Initial version

Dockerfile

@@ -0,0 +1,27 @@
+FROM alpine AS prefetch
+
+WORKDIR /tmp
+
+RUN set -ex \
+ && apk add --no-cache \
+      curl \
+      unzip \
+ && curl -sSfLo vault.zip "https://releases.hashicorp.com/vault/1.17.5/vault_1.17.5_linux_amd64.zip" \
+ && unzip vault.zip
+
+
+FROM quay.io/argoproj/argocd:v2.12.3
+
+USER root
+
+RUN apt-get update \
+ && apt-get install -y \
+      git-crypt \
+ && apt-get clean \
+ && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* \
+ && mv /usr/bin/git /usr/bin/git.bin
+
+COPY                  git-wrapper.sh  /usr/bin/git
+COPY --from=prefetch  /tmp/vault      /usr/bin/vault
+
+USER 999

git-wrapper.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+$(dirname $0)/git.bin "$@"
+EC=$?
+
+if [ "$1" = "checkout" -a -d ".git-crypt" -f ".git-crypt-key" -a ! "$GIT_CRYPT_RUNNING" = "true" ]; then
+  export GIT_CRYPT_RUNNING=true
+  export VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id="${VAULT_ROLE_ID:-}")
+
+  tmpfile=$(mktemp)
+  vault read -field=key "secret/git-crypt/$(<.git-crypt-key)" | base64 -d >${tmpfile}
+  git-crypt unlock ${tmpfile}
+  rm ${tmpfile}
+fi
+
+exit $EC