Explore GitOps enforcer plugin

[WitoDelnat]

The goal is to identify kubernetes resources which are not managed by GitOps.

Usage

# monokle.validation.yaml
plugins:
  gitops-enforcer: true
rules:
  gitops-enforcer/argo-cd: "err"
  gitops-enforcer/flux: false

Afterwards:

kubectl get all | monokle validate -

Implementation details

• It would rely on labels being present but also exclude the necessary resources.
• What makes this plugin unique is that it should only run post-deployment. We can rely on something like metadata.uid to know that it runs in a cluster (better options are likely possible).

Remarks

Usage is not so nice to need a file to enable a plugin that runs on a cluster from anywhere.

• https://github.com/kubeshop/monokle-core/issues/116

Dependencies

• https://github.com/kubeshop/monokle-core/issues/103

[olensmar]

inspired by https://github.com/raffis/gitops-zombies