{"id":13769020,"url":"https://github.com/argoproj-labs/argocd-interlace","last_synced_at":"2025-08-11T13:09:49.143Z","repository":{"id":37833945,"uuid":"392515009","full_name":"argoproj-labs/argocd-interlace","owner":"argoproj-labs","description":"Enabling Software Supply Chain Security Capabilities in ArgoCD","archived":false,"fork":false,"pushed_at":"2022-11-04T07:55:32.000Z","size":10736,"stargazers_count":87,"open_issues_count":2,"forks_count":10,"subscribers_count":7,"default_branch":"main","last_synced_at":"2025-06-20T15:44:27.054Z","etag":null,"topics":["argocd","in-toto","sigstore","software-supply-chain-security"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/argoproj-labs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null}},"created_at":"2021-08-04T02:01:30.000Z","updated_at":"2025-06-07T14:29:51.000Z","dependencies_parsed_at":"2022-06-23T02:25:44.623Z","dependency_job_id":null,"html_url":"https://github.com/argoproj-labs/argocd-interlace","commit_stats":null,"previous_names":["ibm/argocd-interlace"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/argoproj-labs/argocd-interlace","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/argoproj-labs%2Fargocd-interlace","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/argoproj-labs%2Fargocd-interlace/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/argoproj-labs%2Fargocd-interlace/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/argoproj-labs%2Fargocd-interlace/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/argoproj-labs","download_url":"https://codeload.github.com/argoproj-labs/argocd-interlace/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/argoproj-labs%2Fargocd-interlace/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":269892950,"owners_count":24492014,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-11T02:00:10.019Z","response_time":75,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["argocd","in-toto","sigstore","software-supply-chain-security"],"created_at":"2024-08-03T17:00:15.467Z","updated_at":"2025-08-11T13:09:49.110Z","avatar_url":"https://github.com/argoproj-labs.png","language":"Go","funding_links":[],"categories":["Ecosystem Projects","Go"],"sub_categories":[],"readme":"# ArgoCD Interlace\n\nArgoCD is widely used for enabling CD GitOps. ArgoCD internally builds manifest from source data in Git repository, and auto-sync it with target clusters. \n\nArgoCD Interlace enhances ArgoCD capability from end-to-end software supply chain security viewpoint. Interlace adds authenticity of the manifest and the traceability to the source to ArgoCD.\n\nArgoCD Interlace works as a Kubernetes Custom Resource Definition (CRD) controller. Interlace monitors the trigger from state changes of Application resources on the ArgoCD cluster. When detecting new manifest build, Interlace sign the manifest, record the detail of manifest build such as the source files for the build, the command to produce the manifest for reproducibility. Interlace stores those details as provenance records in [in-toto](https://in-toto.io) format and upload it to [Sigstore](https://sigstore.dev/) log for verification.\n\n![ArgoCD-Interlace-Arch](./images/argocd-interlace-arch.png)\n\n\nThe features are \n- Pluggable to ArgoCD\n- Verify signature of source materials used for generating manifest\n- Capture manifest and provenance from application.status automatically\n- Sign manifest\n- Record provenance in in-toto format\n\n## Getting Started\n### Installation\nPrerequisite: Install [ArgoCD](https://argo-cd.readthedocs.io/en/stable/getting_started/) on your Kubernetes cluster before you install ArgoCD Interlace.\n\n\nTo install ArgoCD Interlace, run:\n```\n$ kubectl apply -f https://raw.githubusercontent.com/argoproj-labs/argocd-interlace/main/releases/release.yaml\n```\n\nOn OpenShift, use this instead of the above.\n\n```\n$ kubectl apply -f https://raw.githubusercontent.com/argoproj-labs/argocd-interlace/main/releases/release_openshift.yaml\n```\n\nThen you can check whether ArgoCD Interlace is running just by looking at the pod status.\n\n```\n$ kubectl get pod -n argocd-interlace\nNAME                                           READY   STATUS    RESTARTS   AGE\nargocd-interlace-controller-5b6cd5f896-vwtrj   1/1     Running   0          2m\n```\n\n### Quick Start\nBy default, ArgoCD Interlace stores the generated provenance record in a custom resource `ApplicationProvenance` in `argocd-interlace` namespace.\n\nWhen ArgoCD syncs any Applications, ArgoCD Interlace creates the ApplicationProvenance and you can see the provenance data as below.