In this lesson, you will learn how to bridge your private Git repositories with Argo CD using secure authentication, ensuring your clusters remain perfectly synchronized with your declarative configurations.
Bridging the Security Gap
Argo CD functions as a pull-based controller that reconciles your Kubernetes state with the configuration defined in your Git repository. When your repository is private, Argo CD requires explicit credentials to clone the manifest files. Relying on public access is a security risk; instead, we authenticate using either SSH keys or Personal Access Tokens (PATs).
Authentication Strategies
For most production environments, SSH keys are the preferred method. You generate an SSH key pair, add the public key to your Git provider (GitHub, GitLab, or Bitbucket), and store the private key as a Kubernetes Secret within the Argo CD namespace.
Alternatively, you can use Personal Access Tokens (PATs). While easier to manage for individual developers, tokens must be scoped with read-only repository permissions to adhere to the principle of least privilege.
Implementation Flow
Once you have your credentials, you register the repository via the argocd CLI or the dashboard. When using the CLI, you associate the repository URL with your secret:
argocd repo add git@github.com:org/my-private-repo.git \
--ssh-private-key-path ~/.ssh/id_rsa_argocd
Once added, Argo CD creates a "Repository Secret" in the argocd namespace. The controller then monitors the repository, automatically triggering the reconciliation loop whenever a push occurs. By using these secure handshake methods, you ensure that even if your infrastructure is exposed, the configuration remains shielded from unauthorized read access, maintaining the integrity of your GitOps pipeline.
This step is critical for moving beyond public-only demonstrations and securing enterprise-grade deployments where sensitive environment configurations or proprietary code patterns reside in locked repositories.
Key Takeaway: Connecting private Git repositories to Argo CD via SSH keys or scoped PATs enables secure, automated reconciliation while maintaining strict access control over your infrastructure state.