kubara-io · Matthiator · Jul 22, 2026
diff --git a/bootstrap/Catalog.yaml b/bootstrap/Catalog.yaml
@@ -6,4 +6,4 @@ metadata:
   annotations:
     org.opencontainers.image.source: https://github.com/kubara-io/catalogs
 spec:
-  version: 1.0.0
+  version: 1.1.0
diff --git a/...ponents/helm/template-library/templates/external-secrets/_externalSecret.es.argo.repo.tpl b/...ponents/helm/template-library/templates/external-secrets/_externalSecret.es.argo.repo.tpl
@@ -1,4 +1,31 @@
+{{- define "templateLibrary.externalSecrets.argocd.repository.remoteRef" }}
+{{- if .remoteRef }}
+key: {{ .remoteRef.remoteKey }}
+{{- if .remoteRef.remoteKeyProperty }}
+property: {{ .remoteRef.remoteKeyProperty }}
+{{- end }}
+{{- else }}
+key: {{ .name }}
+{{- end }}
+conversionStrategy: Default
+decodingStrategy: None
+metadataPolicy: None
+nullBytePolicy: Fail
+{{- end }}
+
 {{- define "templateLibrary.externalSecrets.argocd.repository" }}
+{{- $authMode := default "https" .authMode }}
+{{- $credentialSecretKey := "pat" }}
+{{- $credentialRemoteRef := .remoteRef }}
+{{- if eq $authMode "ssh" }}
+{{- $credentialSecretKey = "sshPrivateKey" }}
+{{- $credentialRemoteRef = default .remoteRef .sshPrivateKeyRemoteRef }}
+{{- else if eq $authMode "github-app" }}
+{{- $credentialSecretKey = "githubAppPrivateKey" }}
+{{- $credentialRemoteRef = default .remoteRef .githubAppPrivateKeyRemoteRef }}
+{{- else if ne $authMode "https" }}
+{{- fail (printf "unsupported Argo CD repository authMode %q for repository %q" $authMode .name) }}
+{{- end }}
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
@@ -18,10 +45,21 @@ spec:
           argocd.argoproj.io/secret-type: repository
       data:
         name: {{.name}}
-        type: {{ .repoType }}
+        type: {{ default "git" .repoType }}
         url: {{.url}}
+        {{- if eq $authMode "https" }}
         username: {{ .username }}
         password: "{{ "{{" }} .pat }}"
+        {{- else if eq $authMode "ssh" }}
+        sshPrivateKey: "{{ "{{" }} .sshPrivateKey }}"
+        {{- else if eq $authMode "github-app" }}
+        githubAppID: {{ required (printf "githubAppID is required when authMode is github-app for repository %q" .name) .githubAppID | quote }}
+        githubAppInstallationID: {{ required (printf "githubAppInstallationID is required when authMode is github-app for repository %q" .name) .githubAppInstallationID | quote }}
+        githubAppPrivateKey: "{{ "{{" }} .githubAppPrivateKey }}"
+        {{- if .githubAppEnterpriseBaseUrl }}
+        githubAppEnterpriseBaseUrl: {{ .githubAppEnterpriseBaseUrl | quote }}
+        {{- end }}
+        {{- end }}
         {{- if .proxy }}
         proxy: {{.proxy}}
         {{- end }}
@@ -37,19 +75,8 @@ spec:
         insecure: "false"
         {{- end }}
   data:
-    - secretKey: pat
+    - secretKey: {{ $credentialSecretKey }}
       remoteRef:
-        {{- if .remoteRef }}
-        key: {{ .remoteRef.remoteKey }}
-        {{- if .remoteRef.remoteKeyProperty }}
-        property: {{ .remoteRef.remoteKeyProperty }}
-        {{- end }}
-        {{- else }}
-        key: {{ .name }}
-        {{- end }}
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        nullBytePolicy: Fail
+{{- include "templateLibrary.externalSecrets.argocd.repository.remoteRef" (dict "name" .name "remoteRef" $credentialRemoteRef) | nindent 8 }}
 ---
 {{- end }}
diff --git a/bootstrap/platform-configs/helm/argo-cd/values.generated.yaml.tplt b/bootstrap/platform-configs/helm/argo-cd/values.generated.yaml.tplt
@@ -6,6 +6,13 @@
 {{- $kubePrometheusStatus := dig "cluster" "services" "kube-prometheus-stack" "status" "disabled" . -}}
 {{- $traefikStatus := dig "cluster" "services" "traefik" "status" "disabled" . -}}
 {{- $reloaderStatus := dig "cluster" "services" "reloader" "status" "disabled" . -}}
+{{- $gitRepository := dig "cluster" "argocd" "repo" "git" (dict) . -}}
+{{- if not $gitRepository -}}
+{{- $gitRepository = dig "cluster" "argocd" "repo" "https" (dict) . -}}
+{{- end -}}
+{{- if not $gitRepository -}}
+{{- $gitRepository = dig "cluster" "argocd" "repo" "oci" (dict) . -}}
+{{- end -}}
 
