Proxy configuration in ArgoCD

[zohebk8s]

ArgoCD is running on OpenShift and it’s a corporate proxy environment.

By default, all the argocd pods has proxy values added.

Searching for a clean solution to fix it. As the argocd needs to communicate with git outside of OpenShift

[FabianIMV]

Hi @zohebk8s, the clean approach is to let traffic to Git go through the proxy while keeping all in-cluster traffic out of it 👋

Two options:

Option 1: keep the env vars, but fix NO_PROXY

Only the repo-server (and the applicationset-controller if you use SCM/PR generators) actually needs to reach Git. Everything else talks to in-cluster services, and if those calls go through the proxy, things break. Make sure NO_PROXY covers:

.svc,.cluster.local,localhost,127.0.0.1,<service CIDR>,<pod CIDR>,<API server IP/host>

If you're on the OpenShift GitOps operator, you can set env per component in the ArgoCD CR (spec.repo.env, spec.controller.env, spec.server.env, ...). That way only the repo-server gets the proxy and the other components don't get it at all.

Option 2: per repository proxy (no global env)

Argo CD supports a proxy per repository in the repository Secret, so you don't need HTTP(S)_PROXY on the pods at all:

apiVersion: v1
kind: Secret
metadata:
  name: my-repo
  namespace: openshift-gitops
  labels:
    argocd.argoproj.io/secret-type: repository
stringData:
  type: git
  url: https://github.com/org/repo.git
  proxy: http://proxy.corp.example:3128
  # noProxy: .corp.example   # available in recent versions

This is usually the cleanest when only some repos are external. If it doesn't solve it, share which component is failing and the error message