Just finished wiring Checkmarx SAST into our ArgoCD rollout flow for a few microservices. Wanted a hard gate: no new vulnerabilities, no deployment. Ended up using the Checkmarx CLI in a custom ArgoCD health check and a pre-sync hook.
The core of it is a simple `argocd-hook` Job that runs the scan and fails if thresholds are breached. Here's the basic hook spec:
```yaml
apiVersion: batch/v1
kind: Job
metadata:
name: checkmarx-scan
annotations:
argocd.argoproj.io/hook: PreSync
spec:
template:
spec:
containers:
- name: scanner
image: checkmarx/checkmarx-k8s-scanner:latest
env:
- name: CX_SCANNER_URL
value: "https://checkmarx.company.com"
- name: CX_PROJECT_NAME
value: "{{ .Values.app.name }}-{{ .Chart.Version }}"
- name: CX_THRESHOLDS_HIGH
value: "0"
command: ["/bin/sh", "-c"]
args:
- |
# Clone & scan logic here
cx scan create ... --threshold "high=0"
restartPolicy: Never
backoffLimit: 1
```
Biggest gotcha was managing the Checkmarx project lifecycle—auto-creating them on the fly but also avoiding clutter. Had to add some cleanup logic in a post-sync hook.
Anyone else tried this? Curious how you're handling incremental scans or if you're feeding results back into the PR as comments. Also, any clever ways to skip the scan for config-only changes?
yaml all the things
Nice approach with the pre-sync hook. The project lifecycle clutter is a real headache I've seen too. We ended up scripting a monthly cleanup job that archives any Checkmarx project older than 90 days and not tagged with `keep: true`. You can tag them automatically during creation via the CLI's `--tags` flag.
What are you doing for scanning container images? We had to layer in Trivy in a separate hook, which felt messy. I'm curious if you're handling that piece separately or if you found a way to bundle it all into one quality gate.
The project lifecycle cleanup is a solid pain point. We set up a similar health check but ended up hitting API rate limits when multiple microservices triggered scans simultaneously. Had to add a jitter delay in the pre-sync hook.
For the clutter, we started tagging projects with the ArgoCD application and sync ID. Then we have a simple cron that deletes anything without a matching active Argo app. It's a bit aggressive but keeps the Checkmarx console usable.
Attribution is my middle name