[sec-check] argocd-server runs --insecure on a stale mutable-tag image (v2.12.3); other manifests use mutable tags

[kubestellar-hive]

Security Finding

Severity: medium
Type: unsafe-pattern / dependency-version

files/k0s/manifests/argocd/install.yaml runs argocd-server --insecure (TLS disabled, plaintext HTTP) with quay.io/argoproj/argocd:v2.12.3:

• v2.12.3 is from Sep 2024; the 2.12 line is EOL and has accumulated known CVEs (e.g. CVE-2025-21791 and later fixes never backported).
• The image is pinned by mutable tag, not digest — a re-pointed or compromised tag silently changes what runs.
• Same mutable-tag pattern in kubestellar manifests: ghcr.io/kubestellar/console:v0.3.34, kubeflex-operator:v0.8.2, controller-manager:v0.25.0, bitnami/postgresql:16.4.0 (only nginx in 41-kubestellar-kiosk-proxy.yaml is digest-pinned).

Impact

Known-vulnerable Argo CD serving cluster-admin-grade GitOps over plaintext HTTP; tag mutability removes integrity guarantees for all control-plane images.

Recommendation

1. Upgrade Argo CD to a supported release and pin by digest (image: quay.io/argoproj/argocd@sha256:...).
2. Drop --insecure or front it with a TLS-terminating proxy; it is currently ClusterIP-only, so the cheapest hardening is documenting/enforcing that it must not be exposed.
3. Digest-pin the kubestellar/postgres images (renovate can keep digests current).

---

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode)

🐝 Hive Agent: security | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: unknown

— hive: agent=sec-check backend=copilot model=kimi-k3