Cluster and repository secrets

Argo CD stores destination clusters and source repositories as labelled Kubernetes Secrets, not as separate CRDs. This page documents that on-disk format.

Cluster secret

A registered destination cluster is a Secret with the label argocd.argoproj.io/secret-type: cluster. It contains the API server URL, name, optional config (bearer token, certs, AWS auth config, exec credential plugin), and optional namespaces scope.

Path	Purpose
util/db/cluster.go	CRUD API on cluster Secrets.
pkg/apis/application/v1alpha1/cluster_constants.go	Constants (label names, the in-cluster reserved name).
cmd/argocd/commands/cluster.go	CLI surface.
server/cluster/	gRPC service.

Cluster.Config (in pkg/apis/application/v1alpha1/types.go) holds the auth method:

• bearerToken for service-account-style auth.
• tlsClientConfig for mTLS.
• awsAuthConfig for AWS IAM-based auth.
• execProviderConfig to invoke argocd-k8s-auth or any other client-go exec plugin.

Repository secret

A registered source repository is a Secret with the label argocd.argoproj.io/secret-type: repository (or repo-creds for prefix-matched credentials). It includes:

• url — repo URL.
• username / password / sshPrivateKey.
• tlsClientCertData / tlsClientCertKey.
• githubAppID / githubAppInstallationID / githubAppPrivateKey.
• awsRoleARN for CodeCommit.
• gcpServiceAccountKey.
• enableLfs, proxy, noProxy, forceHttpBasicAuth.

Path	Purpose
util/db/repository.go, repository_secrets.go, repo_creds.go, helmrepository.go, secrets.go	CRUD on repo/repocred Secrets.
pkg/apis/application/v1alpha1/repository_types.go	Go types.
cmd/argocd/commands/repo.go, repocreds.go	CLI surfaces.
server/repository/, server/repocreds/	gRPC services.

Why Secrets instead of CRDs?

• Existing operators already know how to manage Secrets (sealed-secrets, external-secrets-operator, …).
• The Argo CD CLI/UI never has to render a credential payload; it just labels a Secret.
• Cluster topology (registered clusters) is naturally a Secret because it carries credentials.

Reserved entries

• The destination name in-cluster (with empty server URL) is a reserved alias for the cluster Argo CD itself runs in. It does not need a registration Secret.
• Repository "credentials templates" (secret-type=repo-creds) match by URL prefix and apply to any repo whose URL starts with the prefix — useful for org-wide GitHub credentials.

Discovery

The application controller's destination resolution (util/db/cluster.go) and the repo server's source resolution (util/db/repository.go) both read from these Secret stores. The settings package (util/settings/cluster_informer.go) provides the in-process informer.