Note for self: Snyk scan from ArgoCD

 Demo

https://github.com/papicella/springbootemployee-api/tree/master/argocd

Demo Job on K8s to perform Snyk IaC Scan

  
apiVersion: batch/v1
kind: Job
metadata:
  name: snyk-iac-scan
  annotations:
    argocd.argoproj.io/hook: PreSync
spec:
  ttlSecondsAfterFinished: 600
  template:
    spec:
      containers:
        - name: snyk-cli
          image: snyk/snyk-cli:npm
          command: ["/bin/sh","-c"]
          args:
            - git clone https://github.com/papicella/springbootemployee-api.git;
              snyk auth $SNYK_TOKEN;
              snyk iac test springbootemployee-api/argocd/employee-K8s.yaml || true;
          env:
            - name: SNYK_TOKEN
              valueFrom:
                secretKeyRef:
                  name: snyk-token
                  key: token
      restartPolicy: Never
  backoffLimit: 0