feat(redis): Allow loading credentials from a mounted file path #23487

Mangaal · 2025-06-19T11:15:14Z

Description

This PR introduces a more secure method for providing Redis credentials to Argo CD components by allowing them to be loaded from a specified file path. Currently, Redis credentials (password, username, sentinel credentials) are configured via environment variables (e.g., REDIS_PASSWORD). Storing secrets in environment variables is a common practice but can be less secure than using file-based secrets.

This change is backward-compatible. Existing setups using environment variables will continue to work without any modification

Proposed Change
This PR introduces a new mechanism to load Redis credentials from files:

New Environment Variable: A new environment variable, REDIS_CREDS_FILE_PATH, is introduced. This variable should point to a directory where credential files are mounted.
File-Based Credential Loading: When REDIS_CREDS_FILE_PATH is set, Argo CD will attempt to read credentials from the following files within that directory:
- auth: The password for the main Redis connection.
- auth_username: The username for the main Redis connection.
- sentinel_auth: The password for Redis Sentinel connections.
- sentinel_username: The username for Redis Sentinel connections.
Fallback Logic: The implementation prioritises credentials loaded from the file path. If REDIS_CREDS_FILE_PATH is not set, or if a specific credential file does not exist, the system gracefully falls back to using the corresponding environment variables (REDIS_PASSWORD, REDIS_USERNAME, etc.). This ensures full backward compatibility.

Implementation Details

A new struct redisCreds was added to hold the set of credentials.
A new function loadRedisCredsFromFile(mountPath string) was created to handle the logic of reading the individual credential files from the specified mountPath. It is designed to be resilient to missing files, returning empty strings for any credential that cannot be read.
The AddCacheFlagsToCmd function has been updated to incorporate this new logic. It first checks for the REDIS_CREDS_FILE_PATH environment variable. If present, it calls loadRedisCredsFromFile and then checks if any credentials still need to be populated from the environment variables.

How to Test This Change
Mount the Secret into your Argo CD pods (e.g., argocd-repo-server, argocd-application-controller) and set the new environment variable.

spec:
  template:
    spec:
      containers:
      - name: your-argocd-container
        env:
        - name: REDIS_CREDS_FILE_PATH
          value: "/etc/redis-creds"
        # IMPORTANT: Ensure the old env vars like REDIS_PASSWORD are NOT set
        # to verify the new mechanism is working.
        volumeMounts:
        - name: redis-creds-volume
          mountPath: "/etc/redis-creds"
          readOnly: true
      volumes:
      - name: redis-creds-volume
        secret:
          secretName: argocd-redis-creds

Related Issue

Fixes #20619

bunnyshell · 2025-06-19T11:15:19Z

❌ Preview Environment deleted from Bunnyshell

Available commands (reply to this comment):

🚀 /bns:deploy to deploy the environment

util/cache/cache.go

anandf

LGTM

codecov · 2025-06-19T12:44:27Z

Codecov Report

❌ Patch coverage is 55.10204% with 22 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.36%. Comparing base (12d3f5d) to head (f62ac71).

Files with missing lines	Patch %	Lines
util/cache/cache.go	55.10%	17 Missing and 5 partials ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #23487   +/-   ##
=======================================
  Coverage   60.36%   60.36%           
=======================================
  Files         350      350           
  Lines       60036    60070   +34     
=======================================
+ Hits        36242    36264   +22     
- Misses      20877    20894   +17     
+ Partials     2917     2912    -5

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

ishitasequeira

Overall code looks good!! Can we add some documentation about the feature?

util/cache/cache.go

Mangaal · 2025-06-30T05:53:57Z

@ishitasequeira , I have added documentation for the new Redis credentials file-mount feature in the FAQ section.
Please have a look and let me know if any changes are needed.

agaudreault · 2025-07-04T15:12:06Z

docs/faq.md

+
+| Variable Name           | Description                                   |
+|-------------------------|-----------------------------------------------|
+| `REDIS_CREDS_FILE_PATH` | Path to the directory containing credential files |


This PR should update the default kustomize manifests in manifests/ to use that variable and mount the argocd-redis secret

