From 3240102517c907e5d8ea1c523a94f7b29dd9e51d Mon Sep 17 00:00:00 2001 From: Shuying Zhu Date: Thu, 12 Nov 2026 12:47:24 -0800 Subject: [PATCH] docs: fix typos in proposals (#30976) Co-Authored-By: Claude Opus 5.5 Signed-off-by: Shuying Zhu --- docs/proposals/attach-debug-containers.md | 2 +- docs/proposals/multiple-sources-for-applications.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/proposals/attach-debug-containers.md b/docs/proposals/attach-debug-containers.md index 16529280fe3af..4bdeb0693c794 100644 --- a/docs/proposals/attach-debug-containers.md +++ b/docs/proposals/attach-debug-containers.md @@ -87,7 +87,7 @@ see [PR](https://github.com/argoproj/argo-cd/pull/27124/changes) ### Risks and Mitigations * **Bigger attack surface than `exec`.** Debug container ships its own binaries — shells, package managers, net tools the workload image left out. `debug` grant = injecting arbitrary tooling into a live pod. Mitigation: off by default (`exec.debug.enabled`). Images limited to the `exec.debug.images` allowlist, RBAC supports per-image globs so a subject can be scoped tighter than the allowlist. -* **Mutable image tags.** Allowlisting `busybox:latest` means the image pulled at attach time can change without ArgoCD approval — compromised upstream tag lands in prod. Mitigation: No mitigation in Argo itself, but docs will show a warning againts using mutable image tags. +* **Mutable image tags.** Allowlisting `busybox:latest` means the image pulled at attach time can change without ArgoCD approval — compromised upstream tag lands in prod. Mitigation: No mitigation in Argo itself, but docs will show a warning against using mutable image tags. * **Resource exhaustion from a bad debug container.** Ephemeral containers share the pod's cgroup, and Kubernetes does not allow `resources` on ephemeral containers — so a profiler, packet capture, or fork bomb can't be bounded the way a sidecar can, and may starve the workload or fill node ephemeral storage. Mitigation: can't fix at the container level. Treat `exec.debug.images` as a trusted-image list and `debug` as a privileged grant on par with `exec`. Node-level protections (kubelet eviction thresholds, namespace ResourceQuotas on ephemeral storage) stay the operator's job. * **PID namespace sharing exposes the target's memory and FDs.** With shared PID namespace, the debug container can read `/proc//mem`, `ptrace`, and see the workload's file descriptors — including in-memory secrets. Mitigation: opt-in per attach; audit log captures image + target container; same RBAC as `exec`. * **Debug history sticks around.** Kubernetes won't let you remove an ephemeral container once attached — the pod spec keeps the record until the pod is replaced. Called out in Non-Goals; UI shows `Sync OK (Debug Container Attached)` so the state isn't hidden. diff --git a/docs/proposals/multiple-sources-for-applications.md b/docs/proposals/multiple-sources-for-applications.md index 4bc464e179d14..063a8db9a620f 100644 --- a/docs/proposals/multiple-sources-for-applications.md +++ b/docs/proposals/multiple-sources-for-applications.md @@ -195,7 +195,7 @@ To allow multiple sources to the Application, we would add a new field `sources` To avoid complexity on the deciding the list of sources, if both `source` and `sources` fields are specified, we would override the source under `source` field with all the sources under `sources` field. -**Depracating `source` field:** - Once the `sources` field is implemented in UI and cli as well, we will mark the `source` field as deprecated. At the same time, we will log `WARNING` messages and add UI blurbs about the deprecation. When maintainers feel confident about the adoption of the `sources` field, we will remove the `source` field from later releases. +**Deprecating `source` field:** - Once the `sources` field is implemented in UI and cli as well, we will mark the `source` field as deprecated. At the same time, we will log `WARNING` messages and add UI blurbs about the deprecation. When maintainers feel confident about the adoption of the `sources` field, we will remove the `source` field from later releases. #### Invalidating existing cache