init

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Mayflower GmbH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,57 @@
+# argocd-nix-flakes-plugin
+
+**Status: proof of concept 🚧**
+
+An ArgoCD plugin that runs Nix flakes apps that generate Kubernetes resources.
+
+## How to install in ArgoCD
+
+In your `kustomize.yml` that sets up your ArgoCD cluster:
+
+```yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: argocd
+
+resources:
+- github.com/argoproj/argo-cd//manifests/cluster-install?ref=v2.5.5
+
+components:
+- github.com/mayflower/argocd-nix-flakes-plugin//manifests?ref=master
+```
+
+## How to use in your ArgoCD Application
+
+Add an `argoGenerate` app in your `flake.nix` that outputs Kubernetes manifests to
+stdout. See the `./flake.nix` file in this repo for an example how to use this with
+`kustomize`.
+
+The following example app uses `tanka` and needs to run `jsonnet-bundler` first to fetch
+dependencies:
+
+```nix
+{
+  apps.argoGenerate = flake-utils.lib.mkApp {
+    drv = pkgs.writers.writeBashBin "tanka-generate" ''
+      ${pkgs.jsonnet-bundler}/bin/jb install
+      ${pkgs.tanka}/bin/tk show
+    '';
+  }
+}
+```
+
+This plugin will automatically detect if a `flake.nix` is present and the
+`argoGenerate` app is defined.
+
+Note that sandboxing is disabled for Nix builds since ArgoCD requires sidecar containers
+to be run as uid 999 and Nix does not support sandboxed builds if not run as root.
+
+## ⚠️ Security Considerations ⚠️
+
+Even though Nix will *not* be run as root and the build is run in the sidecar container,
+ArgoCD does not recommend to allow to run untrusted code in plugins. The sidecar does
+not have access to Kubernetes clusters but is tied the `argocd-repo-server`. For instance,
+it might have access to other cloned repositories because the generate command calls
+themselves are not isolated. You are therefore advised to only deploy trusted code since
+all contents of the ArgoCD instance used to deploy the application might be exposed.

example/kustomization.yml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- github.com/argoproj/argo-cd//manifests/cluster-install?ref=v2.5.5
+
+components:
+- ../manifests

flake.nix

@@ -0,0 +1,17 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { nixpkgs, flake-utils, ... }:
+    flake-utils.lib.eachDefaultSystem (system:
+    let pkgs = nixpkgs.legacyPackages.${system}; in
+    {
+      apps.argoGenerate = flake-utils.lib.mkApp {
+        drv = pkgs.writers.writeBashBin "kustomize-generate" ''
+          ${pkgs.kubectl}/bin/kubectl kustomize example
+        '';
+      };
+    });
+}

manifests/argocd-cmd-params-cm.yml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cmd-params-cm
+data:
+  controller.repo.server.timeout.seconds: "120"
+  server.repo.server.timeout.seconds: "120"

manifests/argocd-repo-server.yml

@@ -0,0 +1,34 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-repo-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: nix-flakes
+          command: [/var/run/argocd/argocd-cmp-server]
+          image: ghcr.io/fpletz/docker-nixpkgs/nix-user:nixos-22.11
+          imagePullPolicy: Always
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 999
+          env:
+            - name: ARGOCD_EXEC_TIMEOUT
+              value: "120"
+          volumeMounts:
+            - mountPath: /var/run/argocd
+              name: var-files
+            - mountPath: /home/argocd/cmp-server/plugins
+              name: plugins
+            - mountPath: /home/argocd/cmp-server/config/plugin.yaml
+              subPath: nix-flakes.yaml
+              name: cmp-plugin
+            - mountPath: /tmp
+              name: cmp-tmp
+      volumes:
+        - configMap:
+            name: cmp-plugin
+          name: cmp-plugin
+        - emptyDir: {}
+          name: cmp-tmp

manifests/cmp-plugin.yml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cmp-plugin
+data:
+  nix-flakes.yaml: |
+    ---
+    apiVersion: argoproj.io/v1alpha1
+    kind: ConfigManagementPlugin
+    metadata:
+      name: argocd-nix-flakes-plugin
+    spec:
+      allowConcurrency: true
+      lockRepo: false
+      generate:
+        command: [nix, run, '.#apps.x86_64-linux.argoGenerate']
+      discover:
+        find:
+          command: ['nix', 'eval', '--impure', '--expr', '(builtins.getFlake (toString ./.)).apps.${builtins.currentSystem}.argoGenerate']

manifests/kustomization.yml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+- ./cmp-plugin.yml
+
+patchesStrategicMerge:
+- ./argocd-repo-server.yml
+- ./argocd-cmd-params-cm.yml