feat: add OCI support for Argo CD sources by robinlieb · Pull Request #4354 · zarf-dev/zarf

robinlieb · 2025-11-10T19:29:00Z

Description

This PR adds the capability to mutate OCI references in Argo CD resources and replaces the given OCI reference to the Zarf registry URL.

This change adds the possibility to use Manifest and Helm Charts in the repoURL in the Application, like explained in the OCI Docs in Argo CD with the first two examples. To archive that it also changes the patching of the URL in repository secrets to use the registry instead of the git server if oci is used.

Additionally, added the patching of the repo url for Argo CD repo-creds secret type.

Related Issue

Relates to #3046

Checklist before merging

Test, docs, adr added or updated as needed
Contributor Guide Steps followed

netlify · 2025-11-10T19:29:08Z

✅ Deploy Preview for zarf-docs canceled.

Name	Link
🔨 Latest commit	`025a6e1`
🔍 Latest deploy log	https://app.netlify.com/projects/zarf-docs/deploys/69fe2d60d1a56a00078e5030

brandtkeller

Made a first pass - spent a healthy amount of time educating myself on argo further.

Left a nit that I think we can cleanup in a few places. Separately want to consider some additional scope for this change:

E2E testing - unit tests get us some good feedback loops on the internal dependency and behaviors but this is largely an external integration. I would love to think about how we test this is operational.
Documentation - right now this can be appending to the existing tutorial. There may be more opportunity for a more granular pass at argocd orchestration docs.

Two minor requests:

Can you comment on an issue if/when you pick it up for work (or at least with the PR) - In doing so we can assign you and help prevent any colliding submissions (as well as remember to track for reviews on the project board.
Add context to the PR description. It took me a fair bit of reading to tell that the associated issue was asking for a feature around oci registries when you actually solved for oci images. The former isn't actually as valid and you solved the problem correctly here IMO - but I had to hunt down the delta and process.

Thank you for the continued support and contributions - I very much appreciate it!

brandtkeller · 2025-11-11T03:28:54Z

-	patches = append(patches, operations.ReplacePatchOperation("/data/username", base64.StdEncoding.EncodeToString([]byte(gitServer.PullUsername))))
-	patches = append(patches, operations.ReplacePatchOperation("/data/password", base64.StdEncoding.EncodeToString([]byte(gitServer.PullPassword))))
+
+	if isOCI {


Nit: for code patterns used across zarf (of those replaced thus far) we have been upgrading to use the happy path is left-aligned concept whereby - when possible we process conditions and return early and avoid else returns.

robinlieb · 2025-11-13T19:08:53Z

@brandtkeller thanks for the initial review. I added changes which addresses all of the mentioned points.
Added two applications in the Argo CD examples showcasing the the use of Helm Charts and manifests from OCI.
Added E2E test on base of this example.
Also refactored the patch logic for Argo CD resources since this contained some duplication.

For the other two points, will definitely keep that in mind for future work.

Update: For the sake of proper documentation, should I create a new issue specifying the OCI support for manifests?

al-jeyapal · 2025-11-17T06:31:41Z

The issue we might have with this is that ArgoCD will try to hit the registry over HTTPS. We were getting this in the Argo logs:

Failed to load target state:
 failed to generate manifest for source 1 of 2:
   rpc error: code = Unknown desc = failed to resolve revision "0.0.0":
     cannot get digest for revision 0.0.0:
       Head "https://zarf-docker-registry.zarf.svc.cluster.local:5000/v2/helm-charts/manifests/0.0.0":
         http: server gave HTTP response to HTTPS client

Helm allows you to use http via:

 helm pull --plain-http oci://...

However it doesn't look like Argo exposes an option for that. It exposes a --insecure-skip-server-verification but that only allows it to trust unverified certs.

We're currently trying to work around this by putting an internal caddy service to act as a HTTPS proxy in front of the zarf registry (on #4327). Still working through the details.