 {{- if (eq .cluster.type "hub") }}
 bootstrapValues:
@@ -65,13 +72,13 @@ This is a fixed assumption and needs to be followed for spoke cluster onboarding
     {{ .cluster.name }}-{{ .cluster.stage }}:
       projectName: "{{ .cluster.name }}-{{ .cluster.stage }}"
       platformComponents:
-        repoURL: "{{ .cluster.argocd.repo.https.components.url }}"
-        path: "{{ .cluster.argocd.repo.https.components.path | default "platform-components/helm" }}"
-        targetRevision: "{{ .cluster.argocd.repo.https.components.targetRevision }}"
+        repoURL: "{{ $gitRepository.components.url }}"
+        path: "{{ $gitRepository.components.path | default "platform-components/helm" }}"
+        targetRevision: "{{ $gitRepository.components.targetRevision }}"
       platformConfigs:
-        repoURL: "{{ .cluster.argocd.repo.https.configs.url }}"
-        path: "{{ .cluster.argocd.repo.https.configs.path | default "platform-configs" }}"
-        targetRevision: "{{ .cluster.argocd.repo.https.configs.targetRevision }}"
+        repoURL: "{{ $gitRepository.configs.url }}"
+        path: "{{ $gitRepository.configs.path | default "platform-configs" }}"
+        targetRevision: "{{ $gitRepository.configs.targetRevision }}"
       apps:
 {{- if eq .cluster.argocd.selfManaged "enabled" }}
         argocd:

diff --git a/general/Catalog.yaml b/general/Catalog.yaml
@@ -6,4 +6,4 @@ metadata:
   annotations:
     org.opencontainers.image.source: https://github.com/kubara-io/catalogs
 spec:
-  version: 1.0.0
+  version: 1.1.0
diff --git a/general/platform-configs/helm/kyverno-policies/values.generated.yaml.tplt b/general/platform-configs/helm/kyverno-policies/values.generated.yaml.tplt
@@ -2,7 +2,15 @@
 # This file is auto-generated by kubara and should not be modified manually in any way.
 # To customize values, you can add additional files named values-*.yaml to this directory.
 
+{{- $gitRepositoryURL := dig "cluster" "argocd" "repo" "git" "configs" "url" "" . -}}
+{{- if not $gitRepositoryURL -}}
+{{- $gitRepositoryURL = dig "cluster" "argocd" "repo" "https" "configs" "url" "" . -}}
+{{- end -}}
+{{- if not $gitRepositoryURL -}}
+{{- $gitRepositoryURL = dig "cluster" "argocd" "repo" "oci" "configs" "url" "" . -}}
+{{- end -}}
+
 global:
   allowedIssuerDomains: "{{ (index .cluster.services "cert-manager" "config" "clusterIssuer" "server") }}"
   allowedImageRegistries: |
-   "${ARGOCD_GIT_HTTPS_URL}/*|${ARGOCD_HELM_REPO_URL}/*"
+   "{{ $gitRepositoryURL }}/*|${ARGOCD_HELM_REPO_URL}/*"
diff --git a/general/platform-configs/terraform/stackit/infrastructure/env.auto.tfvars.tplt b/general/platform-configs/terraform/stackit/infrastructure/env.auto.tfvars.tplt
@@ -1,6 +1,6 @@
 ### DNS
-contact_email = "{{ .cluster.terraform.dns.email }}"
-dns_name      = "{{ .cluster.terraform.dns.name }}"
+contact_email = "{{ dig "cluster" "terraform" "dns" "email" .cluster.terraform.dnsContactEmail . }}"
+dns_name      = "{{ dig "cluster" "terraform" "dns" "name" .cluster.dnsName . }}"
 
 ### Global
 project_id = "{{ .cluster.terraform.projectId }}"

diff --git a/general/platform-configs/terraform/t-cloud-public/infrastructure/env.auto.tfvars.tplt b/general/platform-configs/terraform/t-cloud-public/infrastructure/env.auto.tfvars.tplt
@@ -5,8 +5,8 @@ name  = "{{ .cluster.name }}"
 {{ if (eq .cluster.terraform.kubernetesType "cce") }}
 ### DNS
 create_dns_zone = true
-dns_zone_name   = "{{ .cluster.terraform.dns.name }}"
-dns_zone_email  = "{{ .cluster.terraform.dns.email }}"
+dns_zone_name   = "{{ dig "cluster" "terraform" "dns" "name" .cluster.dnsName . }}"
+dns_zone_email  = "{{ dig "cluster" "terraform" "dns" "email" .cluster.terraform.dnsContactEmail . }}"
 dns_zone_type   = "public"
 dns_zone_ttl    = 300