CMP server (Config Management Plugin)

argocd-cmp-server runs as a sidecar to argocd-repo-server and exposes a gRPC service over a Unix socket so user-supplied plugins can render manifests for unsupported tools.

Purpose

• Provide a stable contract for "bring your own renderer" use cases (raw cdk8s, tanka, pulumi, custom homemade scripts, …).
• Decouple plugin code from the main repo-server image. Plugins ship as their own container that mounts the source repo over a tar stream.
• Support discovery so the repo server picks the right plugin per source.

Where it lives

Path	Purpose
cmd/argocd-cmp-server/commands/	Binary entry point.
cmpserver/server.go	gRPC server type.
cmpserver/plugin/	Plugin runtime — handles the Generate/MatchRepository/CheckParameters RPCs.
cmpserver/apiclient/	gRPC client used by the repo server to call the plugin.
util/cmp/	Repo-server-side helpers for socket discovery and tar streaming.

Lifecycle

graph LR
    User[Plugin authors] -->|ConfigMap + binary| Pod[CMP sidecar pod]
    Pod -->|listen on socket| Sock[/tmp/cmp/plugin-<name>.sock]
    Repo[argocd-repo-server] -->|Discover/Generate over Unix socket| Sock
    Sock --> Plugin[CMP plugin invokes user binary]
    Plugin --> Manifests[Rendered manifests]
    Manifests --> Repo

The repo server scans the directory configured by ARGOCD_PLUGINSOCKFILEPATH (default /home/argocd/cmp-server/plugins) for Unix sockets. Each socket is a CMP plugin. For an Application that opts into CMP via source.plugin, the repo server:

1. Sends the source files as a tar stream to the matched plugin.
2. Calls Generate to receive rendered manifests.
3. Caches the result keyed by source revision and parameter set.

Plugin contract

A plugin is configured by a ConfigManagementPlugin ConfigMap or a plugin.yaml mounted into the sidecar. It declares:

• discover — patterns or scripts for matching applicable sources.
• generate.command — the command to run to render manifests.
• parameters — the parameter schema used by the UI.

cmpserver/plugin/ translates ConfigMap fields into the gRPC service that the repo server calls.

Tar streaming and limits

The repo server applies size limits when shipping the source tar:

• --cmp-tar-excluded-globs — globs to drop from the tar (defaults to .git/**).
• --streamed-manifest-max-tar-size — bound on the tarball size.
• --streamed-manifest-max-extracted-size — bound on what the plugin extracts.

Entry points for modification

• Extend the plugin RPC surface → edit cmpserver/plugin/ and the underlying proto.
• Tweak discovery → util/cmp/.
• Change the tar stream behavior → repo-server side in util/cmp/.

See Repo server for the call site and features/sources-and-tooling for the bigger picture.