Skip to content

Commit 50532ec

Browse files
author
Kugamoorthy Gajananan
authored
Git storage support, document update and refactoring (#7)
* initial implementation of argocd-interlace Signed-off-by: [email protected] <[email protected]> * Feature/initial implementation (#3) * fixed paths in Dockerfile, changes git cloning approach, fixed dependencies Signed-off-by: [email protected] <[email protected]> * fixed retriving yq in Dockerfile, added licenses to all files Signed-off-by: [email protected] <[email protected]> * fixed error handling, lint check, removed hardcoded server url Signed-off-by: [email protected] <[email protected]> * removed secrets from kustomization.yaml, skip changes to application that manages manifest Signed-off-by: [email protected] <[email protected]> * Added getting started doc Signed-off-by: [email protected] <[email protected]> * Fixed dependencies, Dockerfile, refactored packages Signed-off-by: [email protected] <[email protected]> * Fixed dependencies, error handling, refactored packages Signed-off-by: [email protected] <[email protected]> * Change storage method name, error handling, constant names, fixed generating manifest bundle Signed-off-by: [email protected] <[email protected]> * Fixed manifest generattion and provenance creation flow, error handleing, added simple document Signed-off-by: [email protected] <[email protected]> * Fix/review init implementation (#4) * Removed unnecessary code, improved error handling, changed rbac, license year Signed-off-by: [email protected] <[email protected]> * load config from setup * load config from setup, validation of config, role and rolebinding * removed manifest application * Moved env settings out of deployment yaml to patch.yaml * Fixed document, rest API url * Fixed document * Fixed retriving latest revision if it is missing in application status, fixed dependency * Fixed readme documentation * Fixed readme documentation * Feature/git storage (#6) * Added support for gitops based manifest bundle storage * Added support for application set based mangest bundle distribution * Added logging for showing demo steps * Fixed secret name * Added logging for showing the flow * Added simplified document for quick start (#5) * Added simplified document for quick start * Added simplified document for quick start * Added simplified document for quick start, fixed links * Fixed document for quick start and other setup * Fixed documents, and env variable settings * Fixed documents * Added new animation demo intro * Fixed deployment manifests * Fixed deployment manifests (#7) * Fixed manifests * Rearranged readme, and fixed missing information to get the flow correctly (#8) * Resolved conflicts with upstream main before PR merge (#9) * Fix/upstream merge (#10) * Resolved conflicts with upstream main before PR merge * Resolved conflicts with upstream main before PR merge, fixed license year * Resolved conflicts with upstream main before PR merge, fixed readme * Resolved conflicts with upstream main before PR merge, fixed readme * Remove private registry name, removed unused documents * Reorganized readme docs * Fixed Readme sentences * Fixed Readme and docs links * Fixed Readme and docs links * Fixed typo * Fixed readme and docs
1 parent 188918e commit 50532ec

27 files changed

+1127
-341
lines changed

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#
2-
# Copyright 2020 IBM Corporation
2+
# Copyright 2021 IBM Corporation
33
#
44
# Licensed under the Apache License, Version 2.0 (the "License");
55
# you may not use this file except in compliance with the License.

‎README.md‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ ArgoCD is widely used for enabling CD GitOps. ArgoCD internally builds manifest
44

55
ArgoCD Interlace enhances ArgoCD capability from end-to-end software supply chain security viewpoint. Interlace adds authenticity of the manifest and the traceability to the source to ArgoCD.
66

7-
ArgoCD Interlace works as a Kubernetes Custom Resource Definition (CRD) controller. Interlace monitors the trigger from state changes of Application resources on the ArgoCD cluster. When detecting new manifest build, Interlace sign the manifest, record the detail of manifest build such as the source files for the build, the command to produce the manifest for reproducibility. Interlace stores those details as provenance records in in-toto format.
7+
ArgoCD Interlace works as a Kubernetes Custom Resource Definition (CRD) controller. Interlace monitors the trigger from state changes of Application resources on the ArgoCD cluster. When detecting new manifest build, Interlace sign the manifest, record the detail of manifest build such as the source files for the build, the command to produce the manifest for reproducibility. Interlace stores those details as provenance records in [in-toto](https://in-toto.io) format and upload it to [Sigstore](https://sigstore.dev/) log for verification.
88

