argocd-audit

Enforce ArgoCD and Kubernetes manifest quality and security standards across flux/apps/ and raw-manifests/ directories through automated checks.

What it checks (11 checks):

1. Application Source (targetRevision pinned, HTTPS) - HIGH
2. SyncPolicy Config (automated, prune, selfHeal) - HIGH
3. Hardcoded Secrets (no secrets in Git) - HIGH
4. RBAC Wildcards (no * permissions) - HIGH
5. Istio Gateway TLS (TLS enabled, credentials) - HIGH
6. Application Project (not default, restrictions) - MEDIUM
7. ApplicationSet (goTemplate, missingkey=error) - MEDIUM
8. VirtualService Security (gateway, hosts) - MEDIUM
9. Deprecated APIs (no v1beta1) - MEDIUM
10. Namespace Spec (explicit namespace) - LOW
11. Metadata Best Practices (labels, annotations) - LOW

Running Checks

Full audit (all checks):

node .claude/skills/argocd-audit/scripts/run_all_checks.mjs

Generate report (all checks + markdown report):

node .claude/skills/argocd-audit/scripts/generate_report.mjs

Report saved to: reports/YYYY-MM-DD/argocd-audit.md

Individual checks:

node .claude/skills/argocd-audit/scripts/check_application_source.mjs
node .claude/skills/argocd-audit/scripts/check_sync_policy.mjs
node .claude/skills/argocd-audit/scripts/check_hardcoded_secrets.mjs
node .claude/skills/argocd-audit/scripts/check_rbac_wildcards.mjs
node .claude/skills/argocd-audit/scripts/check_istio_gateway_tls.mjs
node .claude/skills/argocd-audit/scripts/check_application_project.mjs
node .claude/skills/argocd-audit/scripts/check_applicationset.mjs
node .claude/skills/argocd-audit/scripts/check_virtualservice.mjs
node .claude/skills/argocd-audit/scripts/check_deprecated_apis.mjs
node .claude/skills/argocd-audit/scripts/check_namespace_spec.mjs
node .claude/skills/argocd-audit/scripts/check_metadata.mjs

Quality Rules

1. Application Source Validation (HIGH)

RULE: Pin source references for reproducibility. HEAD/floating refs = unpredictable deployments.

Violations:

• targetRevision: HEAD - can change without notice
• repoURL: http://... - insecure, use HTTPS
• Missing targetRevision - defaults to HEAD
• Chart source without targetRevision

Fix: Use targetRevision: main or targetRevision: v1.0.0.

---

2. SyncPolicy Configuration (HIGH)

RULE: Configure automated sync properly. Manual sync = drift accumulation.

Violations:

• No syncPolicy.automated block - manual sync required
• prune: false - orphaned resources accumulate
• selfHeal: false - manual drift correction required
• No retry configuration - transient failures not handled

Fix: Add automated: { prune: true, selfHeal: true } with retry config.

---

3. Hardcoded Secrets (HIGH)

RULE: Never store secrets in Git. Base64 encoding is NOT encryption.

Violations:

• kind: Secret with data: field - secrets exposed in Git
• kind: Secret with stringData: field - plaintext secrets
• Hardcoded passwords, tokens, API keys in any YAML
• Base64-encoded credentials (easily decoded)

Fix: Use External Secrets, Sealed Secrets, or HashiCorp Vault.

---

4. RBAC Wildcards (HIGH)

RULE: Follow least-privilege principle. Wildcard permissions = cluster takeover risk.

Violations:

• verbs: ["*"] - grants all actions
• resources: ["*"] - access to all resource types
• apiGroups: ["*"] - access across all API groups
• roleRef.name: cluster-admin - full cluster access
• verbs: [impersonate] - can act as other users

Fix: Use explicit verbs like [get, list, watch], explicit resources like [pods, services].

---

5. Istio Gateway TLS (HIGH)

RULE: Enable TLS for production traffic. No TLS = unencrypted traffic.

Violations:

• HTTP server without TLS counterpart - plaintext traffic
• No credentialName for HTTPS - certificate not specified
• Missing tls.mode - TLS not configured
• hosts: ["*"] - overly broad, security risk
• HTTP-only gateway for production hosts

Fix: Add HTTPS server with tls.mode: SIMPLE and credentialName: secret-name.

---

6. Application Project Configuration (MEDIUM)

RULE: Use dedicated projects for isolation. default project = no restrictions.

Violations:

• project: default - no source/destination restrictions
• No project-level RBAC configured
• sourceNamespaces unrestricted
• destinations allowing all clusters

Fix: Create dedicated AppProject with proper sourceRepos and destinations restrictions.

---

7. ApplicationSet Best Practices (MEDIUM)

RULE: Use goTemplate with error handling. Silent template failures = hidden bugs.

Violations:

• Missing goTemplate: true - using legacy template engine
• Missing goTemplateOptions: ["missingkey=error"] - silent failures
• Generator without proper configuration
• ApplicationSet without preserveResourcesOnDeletion consideration

Fix: Enable goTemplate: true with goTemplateOptions: ["missingkey=error"].

---

8. VirtualService Security (MEDIUM)

RULE: Validate gateway associations. Orphan VirtualService = unreachable services.

Violations:

• No gateways field specified - orphan VirtualService
• hosts: ["*"] - overly broad matching
• Missing destination host or port
• No route timeout configured

Fix: Associate with valid Gateway, use specific hosts like ["app.example.com"].

---

9. Deprecated Kubernetes APIs (MEDIUM)

RULE: Use stable Kubernetes APIs. Deprecated APIs = upgrade failures.

Violations:

• extensions/v1beta1 - removed in K8s 1.22
• networking.k8s.io/v1beta1 Ingress - removed in K8s 1.22
• apps/v1beta1, apps/v1beta2 - removed in K8s 1.16
• batch/v1beta1 CronJob - removed in K8s 1.25
• policy/v1beta1 PodSecurityPolicy - removed in K8s 1.25

Fix: Update to stable APIs: apps/v1, networking.k8s.io/v1, batch/v1.

---

10. Namespace Specification (LOW)

RULE: Explicitly specify namespaces. Implicit namespace = deployment confusion.

Violations:

• Missing metadata.namespace - relies on kubectl context
• Inconsistent namespace usage across related resources
• Cluster-scoped resources without proper scope handling

Fix: Add explicit namespace field to all namespaced resources.

---

11. Metadata Best Practices (LOW)

RULE: Add labels for observability and management. No labels = hard to query/manage.

Violations:

• Missing app or app.kubernetes.io/name label
• Missing component or app.kubernetes.io/component label
• No annotations for documentation
• Missing part-of for application grouping

Fix: Add standard labels: app.kubernetes.io/name, app.kubernetes.io/component, app.kubernetes.io/part-of.

---

Detection Philosophy

This skill uses VALUE-BASED detection:

• Detects issues by actual values and patterns, not by variable/field names
• Future-proof: new manifests with issues are automatically detected
• No need to update scripts when new applications are added

Target Directories

• flux/apps/ - ArgoCD Application/ApplicationSet manifests, Helm values
• raw-manifests/ - Raw K8s resources (Istio, MetalLB, Secrets, RBAC, Flux CRDs)

Parsing Strategy

• YAML files: Regex-based parsing for Go template compatibility
• Multi-document YAML: Handles --- separators
• File extensions: .yaml, .yml

Safety

• Read-only operation (except report generation)
• No ArgoCD resources modified
• No cluster changes
• No Git modifications