\n\n```\n$ kubectl get appprov -n argocd-interlace\nNAME         AGE\nsample-app   3m40s\n\n\n$ kubectl get appprov -n argocd-interlace sample-app -o json\n{\n    \"apiVersion\": \"interlace.argocd.dev/v1beta1\",\n    \"kind\": \"ApplicationProvenance\",\n    \"metadata\": {\n        \"creationTimestamp\": \"2022-06-15T00:33:07Z\",\n        \"generation\": 1,\n        \"name\": \"sample-app\",\n        \"namespace\": \"argocd-interlace\",\n        \"resourceVersion\": \"1553595\",\n        \"uid\": \"bc081b63-0595-4917-9a0e-2869a7dd1eeb\"\n    },\n    \"spec\": {\n        \"application\": {\n            \"name\": \"sample-app\",\n            \"namespace\": \"argocd\"\n        }\n    },\n    \"status\": {\n        \"lastUpdated\": \"2022-06-15T07:04:05Z\",\n        \"results\": [\n            {\n                \"manifest\": \"ICBh  ...  ODAK\",      // base64 encoded resource manifest\n                \"provenance\": \"eyJf  ...  fQ==\",    // base64 encoded provenance data\n                \"sourceVerified\": false,            // whether source material was verified or not\n                \"time\": \"2022-06-15T07:04:05Z\"      // timestamp of the update\n            }\n        ]\n    }\n}\n```\n\nIn the `spec` field, you can find which `Application` was the target of this provenance data.\n\nIn the `status` field, you can find the generated manifest for the `Application` sync and the provenance data generated by ArgoCD Interlace. (These two values are encoded in base64.)\n\nFor more details about the provenance data, you can refer this [doc](docs/provenance.md)\n\n### Additional Features\n\nArgoCD Interlace supports **3 other features** other than provenance recording.\n\n**1. Verify source material contents before generating provenance**\n\nBefore ArgoCD Interlace generates provenance data, it can verify the source metrial contents.\nFor that, you can sign the source meterials (Git Repo / Helm) beforehand (see the [doc](docs/signing_source_material.md)).\nThis allows you to confirm that the source contents of the synced application is valid by verifying the signature.\n\nYou can enable this feature by configuring the secret `source-material-verify-key` in argocd-interlace namespace.\nYou can do it by the following command. `\u003cPATH/TO/PUBLIC_KEY\u003e` should be the actual filepath (refer [this](docs/key_setup.md) about key setup).\n\n```\n$ KEY_PATH=\u003cPATH/TO/PUBLIC_KEY\u003e kubectl patch secret source-material-verify-key -n argocd-interlace -p=\"{\\\"data\\\":{\\\"public_key_pem\\\":\\\"\"(cat $KEY_PATH | base64)\"\\\"}}\"\n```\n\n*Note that it takes about a minute that the key in the running pod is updated after this command.*\n\nWith this feature, `sourceVerified` field in the ApplicationProvenance status will be `true` if the verification successfully finishes.\n\n**2. Sign the generated provenance data**\n\nBy default, ArgoCD Interlace just generates a provenance data and the data is not authorized.\nYou can enable signing feature for the generated provenance data so that the provenance data can be verified when it is used somewhere other than ArgoCD / ArgoCD Interlace.\n\nBy configuring the secret `interlace-signing-key` in argocd-interlace namespace, you can enable this.\nYou can do it by the following command. `\u003cPATH/TO/PRIVATE_KEY\u003e` should be the actual filepath (refer [this](docs/key_setup.md) about key setup).\n\n```\n$ KEY_PATH=\u003cPATH/TO/PRIVATE_KEY\u003e kubectl patch secret interlace-signing-key -n argocd-interlace -p=\"{\\\"data\\\":{\\\"private_key_pem\\\":\\\"\"(cat $KEY_PATH | base64)\"\\\"}}\"\n```\n\n*Note that it takes about a minute that the key in the running pod is updated after this command.*\n\nWith this feature, `signature` field is added to the status in ApplciationProvenance and it contains the generated signature.\n\n**3. Sign the manifest generated by ArgoCD**\n\nAdditionally, you can enable signing feature for the YAML manifest geneated by ArgoCD.\nFor this, ArgoCD Interlace leverages the manifest signing feature provided by sigstore community ([k8s-manifest-sigstore](https://github.com/sigstore/k8s-manifest-sigstore)).\n\nTo enable this, you can add a ConfigMap resource with a label `signatureResource: true` to your source material repository.\nWhen this ConfigMap is found in the synced resources, ArgoCD Interlace signs the YAML manifest and the signature will be stored in the ConfigMap on the cluster.\nThis feature requires the 2 secrets configured by the above steps.\n\n## Example Scenario\nTo see ArgoCD Interlace in action, check the [example scenario](docs/example_scenario.md).\n\n### Demo\n![intro](images/intro.gif?)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fargoproj-labs%2Fargocd-interlace","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fargoproj-labs%2Fargocd-interlace","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fargoproj-labs%2Fargocd-interlace/lists"}