drydock

drydock

Inspect your Argo CD fleet without getting wet

drydock is a fast, single static Go binary and embeddable Go module for runtime-offline Argo CD desired-state analysis. It discovers, renders, tests, diffs, and diagnoses GitOps Applications with native Go renderers, no Argo CD server, no Kubernetes credentials, and no default shellouts.

Get Started | Set Up PR Checks

Use drydock to review rendered PR diffs automatically:

drydock Bot commented now

drydock diff

Summary: 2 apps, 4 resources, +30/-26.

envoy-gateway-system (+9/-21, 2 resources)
--- Application: argocd/envoy-gateway-system Source: 0 platform/envoy-gateway/kustomization.yaml apps/Deployment: envoy-gateway-system/envoy-gateway
+++ Application: argocd/envoy-gateway-system Source: 0 platform/envoy-gateway/kustomization.yaml apps/Deployment: envoy-gateway-system/envoy-gateway
@@ -8,7 +8,7 @@
name: envoy-gateway
namespace: envoy-gateway-system
spec:
- replicas: 3
+ replicas: 2
selector:
matchLabels:
app.kubernetes.io/instance: envoy-gateway
@@ -19,17 +19,17 @@
spec:
containers:
- args:
- - --gateway-class-name=envoy-gateway
- - --metrics-bind-address=0.0.0.0:19001
- - --enable-wasm-extension=false
- image: docker.io/envoyproxy/gateway:v1.3.2
+ - --gateway-class-name=platform-gateway
+ - --metrics-bind-address=0.0.0.0:19002
+ - --enable-wasm-extension=true
+ image: docker.io/envoyproxy/gateway:v1.4.0
name: envoy-gateway
resources:
limits:
- cpu: 100m
- memory: 150Mi
+ cpu: 150m
+ memory: 192Mi
requests:
- cpu: 10m
- memory: 150Mi
+ cpu: 25m
+ memory: 192Mi
securityContext:
allowPrivilegeEscalation: false
--- Application: argocd/envoy-gateway-system Source: 0 platform/envoy-gateway/kustomization.yaml policy/PodDisruptionBudget: envoy-gateway-system/envoy-gateway
+++ Application: argocd/envoy-gateway-system Source: 0 platform/envoy-gateway/kustomization.yaml policy/PodDisruptionBudget: envoy-gateway-system/envoy-gateway
@@ -1,12 +0,0 @@
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
- annotations:
- argocd.argoproj.io/tracking-id: envoy-gateway-system:policy/PodDisruptionBudget:envoy-gateway-system/envoy-gateway
- name: envoy-gateway
- namespace: envoy-gateway-system
-spec:
- minAvailable: 1
- selector:
- matchLabels:
- app.kubernetes.io/instance: envoy-gateway
renovate (+21/-5, 2 resources)
--- Application: argocd/renovate Source: 0 apps/renovate/templates/servicemonitor.yaml monitoring.coreos.com/ServiceMonitor: renovate/renovate
+++ Application: argocd/renovate Source: 0 apps/renovate/templates/servicemonitor.yaml monitoring.coreos.com/ServiceMonitor: renovate/renovate
@@ -0,0 +1,16 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+ annotations:
+ argocd.argoproj.io/tracking-id: renovate:monitoring.coreos.com/ServiceMonitor:renovate/renovate
+ name: renovate
+ namespace: renovate
+spec:
+ endpoints:
+ - interval: 30s
+ path: /metrics
+ port: metrics
+ scrapeTimeout: 10s
+ selector:
+ matchLabels:
+ app.kubernetes.io/name: renovate
--- Application: argocd/renovate Source: 0 apps/renovate/templates/renovatejob.yaml renovate-operator.mogenius.com/RenovateJob: renovate/renovate
+++ Application: argocd/renovate Source: 0 apps/renovate/templates/renovatejob.yaml renovate-operator.mogenius.com/RenovateJob: renovate/renovate
@@ -11,18 +11,18 @@
value: http://10.2.0.110:3900
- name: S3_FORCE_PATH_STYLE
value: "true"
- image: renovate/renovate:43.205.3@sha256:53a36e2d4da0fea960e6d4ebac3da152233532c0be1c14313086011e7c4bb551
- parallelism: 3
+ image: renovate/renovate:43.207.4@sha256:087bab575172b1926bbc57124d988015d899b0a82d45028514377b10a392f69d
+ parallelism: 2
provider:
name: github
resources:
limits:
- cpu: 500m
+ cpu: 750m
memory: 2048Mi
requests:
- cpu: 500m
+ cpu: 750m
memory: 2048Mi
- schedule: 0 * * * *
+ schedule: 15 * * * *
secretRef: renovate-secret
webhook:
authentication:

Start Here

  • Getting started installs drydock and runs the first local render test.
  • GitHub Actions sets up pull request checks without Kubernetes or Argo CD credentials.
  • Local diffs covers local tree and Git ref comparisons.
  • How it works explains discovery, source acquisition, rendering, normalization, and reporting.
  • Troubleshooting maps common operator symptoms to the first commands to run.

Core Workflows

drydock get apps --path .
drydock test apps --path .
drydock diff apps --repo . --ref HEAD --ref-orig main
drydock diff images --repo . --ref HEAD --ref-orig main
drydock diag --path .

Choose Your Workflow

Need Start with Read next
Confirm the fleet renders drydock test apps --path . Getting started
Review Argo CD desired state before merge drydock diff apps --repo . --ref HEAD --ref-orig main -o markdown GitHub Actions
Scan image movement drydock diff images --repo . --ref HEAD --ref-orig main Local diffs
Set up plugin support drydock plugin-policy init --path . Plugin policy
Explain warnings or failures drydock diag --path . --cache-events Troubleshooting
Validate cache-only operation drydock test apps --path . --offline Source acquisition

What It Covers

Capability Result
Discover Find committed and supported generated Argo CD Applications.
Render Inflate directory, Kustomize, Helm, Jsonnet, and supported remote sources.
Test Prove Applications render before Argo CD syncs them.
Diff Compare rendered desired manifests across paths or Git refs.
Inspect images Report rendered image reference additions and removals.
Diagnose Surface repository, project, source, cache, plugin, and settings issues.

Operating Model

drydock is runtime-offline: render, test, diff, image, and diagnostic commands do not call Kubernetes or Argo CD APIs. Declared Git, HTTP Helm, OCI Helm, and remote Kustomize sources can still be fetched into explicit caches unless --offline is set.

Use these curated pages for day-to-day operation. Use the reference docs for full compatibility notes, action inputs, source acquisition flags, and plugin policy schema.