argocd

Renders Argo CD Applications, ApplicationSets and AppProjects from inventory parameters, including one Application per target that publishes a Kapitan topic.

kubernetes operators ci

Latest: 1.0.3 · 2026-10-16
License: Apache-2.0
Owners: Moep90
Source: github.com/kadet-hub/generators · 0 repo stars, shared by 35 generators
Thumbs up: 👍 0 on GitHub Discussions
Popularity: 18 · 552 pulls

Request a feature Report a problem

Badge

Show the latest listed version in your README. shields.io draws the badge from this page's badge.json, which every catalog build updates; once no version is listed, it reads "not listed".

[![kadet-hub](https://img.shields.io/endpoint?url=https://kadet-hub.org/generators/argocd/badge.json)](https://kadet-hub.org/generators/argocd/)

Argo CD Generator

Published on kadet-hub: pin a released version by digest from its catalog page.

Kapitan kadet generator for Argo CD resources (argoproj.io/v1alpha1). Built for Argo CD 3.5.5.

Application: one source or several, synced to a destination cluster and namespace
ApplicationSet: Applications templated from generators (clusters, git, list, matrix, …)
AppProject: allowed source repositories, destinations and resource kinds for a group of Applications
Applications from Kapitan topics: one Application per target that publishes the argocd topic

Cluster and repository credentials are Secrets with the argocd.argoproj.io/secret-type label; render them with the kubernetes generator. The Argo CD installation itself belongs in the helm input.

Usage

Kapitan Configuration

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/argocd@sha256:<digest>
        output_path: lib/argocd
    compile:
      - output_path: manifests/
        input_type: kadet
        output_type: yml
        input_paths:
          - lib/argocd

Inventory Contract

All keys live under parameters.generators.argocd.

Key	Kind	Output key
`namespace`		Default namespace of all resources, `argocd` if unset.
`applications.<name>`	Application	`<namespace>/<name>-application`
`topics.<topic>`	Application per publishing target	`<namespace>/<target>-application`
`application_sets.<name>`	ApplicationSet	`<namespace>/<name>-appset`
`projects.<name>`	AppProject	`<namespace>/<name>-appproject`

Every entry accepts name (default: the entry key), namespace, labels, annotations and a spec dict that passes through to the resource spec. Precedence is generator defaults < spec < flat keys: a flat key wins over the same field in spec and logs Flat key '<key>' overrides spec passthrough '<field>' for resource '<name>'.

parameters.namespace is not read: Argo CD reconciles these resources only in its control-plane namespace unless apps in any namespace is enabled.

Flat keys map to the camelCase CRD field of the same name; values pass through unchanged.

Kind	Flat keys
Application	`project`, `destination`, `source`, `sources`, `sync_policy`, `ignore_differences`, `revision_history_limit`, `cascade_delete`
ApplicationSet	`generators`, `template`, `template_patch`, `sync_policy`, `go_template`, `go_template_options`, `ignore_application_differences`
AppProject	`source_repos`, `destinations`, `cluster_resource_whitelist`, `namespace_resource_blacklist`, `namespace_resource_whitelist`, `orphaned_resources`, `roles`, `finalizers`

cascade_delete: true adds the resources-finalizer.argocd.argoproj.io finalizer to an Application, so deleting it also deletes the resources it deployed (app deletion). AppProjects get a finalizer only through finalizers.

Defaults and shorthands

Input	Result	Reason
`destination: <namespace>`	`destination: {namespace: <namespace>, server: https://kubernetes.default.svc}`	The common case, an Application in the cluster Argo CD runs in.
a `destination` (flat or in `spec`) without `server` and `name`	`server: https://kubernetes.default.svc`	Argo CD rejects a destination without either (`GetDestinationServer`). The address is Argo CD’s in-cluster server.

A destination with name keeps it and gets no server. The in-cluster address only works while cluster.inClusterEnabled in argocd-cm is on, which is the default.

Deliberately not defaulted:

project has no default and the compile fails QA-7 without it. The default AppProject that ships with Argo CD permits every repository, cluster and resource kind (projects); write project: default to use it.
sync_policy is not set, so Applications sync manually. Automated sync with prune or selfHeal lets the Git repository delete and overwrite cluster resources; set it per Application.
AppProjects get no source_repos or destinations, which denies everything until the inventory lists them.
ApplicationSets keep Argo CD’s template engine unless go_template is set; switching changes the placeholder syntax from {{name}} to {{.name}}.

Applications from Kapitan topics

A workload target publishes its Application parameters to a topic, and the Argo CD target turns every publisher into one Application. Topic parameters use the keys of an applications entry and are deep-merged over generators.argocd.topics.<topic>; a string destination replaces the default destination as a whole. The Application is named after the publishing target unless the parameters set name. Kapitan fails the compile if the Argo CD target does not declare consume: true, and the generator fails it if an applications entry has the same name and namespace.

