argocd-fips

Argo CD is a declarative continuous deployment tool for Kubernetes.

Download this Image

The image is available on cgr.dev:

docker pull cgr.dev/chainguard/argocd-fips:latest

Usage

There are two recommended methods for installing Argo CD: using helm and raw manifests. Chainguard's Argo CD Image is designed to be a drop-in replacement for either method.

To use this Image, replace the appropriate image: value with the Chainguard Argo CD Image. The following is an example how such a value might appear within a Helm chart:

global:
  image:
    repository: cgr.dev/chainguard/argocd-fips

Based on these values, you would install Argo CD using the following helm commands. First, add the Argo Helm repository:

helm repo add argo https://argoproj.github.io/argo-helm

Then you can install Argo CD:

helm install argocd argo/argo-cd \
	--namespace argocd \
	--create-namespace \
	--set global.image.repository="cgr.dev/chainguard/argocd-fips" \
	--set global.image.tag="latest" \
	--set repoServer.image.repository="cgr.dev/chainguard/argocd-repo-server-fips" \
	--set repoServer.image.tag="latest"

Note that this example uses multiple container images, namely argocd-fips and argocd-repo-server-fips. Refer to the following components section for more information.

NOTE: Setting the tag to latest is not recommended, and only shown for illustrative purposes.

Optionally, you can use other Chainguard Images to replace Argo CD dependencies:

redis:
  image:
    repository: cgr.dev/chainguard/redis-fips
    tag: latest

dex:
  image:
    repository: cgr.dev/chainguard/dex-fips
    tag: latest

Argo CD Components

Argo CD is comprised of multiple components that all share the same container image.

Keeping in line with the philosophy of minimal dependencies in Chainguard Images, we chose to split this up to keep the number of packages in each respective component to a minimum. This means the overall number of images increases, but the size and complexity of each image is reduced down to the minimum needed to function.

Argo CD Repo Server, GPG and FIPS

Argo CD Repo Server has ability to use GnuPG signature verification, see upstream documentation. Chainguard does not currently have FIPS CVMP certification for gpg. The cgr.dev/chainguard/argocd-repo-server-fips image has environment variable ARGOCD_GPG_ENABLED=false set, which should also be used for FIPS deployments.