In the ever-evolving landscape of supply chain security, the Argo CD project's v3.5 release candidate stands out as a significant milestone. This update tackles critical gaps in internal security and operational visibility, particularly for large-scale deployments. One of the key enhancements is the introduction of mutual TLS (mTLS) enforcement for internal components, a move that was long overdue. Previously, communication between the repo-server and other Argo CD elements lacked encryption, leaving internal traffic vulnerable. With mTLS, each connecting component now requires a client certificate, adding an essential layer of protection. This not only safeguards internal communications but also ensures that teams can maintain their usual security standards at the ingress layer.
What makes this particularly fascinating is the innovative approach taken by the Argo CD team. For environments without custom certificates, the repo-server generates self-signed certificates in memory. This not only addresses the security gap but also avoids potential issues related to filesystem reliance. It's a clever solution that demonstrates the team's deep understanding of the challenges faced by large-scale deployments.
Another critical aspect addressed in this release is supply chain security. Argo CD now includes Git commit signature verification, ensuring that operators can verify the integrity of Git sources before syncing. This feature, accessible through the Application spec or the CLI, empowers teams to prevent the silent deployment of unsigned or tampered manifests. It's a crucial step towards mitigating supply chain attacks, which have become increasingly sophisticated and prevalent.
The v3.5 release also graduates two significant features from alpha to beta: impersonation and Source Hydrator. Impersonation allows Argo CD to take on a specific user identity for server-side tasks, a feature that's especially important for audit trails in multi-tenant clusters. Source Hydrator, on the other hand, separates dry manifests from their hydrated output, enabling multi-repository GitOps patterns. This feature allows teams to set different repository URLs for source templates and rendered manifests, providing greater flexibility and control over access.
From my perspective, the most intriguing aspect of this release is the ApplicationSet UI. Developed by engineers from Intuit, Red Hat, GoTo, and Octopus Deploy, this UI includes list, filter, and detail views, as well as a Preview Apps tab. This feature not only enhances the user experience but also provides a critical preview capability, allowing operators to see the applications an ApplicationSet template will create before deployment. It's a game-changer for teams managing GitOps by namespace, as it reduces the risk of unexpected deployments and provides a more controlled environment.
In comparing Argo CD's v3.5 features with its competitors, it's evident that each tool's architecture plays a significant role in its capabilities. Flux, for instance, avoids the internal mTLS issue by design, using Kubernetes API objects for communication instead of direct gRPC. This design choice eliminates the need for internal mTLS, but it also means that Flux lacks a visual preview capability like Argo CD's ApplicationSet Preview. Rancher Fleet, on the other hand, uses a websocket-based agent system, which also eliminates the need for internal mTLS. However, Fleet lacks a built-in Source Integrity mechanism, requiring teams to rely on Git provider policies or admission webhooks.
Jenkins X, which uses Tekton to enforce supply chain controls, provides a different approach. While it includes Tekton Chains and GPG-signed releases, it lacks a first-party dashboard and a preview capability similar to ApplicationSet. Multi-cluster promotion in Jenkins X occurs through pull request-based environment flows, a different approach compared to Argo CD's template generation.
In conclusion, the Argo CD v3.5 release candidate is a significant step forward in supply chain security and operational visibility. The introduction of internal mTLS, Git commit signature verification, and the ApplicationSet UI, along with the graduation of impersonation and Source Hydrator to beta, demonstrate the project's commitment to addressing critical gaps. As we continue to navigate the complex landscape of supply chain security, tools like Argo CD play a crucial role in mitigating risks and ensuring the integrity of our digital ecosystems.