I have updated the default kustomize manifests as well as the ha.

util/cache/cache.go

nmirasch · 2025-07-21T09:56:43Z

LGTM

argoproj#23774) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

…ties (argoproj#23787) Signed-off-by: xiaopeng <[email protected]> Signed-off-by: Mangaal <[email protected]>

Signed-off-by: Mangaal <[email protected]>

Signed-off-by: warjiang <[email protected]> Signed-off-by: Mangaal <[email protected]>

…st/container (argoproj#23800) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

Signed-off-by: Mangaal <[email protected]>

…proj#23643) (argoproj#23644) Signed-off-by: Michael Crenshaw <[email protected]> Co-authored-by: rumstead <[email protected]> Signed-off-by: Mangaal <[email protected]>

…ks (argoproj#24421) Signed-off-by: Aamir017 <[email protected]> Signed-off-by: Mangaal <[email protected]>

Signed-off-by: Grégoire Salamin <[email protected]> Signed-off-by: Mangaal <[email protected]>

…goproj#24445) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

…4443) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

…j#24413) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

Signed-off-by: Navaneethan <[email protected]> Signed-off-by: Mangaal <[email protected]>

Signed-off-by: Fox Danger Piacenti <[email protected]> Signed-off-by: Mangaal <[email protected]>

…1.23.2 (argoproj#24442) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

Signed-off-by: Michael Crenshaw <[email protected]> Signed-off-by: Mangaal <[email protected]>

…4441) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

Signed-off-by: CI <[email protected]> Co-authored-by: CI <[email protected]> Signed-off-by: Mangaal <[email protected]>

…goproj#24415) Signed-off-by: Pavel Aborilov <[email protected]> Signed-off-by: Mangaal <[email protected]>

Signed-off-by: Michael Crenshaw <[email protected]> Signed-off-by: Mangaal <[email protected]>

…appset (argoproj#23900) Signed-off-by: nitishfy <[email protected]> Co-authored-by: Alexandre Gaudreault <[email protected]> Signed-off-by: Mangaal <[email protected]>

Signed-off-by: Peter Jiang <[email protected]> Signed-off-by: Mangaal <[email protected]>

…roj#24436) Signed-off-by: Michael Crenshaw <[email protected]> Signed-off-by: Mangaal <[email protected]>

…#24444) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

…4472) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

…cript does not exist argoproj#24490 (argoproj#24491) Signed-off-by: Codey Jenkins <[email protected]> Signed-off-by: Mangaal <[email protected]>

Signed-off-by: Mangaal <[email protected]>

…ets-via-volume-mount

Signed-off-by: Mangaal <[email protected]>

…ets-via-volume-mount

…/argo-cd into secrets-via-volume-mount

Mangaal · 2025-09-17T09:44:31Z

Closing this PR due to rebase issues. I’ve created a new PR with the same fix here: [#24597]. Please continue the discussion/review there.

Mangaal requested a review from a team as a code owner June 19, 2025 11:15

anandf reviewed Jun 19, 2025

View reviewed changes

util/cache/cache.go Outdated Show resolved Hide resolved

Mangaal changed the title ~~feat(redis): Allow loading credentials from a mounted file path~~ (wip)feat(redis): Allow loading credentials from a mounted file path Jun 19, 2025

blakepettersson changed the title ~~(wip)feat(redis): Allow loading credentials from a mounted file path~~ feat(redis): Allow loading credentials from a mounted file path (wip) Jun 19, 2025

Mangaal changed the title ~~feat(redis): Allow loading credentials from a mounted file path (wip)~~ feat(redis): Allow loading credentials from a mounted file path Jun 19, 2025

