Manifest hydrator

The manifest hydrator is an opt-in pipeline that pre-renders ("hydrates") manifests from a dry source revision and commits them back to a hydrated branch in the same Git repo. The Application is then synced from the hydrated branch.

Why

• Auditability. Every deployment is a Git diff in the hydrated branch — exactly what is applied to the cluster.
• Determinism. Sync no longer depends on tool versions (Helm, Kustomize). The rendered YAML is in Git.
• Decoupled CI vs CD. CI can pre-render manifests asynchronously; CD just applies them.

Components

sequenceDiagram
    participant Ctrl as application controller
    participant Hyd as util/hydrator
    participant Repo as argocd-repo-server
    participant CommitSrv as argocd-commit-server
    participant Git as Git (hydrated branch)

    Ctrl->>Repo: GenerateManifests(dry source)
    Repo-->>Ctrl: Rendered manifests
    Ctrl->>Hyd: Prepare hydrated commit
    Hyd-->>Ctrl: Files + metadata
    Ctrl->>CommitSrv: CommitHydratedManifests(repo, hydrated branch, files)
    CommitSrv->>Git: Clone, write files, commit, push
    CommitSrv-->>Ctrl: Hydrated revision
    Ctrl->>Ctrl: Sync from hydrated branch (apply to cluster)

Path	Purpose
controller/hydrator/	Application-controller-side orchestrator.
controller/hydrator_dependencies.go	Helpers to gather everything needed for a hydration round.
util/hydrator/hydrator.go	Library that produces the hydrated file set.
util/hydrator/template.go	Per-source rendering helpers.
commitserver/	The binary that performs the Git commit.

Application API

Applications opt in via spec.sourceHydrator:

spec:
  sourceHydrator:
    drySource:
      repoURL: https://example.com/repo.git
      path: helm/my-app
      targetRevision: main
    syncSource:
      targetBranch: env/prod
      path: my-app

The controller renders drySource and writes the result into syncSource.path on syncSource.targetBranch of the same repo (with optional hydrateTo.targetBranch indirection).

Install variants

The hydrator requires the commit server. Three install bundles include it:

• manifests/install-with-hydrator.yaml
• manifests/core-install-with-hydrator.yaml
• manifests/cluster-install-with-hydrator/

The default install.yaml does not ship the commit server, so the hydrator is silently disabled until you switch bundles or enable it manually.

Controller flag

--hydrator-enabled=true on the application controller turns the loop on. The Procfile passes through ${ARGOCD_HYDRATOR_ENABLED} so dev environments can flip it without rebuilds.

See also

• Commit server — the writeback runtime.
• Application controller — drives the hydrate-then-sync flow.