Workload target web:

parameters:
  kapitan:
    topics:
      argocd:
        parameters:
          source:
            path: compiled/web/manifests
          destination: web

Example

The Argo CD target, consuming the topic above:

parameters:
  kapitan:
    topics:
      argocd:
        consume: true
  generators:
    argocd:
      topics:
        argocd:
          project: platform
          source:
            repoURL: https://git.example.com/platform/deploy.git
            targetRevision: main
      projects:
        platform:
          source_repos:
            - https://git.example.com/platform/deploy.git
            - https://charts.example.com
          destinations:
            - namespace: web
              server: https://kubernetes.default.svc
            - namespace: shop
              server: https://kubernetes.default.svc
          cluster_resource_whitelist:
            - group: ''
              kind: Namespace
          roles:
            - name: developer
              policies:
                - p, proj:platform:developer, applications, sync, platform/*, allow
              groups:
                - platform-developers
        addons:
          source_repos:
            - https://git.example.com/platform/cluster-addons.git
          destinations:
            - namespace: kube-system
              server: '*'
      applications:
        shop:
          project: platform
          destination: shop
          sources:
            - repoURL: https://charts.example.com
              chart: shop
              targetRevision: 2.4.1
              helm:
                valueFiles:
                  - $values/values/shop/production.yaml
            - repoURL: https://git.example.com/platform/deploy.git
              targetRevision: main
              ref: values
          sync_policy:
            automated:
              prune: true
              selfHeal: true
            syncOptions:
              - CreateNamespace=true
      application_sets:
        cluster-addons:
          generators:
            - clusters: {}
          go_template: true
          go_template_options:
            - missingkey=error
          template:
            metadata:
              name: '{{.name}}-addons'
            spec:
              project: addons
              source:
                repoURL: https://git.example.com/platform/cluster-addons.git
                targetRevision: main
                path: 'clusters/{{.name}}'
              destination:
                server: '{{.server}}'
                namespace: kube-system

This renders argocd/platform-appproject, argocd/addons-appproject, argocd/web-application (from the topic, in-cluster, namespace web), argocd/shop-application and argocd/cluster-addons-appset.

Versions

Add a version's inventory entry, then compile with the consumer workflow, which verifies the artifact and runs Kapitan in the sandbox.

Free of charge, as is and on a best-effort basis: use at your own risk, and review the compiled output before you apply it. Terms

This catalog was built from index serial 47. Set index_serial: 47 in .kapitan-sandbox.yaml and the consumer workflow refuses any older index, so a rolled-back index cannot bring back a yanked version.

Checks find known patterns; they do not prove a generator safe. What a listing covers

Version	Built for (schema-checked)
1.0.3	Argo CD 3.5.5
1.0.2	Argo CD 3.5.4
1.0.1	Argo CD 3.5.4
1.0.0	Argo CD 3.5.4

1.0.3# 2026-10-16

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/argocd:1.0.3@sha256:49804acaf225b3337a63ec95ae3ba001a98c53e342791e1c2b1b6ed3089638d4
        output_path: lib/argocd

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/argocd@sha256:49804acaf225b3337a63ec95ae3ba001a98c53e342791e1c2b1b6ed3089638d4 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3274778548, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: reclass-rs, omegaconf
With --cache: passed
krab: compatible
Built for (schema-checked): Argo CD 3.5.5
Source: argocd-v1.0.3 · fac0fbb289db0a5933ff22f3601931d4e2f10434 · argocd
Binaries: none
Output capabilities: none
Digest: sha256:49804acaf225b3337a63ec95ae3ba001a98c53e342791e1c2b1b6ed3089638d4

Checks

Checked by the release run on 2026-10-16, gate at 44c10edf85ef.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

Fixture output against 1.0.2: 0 files, 0 hunks.

Output diff

1.0.2# 2026-10-14

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/argocd:1.0.2@sha256:50a9bd32918970c5ee8d87be3f42129400f4225269f5b8680d3975ab5d3fedc5
        output_path: lib/argocd

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/argocd@sha256:50a9bd32918970c5ee8d87be3f42129400f4225269f5b8680d3975ab5d3fedc5 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3249931969, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): Argo CD 3.5.4
Source: argocd-v1.0.2 · e4891e8fd85ca0a19ebf361e8b54fd6473fd8a2f · argocd
Binaries: none
Output capabilities: none
Digest: sha256:50a9bd32918970c5ee8d87be3f42129400f4225269f5b8680d3975ab5d3fedc5

Checks

Checked by the release run on 2026-10-14, gate at adb2714229cb.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.1# 2026-10-13

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/argocd:1.0.1@sha256:1715416f81cf6e3e8a5c02cc1e243df8a5048e8dc4f5850bb4f9b4d964c7a361
        output_path: lib/argocd

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/argocd@sha256:1715416f81cf6e3e8a5c02cc1e243df8a5048e8dc4f5850bb4f9b4d964c7a361 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3243978107, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): Argo CD 3.5.4
Source: argocd-v1.0.1 · 9166cb30e0ae4874bc8f229c6a6823eff7451d04 · argocd
Binaries: none
Output capabilities: none
Digest: sha256:1715416f81cf6e3e8a5c02cc1e243df8a5048e8dc4f5850bb4f9b4d964c7a361

Checks

Checked by the release run on 2026-10-13, gate at bb2c29b3629b.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.0# 2026-10-11

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/argocd:1.0.0@sha256:e027e7cc3b5aef5399cb0c955955ea745b8cef207227337ebcf7d58c7fd4b41c
        output_path: lib/argocd

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/argocd@sha256:e027e7cc3b5aef5399cb0c955955ea745b8cef207227337ebcf7d58c7fd4b41c \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3212107647, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): Argo CD 3.5.4
Source: argocd-v1.0.0 · c3fd859273b2e76315c54f56052dc743669ac318 · argocd
Binaries: none
Output capabilities: none
Digest: sha256:e027e7cc3b5aef5399cb0c955955ea745b8cef207227337ebcf7d58c7fd4b41c

Checks

Checked by the release run on 2026-10-11, gate at 4f27fde613c7.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.