Seamlessly Access Private Git Repositories in EKS with Argo CD
In today's cloud-native landscape, accessing private Git repositories from your Amazon EKS cluster is crucial for maintaining security and efficiency. Argo CD can manage your Kubernetes applications, but it struggles with private repositories out of the box. This is where AWS CodeConnections comes in, providing a secure and authenticated way to connect your EKS environment to private Git servers like GitHub Enterprise or GitLab.
AWS CodeConnections operates by creating a cross-account elastic network interface (ENI) within your specified VPC. This setup connects directly to your private Git server, ensuring that all communications remain secure. You need to configure several parameters, including the GIT_ENDPOINT_URL, REGION, VPC_ID, SUBNET_IDS, and SECURITY_GROUP_ID. For instance, you might set your GIT_ENDPOINT_URL to https://github.example.com and specify the appropriate subnet IDs for your VPC. Once configured, you can create a connection using the AWS CLI, allowing Argo CD to pull from your private repository seamlessly.
In production, ensure you have the AWS CLI version 2.x or later installed and configured, along with kubectl access to your EKS cluster. Be aware of the TLS certificate requirements; only include the TlsCertificate field if your Git server uses a privately signed certificate. This integration can significantly streamline your CI/CD processes, but remember to monitor your network configurations and permissions closely to avoid connectivity issues.
Key takeaways
- →Configure AWS CodeConnections to create a secure network path for your private Git server.
- →Set the GIT_ENDPOINT_URL to your private Git server's URL for seamless access.
- →Use the AWS CLI to create connections and hosts for your Git repositories.
- →Include the TlsCertificate field only if using a privately signed certificate.
- →Ensure you have the necessary permissions to create CodeConnections and VPC resources.
Why it matters
Integrating private Git repositories with Argo CD in EKS enhances security and streamlines deployment workflows, allowing teams to maintain a robust CI/CD pipeline without compromising on access control.
Code examples
export GIT_ENDPOINT_URL="https://github.example.com" # Private Git Server URL
export REGION="us-west-2"
export VPC_ID="vpc-0c0a64adaa55b2dde" # VPC ID where the Host will be created
export SUBNET_IDS="subnet-0099c63c1499e95c6,subnet-0849c92d198b5ff9b"
export SECURITY_GROUP_ID="sg-08e49afc4f10e1792"1export HOST_ARN=$(aws codeconnections create-host \
2 --name "github-" \
3 --provider-type GitHubEnterpriseServer \
4 --provider-endpoint "$GIT_ENDPOINT_URL" \
5 --vpc-configuration file://vpc-config.json \
6 --region "$REGION" \
7 --query 'HostArn' --output text)1apiVersion: argoproj.io/v1alpha1
2kind: Application
3metadata:
4 name: guestbook
5 namespace: argocd
6spec:
7 project: default
8 source:
9 repoURL: https://codeconnections.<CodeConnection_Region>.amazonaws.com/git-http/<Your_Account_ID>/<CodeConnection_Region>/<Connection_ID>/<Git_Username/Git_Organization/Project>/<Git_Repository>.git
10 targetRevision: HEAD
11 path: guestbook
12 destination:
13 server: arn:aws:eks:<EKS_Cluster_Region>:<Account_ID>:cluster/<Target_EKS_Cluster_Name>
14 namespace: guestbookWhen NOT to use this
The official docs don't call out specific anti-patterns here. Use your judgment based on your scale and requirements.
Want the complete reference?
Read official docsIndustry-standard certifications built by the people behind Linux and Kubernetes. Earn the CKA — the gold standard Kubernetes administrator cert. OpsCanary readers get 30% off year-round with code OPSCANARY3.
Get CKA certified →Deploying Dragonfly Lightweight: P2P Distribution Without the Database Overhead
Tired of heavyweight database stacks slowing down your deployments? Discover how a lightweight Dragonfly deployment leverages Kubernetes primitives like ConfigMaps and headless Services for efficient P2P distribution. This approach simplifies your architecture while maintaining performance.
K8gb: Elevating Global Load Balancing in Kubernetes
K8gb is now a CNCF incubating project, marking a significant step in cloud-native global server load balancing. It automates traffic management and ensures seamless failover using Kubernetes-native health checks and CoreDNS.
TCPRoute and UDPRoute in Gateway API v1.6: What You Need to Know
The Gateway API v1.6 marks a significant step forward with TCPRoute and UDPRoute graduating to standard status. These resources allow you to route traffic based solely on protocol and port, simplifying your networking configurations in Kubernetes.
Get the daily digest
One email. 5 articles. Every morning.
No spam. Unsubscribe anytime.