From add1403fc95d6db24c009e7c51adb7d57b1d081c Mon Sep 17 00:00:00 2001 From: Matthiator Date: Tue, 9 Jun 2026 19:37:36 +0200 Subject: [PATCH 1/2] feat: support repository auth modes in ExternalSecret helper --- .../argocd/add_app_repository.md | 97 +++++++++++++++---- .../_externalSecret.es.argo.repo.tpl | 55 ++++++++--- 2 files changed, 121 insertions(+), 31 deletions(-) diff --git a/docs/content/2_managing_your_platform/argocd/add_app_repository.md b/docs/content/2_managing_your_platform/argocd/add_app_repository.md index 942f945f..558afb51 100644 --- a/docs/content/2_managing_your_platform/argocd/add_app_repository.md +++ b/docs/content/2_managing_your_platform/argocd/add_app_repository.md @@ -8,12 +8,11 @@ https://argo-cd.readthedocs.io/en/stable/user-guide/private-repositories/ ## **Add credentials to vault** Add the repository credentials to your vault. -The example below uses HTTPS username + password/PAT authentication. -For most Git providers, `PAT` means Personal Access Token and is often tied to a user account. +The examples below use one secret value per repository credential. + +For HTTPS username + password/PAT authentication, `PAT` usually means Personal Access Token and is often tied to a user account. For platform automation, prefer a technical or machine account instead of a personal user account. Set `username` to the account name expected by your Git provider; the exact value is provider-dependent. -The helper shown on this page currently covers HTTPS username + password/PAT repositories. -For SSH deploy keys or GitHub App authentication on additional app repositories, create the Argo CD repository Secret manually according to the Argo CD documentation until the helper supports those modes as well. ```json { @@ -22,24 +21,88 @@ For SSH deploy keys or GitHub App authentication on additional app repositories, } } ``` + +For SSH deploy key authentication: + +```json +{ + "repo_ssh": { + "privateKey": "-----BEGIN OPENSSH PRIVATE KEY-----\n...\n-----END OPENSSH PRIVATE KEY-----" + } +} +``` + +For GitHub App authentication: + +```json +{ + "repo_github_app": { + "privateKey": "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----" + } +} +``` + ## **Modify Argo CD overlays** -Add the following to your `argo-cd/values.yaml`. +Add one of the following repository definitions to your `argo-cd/values.yaml`. + +HTTPS username + password/PAT: + +```yaml +repositories: + - name: user-repo-mock + authMode: https + projectScope: k8s-spoke-0 + remoteRef: + remoteKey: repo_pat + remoteKeyProperty: pat + repoType: git + secretStoreRef: + kind: ClusterSecretStore + name: hub-0-production + url: https://git.example.com/org/repo.git + username: +``` + +SSH deploy key: + ```yaml repositories: - - name: user-repo-mock - projectScope: k8s-spoke-0 - # # This points to the secret in vault - remoteRef: - remoteKey: repo_pat - remoteKeyProperty: pat - repoType: git - secretStoreRef: - kind: ClusterSecretStore - name: hub-0-production - url: - username: + - name: user-repo-ssh + authMode: ssh + projectScope: k8s-spoke-0 + sshPrivateKeyRemoteRef: + remoteKey: repo_ssh + remoteKeyProperty: privateKey + repoType: git + secretStoreRef: + kind: ClusterSecretStore + name: hub-0-production + url: git@git.example.com:org/repo.git ``` +For SSH repositories, make sure Argo CD already trusts the SSH host key. See the bootstrap documentation for `configs.ssh.extraHosts`. + +GitHub App: + +```yaml +repositories: + - name: user-repo-github-app + authMode: github-app + projectScope: k8s-spoke-0 + githubAppID: "123456" + githubAppInstallationID: "987654" + githubAppPrivateKeyRemoteRef: + remoteKey: repo_github_app + remoteKeyProperty: privateKey + repoType: git + secretStoreRef: + kind: ClusterSecretStore + name: hub-0-production + url: https://github.com/org/repo.git +``` + +For GitHub Enterprise, also set `githubAppEnterpriseBaseUrl`. + That whats happening behind the scenes: ![Add Repository](../../images/add-repository.png) diff --git a/src/internal/catalog/built-in/managed-service-catalog/helm/template-library/templates/external-secrets/_externalSecret.es.argo.repo.tpl b/src/internal/catalog/built-in/managed-service-catalog/helm/template-library/templates/external-secrets/_externalSecret.es.argo.repo.tpl index 665d0a12..b9a0551f 100644 --- a/src/internal/catalog/built-in/managed-service-catalog/helm/template-library/templates/external-secrets/_externalSecret.es.argo.repo.tpl +++ b/src/internal/catalog/built-in/managed-service-catalog/helm/template-library/templates/external-secrets/_externalSecret.es.argo.repo.tpl @@ -1,4 +1,31 @@ +{{- define "templateLibrary.externalSecrets.argocd.repository.remoteRef" }} +{{- if .remoteRef }} +key: {{ .remoteRef.remoteKey }} +{{- if .remoteRef.remoteKeyProperty }} +property: {{ .remoteRef.remoteKeyProperty }} +{{- end }} +{{- else }} +key: {{ .name }} +{{- end }} +conversionStrategy: Default +decodingStrategy: None +metadataPolicy: None +nullBytePolicy: Fail +{{- end }} + {{- define "templateLibrary.externalSecrets.argocd.repository" }} +{{- $authMode := default "https" .authMode }} +{{- $credentialSecretKey := "pat" }} +{{- $credentialRemoteRef := .remoteRef }} +{{- if eq $authMode "ssh" }} +{{- $credentialSecretKey = "sshPrivateKey" }} +{{- $credentialRemoteRef = default .remoteRef .sshPrivateKeyRemoteRef }} +{{- else if eq $authMode "github-app" }} +{{- $credentialSecretKey = "githubAppPrivateKey" }} +{{- $credentialRemoteRef = default .remoteRef .githubAppPrivateKeyRemoteRef }} +{{- else if ne $authMode "https" }} +{{- fail (printf "unsupported Argo CD repository authMode %q for repository %q" $authMode .name) }} +{{- end }} apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: @@ -18,10 +45,21 @@ spec: argocd.argoproj.io/secret-type: repository data: name: {{.name}} - type: {{ .repoType }} + type: {{ default "git" .repoType }} url: {{.url}} + {{- if eq $authMode "https" }} username: {{ .username }} password: "{{ "{{" }} .pat }}" + {{- else if eq $authMode "ssh" }} + sshPrivateKey: "{{ "{{" }} .sshPrivateKey }}" + {{- else if eq $authMode "github-app" }} + githubAppID: {{ .githubAppID | quote }} + githubAppInstallationID: {{ .githubAppInstallationID | quote }} + githubAppPrivateKey: "{{ "{{" }} .githubAppPrivateKey }}" + {{- if .githubAppEnterpriseBaseUrl }} + githubAppEnterpriseBaseUrl: {{ .githubAppEnterpriseBaseUrl | quote }} + {{- end }} + {{- end }} {{- if .proxy }} proxy: {{.proxy}} {{- end }} @@ -37,19 +75,8 @@ spec: insecure: "false" {{- end }} data: - - secretKey: pat + - secretKey: {{ $credentialSecretKey }} remoteRef: - {{- if .remoteRef }} - key: {{ .remoteRef.remoteKey }} - {{- if .remoteRef.remoteKeyProperty }} - property: {{ .remoteRef.remoteKeyProperty }} - {{- end }} - {{- else }} - key: {{ .name }} - {{- end }} - conversionStrategy: Default - decodingStrategy: None - metadataPolicy: None - nullBytePolicy: Fail +{{- include "templateLibrary.externalSecrets.argocd.repository.remoteRef" (dict "name" .name "remoteRef" $credentialRemoteRef) | nindent 8 }} --- {{- end }} From cb6be06f9438581cf11308921bf89e8828acde23 Mon Sep 17 00:00:00 2001 From: Matthiator Date: Tue, 9 Jun 2026 19:46:54 +0200 Subject: [PATCH 2/2] fix: validate GitHub App repository helper settings --- .../2_managing_your_platform/argocd/add_app_repository.md | 2 +- .../external-secrets/_externalSecret.es.argo.repo.tpl | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/content/2_managing_your_platform/argocd/add_app_repository.md b/docs/content/2_managing_your_platform/argocd/add_app_repository.md index 558afb51..edc1e45f 100644 --- a/docs/content/2_managing_your_platform/argocd/add_app_repository.md +++ b/docs/content/2_managing_your_platform/argocd/add_app_repository.md @@ -103,7 +103,7 @@ repositories: For GitHub Enterprise, also set `githubAppEnterpriseBaseUrl`. -That whats happening behind the scenes: +That's what's happening behind the scenes: ![Add Repository](../../images/add-repository.png) diff --git a/src/internal/catalog/built-in/managed-service-catalog/helm/template-library/templates/external-secrets/_externalSecret.es.argo.repo.tpl b/src/internal/catalog/built-in/managed-service-catalog/helm/template-library/templates/external-secrets/_externalSecret.es.argo.repo.tpl index b9a0551f..3001e121 100644 --- a/src/internal/catalog/built-in/managed-service-catalog/helm/template-library/templates/external-secrets/_externalSecret.es.argo.repo.tpl +++ b/src/internal/catalog/built-in/managed-service-catalog/helm/template-library/templates/external-secrets/_externalSecret.es.argo.repo.tpl @@ -53,8 +53,8 @@ spec: {{- else if eq $authMode "ssh" }} sshPrivateKey: "{{ "{{" }} .sshPrivateKey }}" {{- else if eq $authMode "github-app" }} - githubAppID: {{ .githubAppID | quote }} - githubAppInstallationID: {{ .githubAppInstallationID | quote }} + githubAppID: {{ required (printf "githubAppID is required when authMode is github-app for repository %q" .name) .githubAppID | quote }} + githubAppInstallationID: {{ required (printf "githubAppInstallationID is required when authMode is github-app for repository %q" .name) .githubAppInstallationID | quote }} githubAppPrivateKey: "{{ "{{" }} .githubAppPrivateKey }}" {{- if .githubAppEnterpriseBaseUrl }} githubAppEnterpriseBaseUrl: {{ .githubAppEnterpriseBaseUrl | quote }}