<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# GitOps Security — API Reference

## ArgoCD CLI

```bash
# Login
argocd login SERVER --username admin --password PASS

# List applications
argocd app list -o json

# Get app details
argocd app get APP_NAME -o json

# Diff (detect drift)
argocd app diff APP_NAME

# Sync application
argocd app sync APP_NAME --prune

# RBAC validation
argocd admin settings rbac validate -f argocd-rbac-cm.yaml
```

## ArgoCD Kubernetes Resources

```bash
# RBAC ConfigMap
kubectl get configmap argocd-rbac-cm -n argocd -o json

# Applications
kubectl get applications.argoproj.io -n argocd -o json

# AppProjects
kubectl get appprojects -n argocd -o json

# Repositories
kubectl get secrets -n argocd -l argocd.argoproj.io/secret-type=repository
```

## Flux CLI

```bash
# Check Flux installation
flux check

# List Git repositories
flux get sources git -A

# List Kustomizations
flux get kustomizations -A

# Reconcile
flux reconcile source git APP_NAME

# Suspend/resume
flux suspend kustomization APP_NAME
flux resume kustomization APP_NAME
```

## Flux Kubernetes Resources

```bash
# Git repositories
kubectl get gitrepositories.source.toolkit.fluxcd.io -A -o json

# Kustomizations
kubectl get kustomizations.kustomize.toolkit.fluxcd.io -A -o json

# Image policies
kubectl get imagepolicies.image.toolkit.fluxcd.io -A -o json
```

## Secret Scanning

```bash
# Gitleaks
gitleaks detect --source=. --report-format=json
gitleaks detect --source=. --log-opts="--all"

# TruffleHog
trufflehog git file://. --json

# git-secrets
git secrets --scan
git secrets --scan-history
```

## Cosign Image Signing

```bash
# Sign image
cosign sign --key cosign.key REGISTRY/IMAGE:TAG

# Verify image
cosign verify --key cosign.pub REGISTRY/IMAGE:TAG

# Keyless sign (Sigstore)
cosign sign REGISTRY/IMAGE:TAG
```