anandf approved these changes Jun 19, 2025

View reviewed changes

ishitasequeira reviewed Jun 23, 2025

View reviewed changes

util/cache/cache.go Show resolved Hide resolved

nitishfy reviewed Jun 25, 2025

View reviewed changes

util/cache/cache.go Show resolved Hide resolved

nitishfy reviewed Jun 25, 2025

View reviewed changes

util/cache/cache.go Show resolved Hide resolved

Mangaal requested a review from a team as a code owner June 30, 2025 05:45

Mangaal requested a review from ishitasequeira June 30, 2025 05:51

Mangaal requested a review from nitishfy June 30, 2025 09:47

agaudreault requested changes Jul 4, 2025

View reviewed changes

Mangaal requested a review from agaudreault July 16, 2025 12:07

nitishfy mentioned this pull request Aug 1, 2025

REQUEST: Promotion to Approver for @nitishfy argoproj/argoproj#373

Closed

6 tasks

dependabot bot and others added 11 commits September 10, 2025 14:22

chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.8.1 to 4.9.0 (

a2010f8

argoproj#23774) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

fix(ui): account detail page crashes for accounts with empty capabili…

19054f4

…ties (argoproj#23787) Signed-off-by: xiaopeng <[email protected]> Signed-off-by: Mangaal <[email protected]>

update redis init.sh

a7962a2

Signed-off-by: Mangaal <[email protected]>

update redis ha overlay to update configmap

5510ccb

Signed-off-by: Mangaal <[email protected]>

update redis ha overlay to update configmap in kustomize yaml

8512dd8

Signed-off-by: Mangaal <[email protected]>

run make manifest-local

db9c46a

Signed-off-by: Mangaal <[email protected]>

fix: typo err for GetConditions comment (argoproj#23807)

1dd3a45

Signed-off-by: warjiang <[email protected]> Signed-off-by: Mangaal <[email protected]>

chore(deps): bump library/registry from 1fc7de6 to 45fbac2 in /te…

7866233

…st/container (argoproj#23800) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

added a new config-map

f2338ee

Signed-off-by: Mangaal <[email protected]>

read redis image from redis container

c11e2f0

Signed-off-by: Mangaal <[email protected]>

fix(repo-server): support .argocd-source.yaml kustomize version (argo…

27042be

…proj#23643) (argoproj#23644) Signed-off-by: Michael Crenshaw <[email protected]> Co-authored-by: rumstead <[email protected]> Signed-off-by: Mangaal <[email protected]>

Aamir017 and others added 20 commits September 10, 2025 14:32

docs: clarify manifest-generate-paths annotation usage without webhoo…

109352e

…ks (argoproj#24421) Signed-off-by: Aamir017 <[email protected]> Signed-off-by: Mangaal <[email protected]>

docs: Use enabled in application example (argoproj#24448)

355031e

Signed-off-by: Grégoire Salamin <[email protected]> Signed-off-by: Mangaal <[email protected]>

chore(deps): bump softprops/action-gh-release from 2.3.2 to 2.3.3 (ar…

53e9e96

…goproj#24445) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

chore(deps): bump golang.org/x/sync from 0.16.0 to 0.17.0 (argoproj#2…

b65013a

…4443) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

chore(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (argopro…

fe7132a

…j#24413) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

docs: Fix cluster bootstrapping documentation (argoproj#24353)

611f13e

Signed-off-by: Navaneethan <[email protected]> Signed-off-by: Mangaal <[email protected]>

docs: Change reference URL for HA manifests to stable. (argoproj#24049)

65c00c9

Signed-off-by: Fox Danger Piacenti <[email protected]> Signed-off-by: Mangaal <[email protected]>

chore(refactor): use contexts in hydration operations (argoproj#24431)

644d720

Signed-off-by: Michael Crenshaw <[email protected]> Signed-off-by: Mangaal <[email protected]>

chore(deps): bump golang.org/x/time from 0.12.0 to 0.13.0 (argoproj#2…

9222515

…4441) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

[Bot] docs: Update Snyk report (argoproj#24437)

740ee44

Signed-off-by: CI <[email protected]> Co-authored-by: CI <[email protected]> Signed-off-by: Mangaal <[email protected]>

fix: correct post-delete finalizer removal when cluster not found (ar…

7b1d47a

…goproj#24415) Signed-off-by: Pavel Aborilov <[email protected]> Signed-off-by: Mangaal <[email protected]>

chore(refactor): simplify hydrator manifest generation (argoproj#24427)

