2.11.0 -> 2.11.1 changed the Registry for Redis and HAProxy from Docker to Amazon ECR breaking Cosign verification about argo-cd

[crenshaw-dev]

2.11.1 updated the upstream redis-ha chart version. That change included a change in image repo. https://github.com/DandyDeveloper/charts/pull/214/files

I don't think that change should have been included in our change. I'll open a PR to revert to the old image.

[avo-sepp]

Thank you Michael! That makes a lot of sense.

[avo-sepp]

https://github.com/argoproj/argo-cd/blob/8dff209cba4044ec8d0ff8ec32dd79bded7bafaf/manifests/ha/install.yaml#L22943

Line where change occurred. There are a few lines for HAProxy and Redis in this file that were all changed. You can search ecr.aws to find the changes.

f1a449e#diff-f57b731949fe998635a3f1de62d2cd7c5ae7139f7b288af17ee7f7166f3f5b6a

Commit which made the change.

[avo-sepp]

Also worth noting that the non-ha installs still use Docker Hub for HAProxy and Redis. This change only affects HA installers. Sort of a weird thing I noticed. Why use two registry sources?

[crenshaw-dev]

@avo-sepp could you check #18329 and let me know if the language of the third paragraph makes sense?

[avo-sepp]

Looks good. I would suggest using the word Policy for Cosign. Something like "make sure your Image Validation policy includes the AWS ECR as an approved registry"

[crenshaw-dev]

Pushed with that additional language! lmk if you'd like me to add you as a co-author, I'd just need an email to include in the commit message. :-)

[avo-sepp]

Sure! I can send you an email in Slack on the CNCF Slack. Do you usually use your Github hide-my-email address for these? That's what I use in commits.