rules-argocd

RISK: enabling both automated.prune: true and automated.selfHeal: true means Argo CD will automatically delete live resources that are absent from the git manifest AND continuously revert any manual change. A mistaken manifest commit that removes a resource (e.g., a ConfigMap or PVC) will be immediately pruned from the cluster with no manual intervention required. FIX: enable these flags deliberately and only after verifying your RBAC AppProject destinationNamespaces are tightly scoped. Consider setting selfHeal: true alone without prune for safer auto-recovery.

Usage of the 'default' Argo CD project detected. The 'default' project often has broader permissions and is not recommended for production workloads. Create and use dedicated Argo CD projects with fine-grained RBAC for better security and isolation. Example fix: Change 'project: default' to 'project: my-secure-project'.

Deprecated Kubernetes API version detected. Using 'extensions/v1beta1' or 'apps/v1beta1' for Deployments, DaemonSets, or ReplicaSets is deprecated and may lead to instability or breakage in future Kubernetes versions. Update to 'apiVersion: apps/v1'. This aligns with Google's general Kubernetes best practices for API versioning. Example fix: Change 'apiVersion: extensions/v1beta1' to 'apiVersion: apps/v1'.

RISK: image tag ':latest' is mutable — a new push to the registry will change what Argo CD deploys on the next sync without any manifest change, making rollbacks impossible and supply-chain substitution trivial. FIX: pin images to an immutable digest (image: myrepo/app@sha256:<digest>) or a specific semver tag. Use an image-update automation tool (e.g., Argo CD Image Updater) to manage upgrades through git PRs.

Insecure Git repository URL detected. Using 'http://' for 'repoURL' is vulnerable to Man-in-the-Middle attacks and credential exposure. Always use 'https://' or 'ssh://' for secure communication. Example fix: Change 'repoURL: http://git.example.com/repo.git' to 'repoURL: https://git.example.com/repo.git'.

Insecure Argo CD sync option detected. 'AllowEmpty=true' can lead to accidental deletion of all resources if the manifest becomes empty. 'Replace=true' can bypass immutable fields and security controls. Avoid these options unless absolutely necessary and with extreme caution. Example fix: Remove 'AllowEmpty=true' or 'Replace=true' from syncOptions.

Potential path traversal detected in application source path or Helm value files. Using '..' can lead to unauthorized file access outside the intended repository directory. Ensure all paths are relative to the application's root and do not escape it. Example fix: Use 'path: my-app' instead of 'path: ../my-app'.

Unpinned Git target revision detected. Using 'HEAD' for 'targetRevision' can lead to non-reproducible deployments and unexpected changes, potentially deploying unreviewed code. Pin to a specific commit SHA or a stable tag for security and reproducibility. Example fix: Change 'targetRevision: HEAD' to 'targetRevision: v1.2.3' or 'targetRevision: <commit-sha>'.