1f8d637

Signed-off-by: Michael Crenshaw <[email protected]> Signed-off-by: Mangaal <[email protected]>

fix: change the appset namespace to server namespace when generating …

b27a820

…appset (argoproj#23900) Signed-off-by: nitishfy <[email protected]> Co-authored-by: Alexandre Gaudreault <[email protected]> Signed-off-by: Mangaal <[email protected]>

chore: bump k8s 1.34 (argoproj#24405)

c5b9d88

Signed-off-by: Peter Jiang <[email protected]> Signed-off-by: Mangaal <[email protected]>

feat(hydrator): parallelize repo-server calls (argoproj#24451) (argop…

59017cd

…roj#24436) Signed-off-by: Michael Crenshaw <[email protected]> Signed-off-by: Mangaal <[email protected]>

chore(deps): bump golang.org/x/oauth2 from 0.30.0 to 0.31.0 (argoproj…

7f9eda0

…#24444) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

chore(deps): bump golang.org/x/term from 0.34.0 to 0.35.0 (argoproj#2…

bc7fa19

…4472) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Mangaal <[email protected]>

fix: RunResourceAction: error getting Lua resource action: built-in s…

d6ca70e

…cript does not exist argoproj#24490 (argoproj#24491) Signed-off-by: Codey Jenkins <[email protected]> Signed-off-by: Mangaal <[email protected]>

empty commit to trigger CI

eb7c25c

Signed-off-by: Mangaal <[email protected]>

Mangaal force-pushed the secrets-via-volume-mount branch from 174b4a3 to eb7c25c Compare September 10, 2025 09:03

Mangaal requested a review from a team as a code owner September 10, 2025 09:03

Mangaal added 5 commits September 10, 2025 14:36

Merge branch 'master' of https://github.com/Mangaal/argo-cd into secr…

c44a81d

…ets-via-volume-mount

empty commit to trigger CI again

2ae5e32

Signed-off-by: Mangaal <[email protected]>

Merge branch 'argoproj:master' into secrets-via-volume-mount

5efb134

Merge branch 'master' of https://github.com/Mangaal/argo-cd into secr…

9bcd8ac

…ets-via-volume-mount

Merge branch 'secrets-via-volume-mount' of https://github.com/Mangaal…

8f43516

…/argo-cd into secrets-via-volume-mount

Mangaal closed this Sep 17, 2025

Mangaal mentioned this pull request Sep 19, 2025

feat(redis): Secrets credentials via volume mount #24597

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(redis): Allow loading credentials from a mounted file path #23487

feat(redis): Allow loading credentials from a mounted file path #23487

Uh oh!

Mangaal commented Jun 19, 2025

Uh oh!

bunnyshell bot commented Jun 19, 2025 •

edited

Loading

Uh oh!

Uh oh!

anandf left a comment

Uh oh!

codecov bot commented Jun 19, 2025 •

edited

Loading

Uh oh!

ishitasequeira left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mangaal commented Jun 30, 2025

Uh oh!

agaudreault Jul 4, 2025 •

edited

Loading

Uh oh!

Mangaal Jul 15, 2025

Uh oh!

Uh oh!

nmirasch commented Jul 21, 2025

Uh oh!

Mangaal commented Sep 17, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

89 participants

feat(redis): Allow loading credentials from a mounted file path #23487

feat(redis): Allow loading credentials from a mounted file path #23487

Uh oh!

Conversation

Mangaal commented Jun 19, 2025

Description

Related Issue

Uh oh!

bunnyshell bot commented Jun 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Preview Environment deleted from Bunnyshell

Uh oh!

Uh oh!

anandf left a comment

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Jun 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ishitasequeira left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mangaal commented Jun 30, 2025

Uh oh!

agaudreault Jul 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mangaal Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

nmirasch commented Jul 21, 2025

Uh oh!

Mangaal commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

89 participants

bunnyshell bot commented Jun 19, 2025 •

edited

Loading

codecov bot commented Jun 19, 2025 •

edited

Loading

agaudreault Jul 4, 2025 •

edited

Loading

Mangaal commented Sep 17, 2025 •

edited

Loading