The easier option would be to have a HTTPS endpoint exposed on the zarf registry (just internally as a service not as an ingress/GatewayAPI route), even if it just uses a self-signed certificate. Not sure if that's a route we want to take though.

codecov · 2025-12-16T12:52:07Z

Codecov Report

❌ Patch coverage is 74.84663% with 41 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/internal/agent/hooks/argocd-application.go	63.88%	18 Missing and 8 partials ⚠️
src/internal/agent/hooks/argocd-repository.go	83.72%	5 Missing and 2 partials ⚠️
src/internal/agent/hooks/argocd-applicationset.go	85.00%	2 Missing and 1 partial ⚠️
src/internal/agent/hooks/argocd-appproject.go	80.00%	2 Missing and 1 partial ⚠️
src/internal/agent/hooks/flux-ocirepo.go	33.33%	2 Missing ⚠️

Files with missing lines	Coverage Δ
src/internal/agent/hooks/common.go	`88.46% <100.00%> (+2.74%)`	⬆️
src/internal/agent/hooks/flux-gitrepo.go	`85.71% <ø> (ø)`
src/internal/agent/hooks/flux-ocirepo.go	`80.64% <33.33%> (ø)`
src/internal/agent/hooks/argocd-applicationset.go	`77.77% <85.00%> (-0.28%)`	⬇️
src/internal/agent/hooks/argocd-appproject.go	`75.92% <80.00%> (-2.34%)`	⬇️
src/internal/agent/hooks/argocd-repository.go	`77.50% <83.72%> (-0.77%)`	⬇️
src/internal/agent/hooks/argocd-application.go	`71.21% <63.88%> (-7.67%)`	⬇️

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

robinlieb · 2025-12-16T21:59:17Z

The failed pipeline Is probably related to the version bump of Argo CD, which throws an error with the gitea.localhost setup in the test. Not sure yet what exactly changed in Argo CD but will investigate further on how to resolve that.

robinlieb · 2025-12-18T16:19:41Z

External test fails because gitea.localhost gets resolved to 127.0.0.1 when calling git / libcurl in Argo CD Repo Server. This behavior changed with Helm 7.4.0 / Argo CD v2.12.0, where Argo CD moved to ubuntu:24.04 base image, which is stricter / RFC 6761 conform in terms of localhost resolution.
Added curloptResolve option for git config in repo sever.
Alternative approach would move from gitea.localhost to e.g. gitea.local in tests, but that would require to add this entry in /etc/hosts on local machines running external tests and in pipeline.

al-jeyapal · 2025-12-18T20:01:22Z

Thanks for the work on this @robinlieb. Out of curiosity, how did you work around ArgoCD forcing Helm to use HTTPS when interacting with OCI? We had to put a HTTPS proxy in place to work around that.

robinlieb · 2026-01-15T17:58:31Z

@al-jeyapal setting insecureOCIForceHttp to true for the repository secret should make that possible. Have you tried that? Had you also the chance to build and test the branch and could provide feedback if that world work on your end?

al-jeyapal · 2026-01-15T19:47:23Z

@al-jeyapal setting insecureOCIForceHttp to true for the repository secret should make that possible. Have you tried that? Had you also the chance to build and test the branch and could provide feedback if that world work on your end?

Thanks @robinlieb I hadn't seen any references to that in the doco, but can see it in the code. Very helpful.

I'm hoping to be rotated back onto the project later this month, so will aim to give it a go when next on.

zeljkobekcic · 2026-04-29T13:00:33Z

Hey, I would really like to use this feature. Can I expect this feature to be in the next release?

brandtkeller · 2026-04-29T13:08:58Z

Hey, I would really like to use this feature. Can I expect this feature to be in the next release?

In review! Next release is tomorrow - so if not that release then the following.

@robinlieb Can you update with main before I run CI? We had some changes that will likely make them fail if I run now.

Review nearly complete.

robinlieb · 2026-04-29T13:11:47Z

Hey, I would really like to use this feature. Can I expect this feature to be in the next release?

In review! Next release is tomorrow - so if not that release then the following.

@robinlieb Can you update with main before I run CI? We had some changes that will likely make them fail if I run now.

Review nearly complete.

@brandtkeller rebased.

brandtkeller

I think there are tests implicitly passing with the argo package because we also have the git server configured (required for the package to fully deploy) and the corresponding logic can handle OCI - but when you disable the git server and remove the git-server related elements from the package it does not deploy the applications as expected.

brandtkeller · 2026-04-29T17:37:39Z

Doing some testing - Do we need to handle registry-only (OCI) for this resource?