99
![ArgoCD-Interlace-Arch](./images/argocd-interlace-arch.png)
1010

@@ -15,6 +15,34 @@ The features are
1515
- Sign manifest
1616
- Record provenance in intoto format
1717

18+
### Installation
19+
Prerequisite: Install [ArgoCD](https://argo-cd.readthedocs.io/en/stable/getting_started/) on your Kubernetes cluster before you install ArgoCD Interlace.
1820

19-
Demo
21+
22+
To install the latest version of ArgoCD Interlace to your cluster, run:
23+
```
24+
kubectl apply --filename https://raw.githubusercontent.com/IBM/argocd-interlace/main/releases/release.yaml
25+
```
26+
This creates a default installation of ArgoCD Interlace, however you will need futher setup for seeing it in action.
27+
28+
To verify that installation was successful, ensure Status of pod `argocd-interlace-controller` become `Running`:
29+
```shell
30+
$ kubectl get pod -n argocd-interlace -w
31+
NAME READY STATUS RESTARTS AGE
32+
pod/argocd-interlace-controller-f57fd69fb-72l4h 1/1 Running 0 19m
33+
```
34+
35+
### Setup
36+
37+
To complete setting up ArgoCD Interlace, configure secrets for:
38+
* [ArgoCD REST API authentication for querying ArgoCD REST API to retrive desired manifest for an application](docs/argo_setup.md)
39+
* [OCI image registry authentication for pushing OCI images generated by Interlace](docs/oci_setup.md)
40+
* [Cosign based signing keys for creating signature for desired manifest.](docs/signing_key_setup.md)
41+
42+
43+
## Example Scenario
44+
To see ArgoCD Interlace in action, check the [example scenario](docs/example_scenario.md).
45+
46+
47+
### Demo
2048
![intro](images/intro.gif?)

‎deploy/application-set.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: ApplicationSet
3+
metadata:
4+
name: akmebank
5+
namespace: argocd
6+
spec:
7+
generators:
8+
- clusters: {}
9+
template:
10+
metadata:
11+
name: '{{name}}-manifest-bundles'
12+
spec:
13+
project: default
14+
syncPolicy:
15+
automated:
16+
prune: true
17+
selfHeal: true
18+
source:
19+
repoURL: https://github.com/gajananan/interlace-manifests
20+
targetRevision: main
21+
path: manifest-bundles/{{name}}
22+
destination:
23+
server: '{{server}}'
24+
namespace: bundle-manifests

‎deploy/kustomization.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ resources:
44
- role_binding.yaml
55
- deployment.yaml
66
- service_account.yaml
7+
- secrets.yaml
78

89
patchesJson6902:
910
- target:

