Handling KSOPS (kustomize-sops) with a stub plugin

[mpeterson]

I use KSOPS as a kustomize exec plugin to generate Secrets from SOPS-encrypted files. In CI, the SOPS decryption key isn't available, so all kustomize apps with KSOPS generators fail with:

external plugins disabled; unable to load external plugin 'ksops'

Even after enabling alpha plugins via values.yaml, they fail with SOPS decryption errors — which causes the entire run to fail.

Solution: Install a fake ksops stub that returns an empty ResourceList. Kustomize is happy (the generator "runs" successfully), and all other resources (Deployments, Services, ConfigMaps, etc.) render correctly. Since both branches get the same stub, secrets are consistently absent from the diff — only non-secret changes show up.

The values.yaml mounted at --argocd-config-dir:

configs:
  cm:
    kustomize.buildOptions: "--enable-alpha-plugins --enable-exec"

repoServer:
  volumes:
    - name: custom-tools
      emptyDir: {}
  volumeMounts:
    - mountPath: /usr/local/bin/ksops
      name: custom-tools
      subPath: ksops
  initContainers:
    - name: install-fake-ksops
      image: alpine:3.23
      command: ["/bin/sh", "-c"]
      args:
        - |
          cat > /custom-tools/ksops << 'SCRIPT'
          #!/bin/sh
          # Stub KSOPS: returns an empty resource list so kustomize builds
          # succeed without real SOPS decryption keys.
          echo '{"apiVersion":"config.kubernetes.io/v1","kind":"ResourceList","items":[]}'
          SCRIPT
          chmod +x /custom-tools/ksops
      volumeMounts:
        - mountPath: /custom-tools
          name: custom-tools
  env:
    - name: XDG_CONFIG_HOME
      value: /.config

This could also be adapted for other kustomize exec plugins that depend on external secrets or credentials not available in CI.

[dag-andersen]

@mpeterson Thanks for sharing this 🚀

Would you be interested in adding this as a documentation example for others to reuse?

If yes, we suggest adding it to:

• docs/getting-started/custom-argo-cd-installation.md
  under the CMP section, as a subsection like: CI fallback for KSOPS (stub plugin)
  That seems like the most natural place since the solution is based on Argo CD values.yaml customization and plugin behavior.

[mpeterson]

I opened a PR to add this to the docs: #395

It covers the stub plugin approach from this discussion, plus a complementary workaround for stripping .sops metadata from encrypted Application manifests (which breaks CRD schema validation).

[dag-andersen]

Thank you so much! Good work :)