD Notifications and ApplicationSet are part of Argo CD now. You no longer need to install them separately.
     6  The Notifications and ApplicationSet components are bundled into default Argo CD installation manifests.
     7  
     8  The bundled manifests are drop-in replacements for the previous versions. If you are using Kustomize to bundle the manifests together then just
     9  remove references to https://github.com/argoproj-labs/argocd-notifications and https://github.com/argoproj-labs/applicationset.
    10  
    11  If you are using [the argocd-notifications helm chart](https://github.com/argoproj/argo-helm/tree/argocd-notifications-1.8.1/charts/argocd-notifications), you can move the chart [values](https://github.com/argoproj/argo-helm/blob/argocd-notifications-1.8.1/charts/argocd-notifications/values.yaml) to the `notifications` section of the argo-cd chart [values](https://github.com/argoproj/argo-helm/blob/main/charts/argo-cd/values.yaml#L2152). Although most values remain as is, for details please look up the values that are relevant to you.
    12  
    13  No action is required if you are using `kubectl apply`.
    14  
    15  ## Configure Additional Argo CD Binaries
    16  
    17  We have removed non-Linux Argo CD binaries (Darwin amd64 and Windows amd64) from the image ([#7668](https://github.com/argoproj/argo-cd/pull/7668)) and the associated download buttons in the help page in the UI.
    18  
    19  Those removed binaries will still be included in the release assets and we made those configurable in [#7755](https://github.com/argoproj/argo-cd/pull/7755). You can add download buttons for other OS architectures by adding the following to your `argocd-cm` ConfigMap:
    20  
    21  ```yaml
    22  apiVersion: v1
    23  kind: ConfigMap
    24  metadata:
    25    name: argocd-cm
    26    namespace: argocd
    27    labels:
    28      app.kubernetes.io/name: argocd-cm
    29      app.kubernetes.io/part-of: argocd
    30  data:
    31    help.download.linux-arm64: "path-or-url-to-download"
    32    help.download.darwin-amd64: "path-or-url-to-download"
    33    help.download.darwin-arm64: "path-or-url-to-download"
    34    help.download.windows-amd64: "path-or-url-to-download"
    35  ```
    36  
    37  ## Removed Python from the base image
    38  
    39  If you are using a [Config Management Plugin](../config-management-plugins.md) that relies on Python, you
    40  will need to build a custom image on the Argo CD base to install Python.
    41  
    42  ## Upgraded Kustomize Version
    43  
    44  Note that bundled Kustomize version has been upgraded from 4.2.0 to 4.4.1.
    45  
    46  ## Upgraded Helm Version
    47  
    48  Note that bundled Helm version has been upgraded from 3.7.1 to 3.8.0.
    49  
    50  ## Support for private repo SSH keys using the SHA-1 signature hash algorithm is removed in 2.3.7
    51  
    52  Argo CD 2.3.7 upgraded its base image from Ubuntu 21.04 to Ubuntu 22.04, which upgraded OpenSSH to 8.9. OpenSSH starting
    53  with 8.8 [dropped support for the `ssh-rsa` SHA-1 key signature algorithm](https://www.openssh.com/txt/release-8.8).
    54  
    55  The signature algorithm is _not_ the same as the algorithm used when generating the key. There is no need to update
    56  keys.
    57  
    58  The signature algorithm is negotiated with the SSH server when the connection is being set up. The client offers its
    59  list of accepted signature algorithms, and if the server has a match, the connection proceeds. For most SSH servers on
    60  up-to-date git providers, acceptable algorithms other than `ssh-rsa` should be available.
    61  
    62  Before upgrading to Argo CD 2.3.7, check whether your git provider(s) using SSH authentication support algorithms newer
    63  than `rsa-ssh`.
    64  
    65  1. Make sure your version of SSH >= 8.9 (the version used by Argo CD). If not, upgrade it before proceeding.
    66  
    67     ```shell
    68     ssh -V
    69     ```
    70  
    71     Example output: `OpenSSH_8.9p1 Ubuntu-3, OpenSSL 3.0.2 15 Mar 2022`
    72  
    73  2. Once you have a recent version of OpenSSH, follow the directions from the [OpenSSH 8.8 release notes](https://www.openssh.com/txt/release-8.7):
    74  
    75     > To check whether a server is using the weak ssh-rsa public key
    76     > algorithm, for host authentication, try to connect to it after
    77     > removing the ssh-rsa algorithm from ssh(1)'s allowed list:
    78     >
    79     > ```shell
    80     > ssh -oHostKeyAlgorithms=-ssh-rsa user@host
    81     > ```
    82     >
    83     > If the host key verification fails and no other supported host key
    84     > types are available, the server software on that host should be
    85     > upgraded.
    86  
    87     If the server does not support an acceptable version, you will get an error similar to this;
    88  
    89     ```
    90     $ ssh -oHostKeyAlgorithms=-ssh-rsa vs-ssh.visualstudio.com
    91     Unable to negotiate with 20.42.134.1 port 22: no matching host key type found. Their offer: ssh-rsa
    92     ```
    93  
    94     This indicates that the server needs to update its supported key signature algorithms, and Argo CD will not connect
    95     to it.
    96  
    97  ### Workaround
    98  
    99  The [OpenSSH 8.8 release notes](https://www.openssh.com/txt/release-8.8) describe a workaround if you cannot change the
   100  server's key signature algorithms configuration.
   101  
   102  > Incompatibility is more likely when connecting to older SSH
   103  > implementations that have not been upgraded or have not closely tracked
   104  > improvements in the SSH protocol. For these cases, it may be necessary
   105  > to selectively re-enable RSA/SHA1 to allow connection and/or user
   106  > authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
   107  > options. For example, the following stanza in ~/.ssh/config will enable
   108  > RSA/SHA1 for host and user authentication for a single destination host:
   109  >
   110  > ```
   111  > Host old-host
   112  >     HostkeyAlgorithms +ssh-rsa
   113  >     PubkeyAcceptedAlgorithms +ssh-rsa
   114  > ```
   115  >
   116  > We recommend enabling RSA/SHA1 only as a stopgap measure until legacy
   117  > implementations can be upgraded or reconfigured with another key type
   118  > (such as ECDSA or Ed25519).
   119  
   120  To apply this to Argo CD, you could create a ConfigMap with the desired ssh config file and then mount it at
   121  `/home/argocd/.ssh/config`.
   122