‎deploy/patch.yaml‎

Lines changed: 46 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,29 +4,68 @@
44
- name: DOCKER_CONFIG
55
value: /tmp/.docker/
66
- name: MANIFEST_STORAGE_TYPE
7-
value: oci #/git
7+
value: oci #/git/oci
88
- name: OCI_IMAGE_REGISTRY
9-
value: gcr.io/kg-image-registry
9+
value: gcr.io/<some-registry-name>
1010
- name: OCI_IMAGE_PREFIX
11-
value: "argocd.apps.ma4kmc2"
11+
value: "argocd.apps"
1212
- name: OCI_IMAGE_TAG
1313
value: "mnf"
1414
- name: REKOR_SERVER
1515
value: https://rekor.sigstore.dev
1616
- name: COSIGN_PASSWORD
1717
value: ""
18+
- name: MANIFEST_ARGOCD_PROJECT
19+
value: default
1820
- name: MANIFEST_GITREPO_URL
19-
value: ""
21+
valueFrom:
22+
secretKeyRef:
23+
name: interlace-manifest-git-secret
24+
key: MANIFEST_GITREPO_URL
25+
- name: MANIFEST_GITREPO_SUFFIX
26+
valueFrom:
27+
secretKeyRef:
28+
name: interlace-manifest-git-secret
29+
key: MANIFEST_GITREPO_SUFFIX
30+
- name: MANIFEST_GITREPO_BRANCH
31+
valueFrom:
32+
secretKeyRef:
33+
name: interlace-manifest-git-secret
34+
key: MANIFEST_GITREPO_BRANCH
2035
- name: MANIFEST_GITREPO_TOKEN
21-
value: ""
36+
valueFrom:
37+
secretKeyRef:
38+
name: interlace-manifest-git-secret
39+
key: MANIFEST_GITREPO_TOKEN
2240
- name: MANIFEST_GITREPO_USER
23-
value: ""
41+
valueFrom:
42+
secretKeyRef:
43+
name: interlace-manifest-git-secret
44+
key: MANIFEST_GITREPO_USER
2445
- name: MANIFEST_GITREPO_USEREMAIL
25-
value: ""
46+
valueFrom:
47+
secretKeyRef:
48+
name: interlace-manifest-git-secret
49+
key: MANIFEST_GITREPO_USEREMAIL
50+
- name: MANIFEST_DEST_NAMESPACE
51+
valueFrom:
52+
secretKeyRef:
53+
name: interlace-manifest-git-secret
54+
key: MANIFEST_DEST_NAMESPACE
55+
- name: MANIFEST_GITREPO_MODE
56+
valueFrom:
57+
secretKeyRef:
58+
name: interlace-manifest-git-secret
59+
key: MANIFEST_GITREPO_MODE
2660
- name: K8S_MANIFEST_SIGSTORE_LOG_LEVEL
2761
value: info
2862
- name: ARGOCD_INTERLACE_LOG_LEVEL
2963
value: info
64+
- name: "ARGOCD_NAMESPACE"
65+
valueFrom:
66+
secretKeyRef:
67+
name: argocd-token-secret
68+
key: ARGOCD_NAMESPACE
3069
- name: ARGOCD_API_BASE_URL
3170
valueFrom:
3271
secretKeyRef:

‎deploy/secrets.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: signing-secrets
5+
namespace: argocd-interlace
6+
type: Opaque
7+
data:
8+
cosign.key: UkVQTEFDRSBUSElTCg==
9+
cosign.pub: UkVQTEFDRSBUSElTCg==
10+
11+
---
12+
apiVersion: v1
13+
kind: Secret
14+
metadata:
15+
name: argocd-interlace-gcr-secret
16+
namespace: argocd-interlace
17+
type: Opaque
18+
data:
19+
.dockerconfigjson: UkVQTEFDRSBUSElTCg==
20+
21+
---
22+
apiVersion: v1
23+
kind: Secret
24+
metadata:
25+
name: argocd-token-secret
26+
namespace: argocd-interlace
27+
type: Opaque
28+
data:
29+
ARGOCD_API_BASE_URL: UkVQTEFDRSBUSElTCg==
30+
ARGOCD_NAMESPACE: YXJnb2NkCg==
31+
ARGOCD_TOKEN: UkVQTEFDRSBUSElTCg==
32+
33+
---
34+
apiVersion: v1
35+
kind: Secret
36+
metadata:
37+
name: interlace-manifest-git-secret
38+
namespace: argocd-interlace
39+
type: Opaque
40+
data:
41+
MANIFEST_GITREPO_URL: UkVQTEFDRSBUSElTCg==
42+
MANIFEST_GITREPO_BRANCH: UkVQTEFDRSBUSElTCg==
43+
MANIFEST_GITREPO_TOKEN: UkVQTEFDRSBUSElTCg==
44+
MANIFEST_GITREPO_USER: UkVQTEFDRSBUSElTCg==
45+
MANIFEST_GITREPO_USEREMAIL: UkVQTEFDRSBUSElTCg==
46+
MANIFEST_DEST_NAMESPACE: UkVQTEFDRSBUSElTCg==
47+
MANIFEST_GITREPO_SUFFIX: UkVQTEFDRSBUSElTCg==
48+
MANIFEST_GITREPO_MODE: UkVQTEFDRSBUSElTCg==

0 commit comments

Comments
 (0)