Unified the check to conform with applications. Added tests for that.

brandtkeller · 2026-04-29T17:52:36Z

Are there OCI implications that we need to consider here as well?

Unified the check to conform with applications. Added tests for that.

brandtkeller

Some of my last comments (hopefully) - only other thing I was going to look at is where we landed for testing with the proxy init model and mTLS.

brandtkeller · 2026-04-29T21:46:03Z


+const (
+	// AgentErrTransformGitURL is thrown when the agent fails to make the git url a Zarf compatible url
+	AgentErrTransformGitURL = "unable to transform the git url"


nit: if we have these constants then they likeky qualify as good sentinel errors. I won't block on this.

brandtkeller · 2026-04-29T21:55:49Z

 	for idx, repo := range proj.Spec.SourceRepos {
-		patchedURL, err := getPatchedRepoURL(ctx, repo, s.GitServer)
+		patchedURL, err := getPatchedRepoURL(ctx, repo, registryAddress, clusterIP, s.GitServer, r)
 		// The AppProject can also include source repositories like '*' (as in the default project),


Something we should address in the near future is detecting wildcards before the patch operation. This current flow could open up quite a few avenues for unintended consequences on misconfiguration.

brandtkeller · 2026-04-29T23:48:04Z

This check is missing the asymmetry for both git server address and registry address. shouldMutateURL also performs this check in a sense. So I think we just need to resolve how and where to best perform that validation.

brandtkeller

Minor changes - please rebase with main and I'll kickoff CI and approve/advocate for second review. Appreciate the patience again.

Signed-off-by: Robin Lieb <[email protected]>

…tation Signed-off-by: Robin Lieb <[email protected]>

Signed-off-by: Robin Lieb <[email protected]>

Co-authored-by: Brandt Keller <[email protected]> Signed-off-by: Robin Lieb <[email protected]>

robinlieb · 2026-05-08T18:37:46Z

Minor changes - please rebase with main and I'll kickoff CI and approve/advocate for second review. Appreciate the patience again.

Rebased and proposed changes applied, thanks!

AustinAbro321

LGTM, nice work

robinlieb requested review from a team as code owners November 10, 2025 19:29

github-project-automation Bot added this to Zarf Nov 10, 2025

brandtkeller requested changes Nov 11, 2025

View reviewed changes

github-project-automation Bot moved this to In progress in Zarf Nov 11, 2025

robinlieb force-pushed the feat/argocd-applications-oci-source branch 2 times, most recently from ab7df2b to 9007e84 Compare November 13, 2025 19:06

robinlieb mentioned this pull request Nov 14, 2025

Using ArgoCD with values from the air-gapped gitea instance #4327

Closed

brandtkeller added this to the v0.67.1 Release milestone Dec 4, 2025

robinlieb force-pushed the feat/argocd-applications-oci-source branch 2 times, most recently from 1128adc to a5388db Compare December 12, 2025 20:24

robinlieb force-pushed the feat/argocd-applications-oci-source branch from a5388db to d159081 Compare December 16, 2025 16:50

robinlieb force-pushed the feat/argocd-applications-oci-source branch from 34ce98d to c9b5774 Compare December 18, 2025 16:13

robinlieb force-pushed the feat/argocd-applications-oci-source branch from d993eff to d707be0 Compare January 28, 2026 16:11

robinlieb requested a review from brandtkeller January 28, 2026 16:13

robinlieb force-pushed the feat/argocd-applications-oci-source branch 2 times, most recently from c462f45 to e933a52 Compare February 4, 2026 20:13

robinlieb force-pushed the feat/argocd-applications-oci-source branch 3 times, most recently from c420e22 to 3790883 Compare February 17, 2026 17:02

robinlieb force-pushed the feat/argocd-applications-oci-source branch from 9f2f551 to 89261bc Compare February 17, 2026 18:45

brandtkeller removed this from the v0.67.1 Release milestone Apr 29, 2026

robinlieb force-pushed the feat/argocd-applications-oci-source branch from 031366c to 4ab4033 Compare April 29, 2026 13:11

