Issue with declarative setup and SSH auth with 1.5.x onward

[Kampe]

Checklist:

• [x] I've searched in the docs and FAQ for my answer: http://bit.ly/argocd-faq.
• [x] I've included steps to reproduce the bug.
• [x] I've pasted the output of argocd version. ^ not needed to validate

Describe the bug

When attempting to use declarative setup with Argo after any changes from 1.5 on we're running into many issues with attempting to use our private git repo. We do see via the UI when you mouse over the "X" on why repo sync failed, however none of the container logs are of much use it seems:

Unable to connect to repository: parse "git@github.com:org/manifests_repo": first path segment in URL cannot contain colon

The docs clearly show using the git ssh URI as valid: https://argoproj.github.io/argo-cd/operator-manual/declarative-setup/

Here's my configmap:

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
data:
  repositories: |
    - url: git@github.com:org/manifests_repo
      sshPrivateKeySecret:
        name: ssh-deploy-keys
        key: key.pem

Rolling back to 1.4.3 allows for argo to sync properly. What's changed here about the setup of SSH private key auth?

To Reproduce

Setup argo with declarative setup and attempt to give it a private git repo with SSH key credentials to authenticate with.

Expected behavior

Should deploy the Argo configured application as expected without regression.

Version 1.5.x and onward

[jannfis]

Hi @Kampe, can you please try to set type: git property explicitly for the repository configuration, i.e.

  repositories: |
    - url: git@github.com:org/manifests_repo
      sshPrivateKeySecret:
        name: ssh-deploy-keys
        key: key.pem
      type: git

[jannfis]

I could reproduce the issue, and also validated that explicitly setting type should be the workaround.

However, I think we should assume git as the default repository type when testing for repository access, as to support legacy configurations.

[jannfis]

After some more research, I came to another conclusion. I have tested the following configuration with v1.5.3:

    - url: git@github.com:jannfis/argocd-example-apps
      sshPrivateKeySecret:
        name: ssh-deploy-keys
        key: key.pem

and it works out of the box - as long as the connection to the repository is successful, i.e. the referenced secret exists and contains a key which can be used to connect the repository.

If either the secret does not exist, or the key is not good, the error message can be observed when the type of the repository is not explicitly set. This is because of a check in https://github.com/argoproj/argo-cd/blob/e42102a67e1d82c33351f95d3a758784f1e1c7ef/util/argo/argo.go#L136 - when the type of the repo is not explicitly set, it checks both, git and helm repos. The git check returns an error, therefore, the helm check is executed and that does not accept an scp-style URL.

This could be considered a bug, but I am lowering severity and priority.

[Kampe]

Can confirm this did solve my issue with the repo connection.

[janwillies]

When using the API to request a repo which was previously deleted, it would be great if the response could be more like a 404 instead of this.

[janwillies]

With DeleteRepository() I'm getting the correct answer:

cannot delete Argocd repository: rpc error: code = NotFound desc = repo 'git@gitlab.com:foobar/example-project.git' not found

repoQuery := repository.RepoQuery{
Repo: "git@gitlab.com:foobar/example-project.git",
}
_, err := e.client.DeleteRepository(ctx, &repoQuery)

With Get() however I'm getting a v1alpha1.Repository with Repo set to my RepoQuery string, Type set to git and this connectionState: connectionState: attemptedAt: "2021-04-01T19:11:26Z" message: 'Unable to connect to repository: parse "git@gitlab.com:foobar/example-project.git": first path segment in URL cannot contain colon' status: Failed

    repoQuery := repository.RepoQuery{
        Repo: "git@gitlab.com:foobar/example-project.git",
    }
    repository, err := e.client.Get(ctx, &repoQuery)

Is there another way to check if a repo exists?

[janwillies]

I opened a new issue: https://github.com/argoproj/argo-cd/issues/5951