Repo server

argocd-repo-server is the only Argo CD component that talks to source repositories. Everything else asks the repo server to render manifests on its behalf.

Purpose

• Clone Git repositories and fetch Helm charts (HTTP, OCI) and pure OCI artifacts.
• Render Kubernetes manifests using the configured tool: directory of YAML, Helm, Kustomize, or a Config Management Plugin.
• Cache rendered results in Redis to avoid re-rendering on every refresh.
• Validate signatures (GPG) and credentials.
• Stream renders back to the application controller and API server over gRPC.

Where it lives

Path	Purpose
cmd/argocd-repo-server/commands/argocd_repo_server.go	Binary entry point.
reposerver/server.go	Top-level RepoServer type, listener wiring.
reposerver/repository/repository.go	The single-most important file in the repo server. ~138 KB of GenerateManifests/GetAppDetails/GetRevisionMetadata logic.
reposerver/repository/chart.go, lock.go	Helm chart helpers, per-repo lock file.
reposerver/apiclient/	Auto-generated gRPC client used by the controller and API server.
reposerver/cache/	Wrapper around util/cache/ for per-revision/per-app cache entries.
reposerver/metrics/	Prometheus metrics.
reposerver/gpgwatcher.go	Reloads GnuPG keys on disk-change.

How it works

sequenceDiagram
    participant Caller as Controller / API server
    participant Repo as argocd-repo-server
    participant Cache as Redis
    participant Git as Git/Helm/OCI

    Caller->>Repo: GenerateManifests(repo, revision, source)
    Repo->>Cache: Lookup cached manifests
    alt cache hit
      Cache-->>Repo: rendered manifests
    else cache miss
      Repo->>Git: Clone/fetch
      Repo->>Repo: Tool-specific render (helm/kustomize/cmp/dir)
      Repo->>Cache: Store rendered manifests
    end
    Repo-->>Caller: ManifestResponse

The render path is selected by ApplicationSource shape:

Tool	Detector	Renderer
Helm	source.helm != nil or Chart.yaml present	util/helm/helm.go, util/helm/cmd.go
Kustomize	source.kustomize != nil or kustomization.yaml	util/kustomize/kustomize.go
Directory	YAML/JSON files in the source dir	reposerver/repository/repository.go glob walk
Config Management Plugin	source.plugin or sidecar discovery	util/cmp/, cmpserver/
OCI artifact	OCI URL scheme	util/oci/client.go

Source caching

The repo server has multiple caches:

• Repo lock (reposerver/repository/lock.go) — prevents concurrent fetches of the same repo on the same instance.
• Manifest cache (reposerver/cache/) — keyed by repo URL, revision, source path, tool, values overrides.
• App-details cache — short-lived helper for UI "browse repo" features.
• Pause-on-failure — after --pause-generation-after-failed-generation-attempts consecutive failures, generation is paused for --pause-generation-on-failure-for-minutes to protect upstreams. Configured in cmd/argocd-repo-server/commands/argocd_repo_server.go.

Credentials and authentication

Credentials are passed in the Repository proto, populated server-side from argocd-secret or labelled secrets:

• Git over HTTPS — username + password / token.
• Git over SSH — SSH private key.
• GitHub App — installation private key + app id (util/github_app/).
• Helm registries — username/password, OCI tokens.
• AWS CodeCommit — sigv4 with optional STS assume-role (applicationset/services/scm_provider/aws_codecommit.go is the analogous AppSet path; the repo server uses util/git/creds.go).
• Azure managed identity / workload identity — util/workloadidentity/.

GPG signature verification reads keys from the path set by ARGOCD_GPG_DATA_PATH (default /app/config/gpg/source) and is implemented in util/gpg/. The gpgwatcher.go file restarts the in-memory key set on disk changes.

Streaming and limits

To bound memory use, the repo server enforces:

• --max-combined-directory-manifests-size
• --streamed-manifest-max-tar-size, --streamed-manifest-max-extracted-size
• --helm-manifest-max-extracted-size, --helm-registry-max-index-size
• --oci-manifest-max-extracted-size (with --disable-oci-manifest-max-extracted-size to opt out)

CMP plugins receive a tarred snapshot of the source directory bounded by the same limits.

Service surface

The gRPC service is defined in reposerver/repository/repository.proto. Major RPCs:

• GenerateManifests
• GetAppDetails / GetAppPaths / GetRevisionMetadata / GetRevisionChartDetails
• ListRefs / ListApps / ListPlugins
• RepoServerService health + version

Entry points for modification

• New source tool → add a renderer under util/<tool>/ and a switch case in reposerver/repository/repository.go.
• New credential type → extend util/git/creds.go (or util/helm/creds.go).
• New cache key → extend reposerver/cache/.
• Tighten/loosen size limits → flags in cmd/argocd-repo-server/commands/argocd_repo_server.go.

For the rendering tools see features/sources-and-tooling. For CMP details see applications/cmp-server.