brandtkeller requested changes Apr 29, 2026

View reviewed changes

robinlieb force-pushed the feat/argocd-applications-oci-source branch from 8292b94 to 16cf0f1 Compare April 29, 2026 18:53

robinlieb requested a review from brandtkeller April 29, 2026 18:53

brandtkeller requested changes Apr 29, 2026

View reviewed changes

brandtkeller requested changes May 8, 2026

View reviewed changes

Comment thread src/test/e2e/22_git_and_gitops_test.go Outdated

Comment thread src/test/e2e/22_git_and_gitops_test.go Outdated

Comment thread src/test/external/ext_in_cluster_test.go Outdated

Comment thread src/test/external/ext_out_cluster_test.go Outdated

robinlieb added 7 commits May 8, 2026 20:35

feat: add OCI support for Argo CD sources

bd32203

Signed-off-by: Robin Lieb <[email protected]>

test: add unit tests for shouldMutateURL function and improve documen…

69744a5

…tation Signed-off-by: Robin Lieb <[email protected]>

feat: add extraObjects and repoServer to values

3db8752

Signed-off-by: Robin Lieb <[email protected]>

build: enable values feature for argocd example

ce2f033

Signed-off-by: Robin Lieb <[email protected]>

feat: update to new state handling

b8f6846

Signed-off-by: Robin Lieb <[email protected]>

feat: add available service check for project and repo

85cf515

Signed-off-by: Robin Lieb <[email protected]>

feat: remove checks for operations

64867ba

Signed-off-by: Robin Lieb <[email protected]>

robinlieb force-pushed the feat/argocd-applications-oci-source branch from a026906 to 64867ba Compare May 8, 2026 18:36

robinlieb and others added 4 commits May 8, 2026 20:36

Update src/test/external/ext_out_cluster_test.go

3923db0

Co-authored-by: Brandt Keller <[email protected]> Signed-off-by: Robin Lieb <[email protected]>

Update src/test/external/ext_in_cluster_test.go

a86ad7e

Co-authored-by: Brandt Keller <[email protected]> Signed-off-by: Robin Lieb <[email protected]>

Update src/test/e2e/22_git_and_gitops_test.go

8bda2ca

Co-authored-by: Brandt Keller <[email protected]> Signed-off-by: Robin Lieb <[email protected]>

Update src/test/e2e/22_git_and_gitops_test.go

025a6e1

Co-authored-by: Brandt Keller <[email protected]> Signed-off-by: Robin Lieb <[email protected]>

brandtkeller approved these changes May 11, 2026

View reviewed changes

AustinAbro321 approved these changes May 11, 2026

View reviewed changes

AustinAbro321 added this pull request to the merge queue May 11, 2026

Merged via the queue into zarf-dev:main with commit 6b54e0a May 11, 2026
32 checks passed

github-project-automation Bot moved this from In progress to Done in Zarf May 11, 2026

zarf-release-please Bot mentioned this pull request May 11, 2026

chore(main): release 0.76.0 #4868

Merged

Conversation

robinlieb commented Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issue

Checklist before merging

Uh oh!

netlify Bot commented Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for zarf-docs canceled.

Uh oh!

brandtkeller left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

robinlieb commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

al-jeyapal commented Nov 17, 2025

Uh oh!

codecov Bot commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

robinlieb commented Dec 16, 2025

Uh oh!

robinlieb commented Dec 18, 2025

Uh oh!

al-jeyapal commented Dec 18, 2025

Uh oh!

robinlieb commented Jan 15, 2026

Uh oh!

al-jeyapal commented Jan 15, 2026

Uh oh!

zeljkobekcic commented Apr 29, 2026

Uh oh!

brandtkeller commented Apr 29, 2026

Uh oh!

robinlieb commented Apr 29, 2026

Uh oh!

brandtkeller left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

brandtkeller left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

brandtkeller left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

robinlieb commented May 8, 2026

Uh oh!

AustinAbro321 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

robinlieb commented Nov 10, 2025 •

edited

Loading

netlify Bot commented Nov 10, 2025 •

edited

Loading

robinlieb commented Nov 13, 2025 •

edited

Loading

codecov Bot commented Dec 16, 2025 •

edited

Loading