Helper binaries

Argo CD ships two single-purpose helper binaries that the bigger components shell out to. They are dispatched from the same cmd/main.go as everything else.

argocd-git-ask-pass

A GIT_ASKPASS provider used by the repo server when invoking git. When git needs credentials for an HTTPS clone, it executes whatever is in GIT_ASKPASS and feeds the standard input/output convention to it. Argo CD points GIT_ASKPASS at this helper so that git inherits the credentials in-memory, rather than embedding them in URLs or files.

Path	Purpose
cmd/argocd-git-ask-pass/commands/	The cobra command.
hack/git-ask-pass.sh	The thin shim used in dev (calls argocd-git-ask-pass over a Unix socket).
util/askpass/	Shared client/server library.

The repo server starts an in-process socket server (util/askpass/) that receives credential queries from this binary. Because git-ask-pass runs as a child of git, it can be a tiny binary and never sees the Git remote URL itself.

argocd-k8s-auth

A kubectl exec credential plugin (client.authentication.k8s.io/v1beta1). Used when destination clusters need short-lived tokens — for example AWS EKS clusters that authenticate via IAM, or GKE clusters that authenticate via Google service accounts, or Azure AKS via AAD.

Path	Purpose
cmd/argocd-k8s-auth/commands/	The cobra command.
util/clusterauth/	Shared logic for token minting.
util/workloadidentity/	Cloud workload-identity helpers.

The binary takes a sub-command per cloud provider (aws, gcp, azure) and prints an ExecCredential JSON document that kubectl/client-go consumes.

Why split these out?

Both helpers run in tightly-scoped subprocesses spawned by other components. Keeping them as separate, name-dispatched binaries means:

• They have a clean process boundary and can crash without taking down the parent.
• Their access to filesystem and network is visible in the process tree.
• They can be invoked by git and kubectl as drop-in plugins without those tools knowing about Argo CD.

For development, they appear as additional cases in the dispatch table of cmd/main.go.