projectsyn · simu · Nov 3, 2025 · Oct 9, 2025 · Oct 31, 2025
diff --git a/component/argocd.jsonnet b/component/argocd.jsonnet
@@ -231,27 +231,6 @@ local argocd(name) =
       version: params.images.argocd.tag,
       applicationInstanceLabelKey: 'argocd.argoproj.io/instance',
       controller: applicationController,
-      initialRepositories: '- url: ' + inv.parameters.cluster.catalog_url,
-      repositoryCredentials: if useHttpsCatalog then
-        |||
-          - url: %(catalog_url)s
-            usernameSecret:
-              name: %(secret)s
-              key: username
-            passwordSecret:
-              name: %(secret)s
-              key: password
-        ||| % {
-          catalog_url: inv.parameters.cluster.catalog_url,
-          secret: params.http_credentials_secret_name,
-        }
-      else
-        |||
-          - url: ssh://git@
-            sshPrivateKeySecret:
-              name: argo-ssh-key
-              key: sshPrivateKey
-        |||,
       initialSSHKnownHosts: {
         keys: |||
           bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==
@@ -395,8 +374,35 @@ local argocd(name) =
 
 local ssh_secret = kube._Object('v1', 'Secret', 'argo-ssh-key') {
   type: 'Opaque',
-};
+} + if !useHttpsCatalog then {
+  metadata+: {
+    labels+: {
+      'argocd.argoproj.io/secret-type': 'repo-creds',
+    },
+  },
+  stringData: {
+    // sshPrivateKey set by Steward -- should be safe with SSA for the ArgoCD
+    // app. For full safety we should update Steward to use SSA for this
+    // secret.
+    url: inv.parameters.cluster.catalog_url,
+  },
+} else {};
 
+local repo_secret = kube._Object('v1', 'Secret', 'cluster-catalog') {
+  type: 'Opaque',
+  metadata+: {
+    labels+: {
+      'argocd.argoproj.io/secret-type': 'repository',
+    },
+  },
+  stringData: {
+    type: 'git',
+    url: inv.parameters.cluster.catalog_url,
+    // creds always provided in a `repo-creds` secret. Externally managed
+    // https secrets must be updated to have label
+    // `argocd.argoproj.io/secret-type=repo-creds`
+  },
+};
 
 // Manually adding certificate for conversion webhook
 // as the upstream kustomize is broken.
@@ -511,6 +517,7 @@ local tls_refresh = [
   '00_vault_agent_config': vault_agent_config,
   '00_kapitan_plugin_config': kapitan_plugin_config,
   '00_ssh_secret': ssh_secret,
+  '00_repo_secret': repo_secret,
   '10_argocd': argocd('syn-argocd'),
   [if params.network_policies.enabled then '20_networkpolicy']: std.map(function(p) com.namespaced(params.namespace, p), import 'networkpolicy.libsonnet'),
   // Manually adding certificate for conversion webhook

diff --git a/docs/modules/ROOT/pages/how-tos/upgrade-v8-v9.adoc b/docs/modules/ROOT/pages/how-tos/upgrade-v8-v9.adoc
@@ -0,0 +1,23 @@
+= Upgrade `component-argocd` from `v8.x` to `v9.x`
+
+TIP: On clusters which use SSH to fetch the cluster catalogs no manual actions are necessary.
+
+The component version `v9.x` defaults to ArgoCD v3 which only supports https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#repositories[declarative configuration of repositories^].
+
+The switch to declarative repository configuration is a breaking change for clusters which use HTTPS cluster catalogs.
+
+Operators of such clusters must update the HTTPS credentials secret to be picked up as a repo credentials secret by ArgoCD v3:
+
+[source,bash]
+----
+SECRET_NAME=the-credentials-secret <1>
+
+CATALOG_URL=$(kubectl -n syn get cm argocd-cm -oyaml | \
+  yq '.data.repositories|from_yaml|.[0].url')
+
+kubectl -n syn patch secret "$SECRET_NAME" --type=merge \
+  -p '{"stringData":{"url":"'"$CATALOG_URL"'"}}'
+kubectl -n syn label secret "$SECRET_NAME" \
+  argocd.argoproj.io/secret-type=repo-creds
+----
+<1> Replace with the name of the secret
diff --git a/docs/modules/ROOT/pages/references/parameters.adoc b/docs/modules/ROOT/pages/references/parameters.adoc
@@ -128,11 +128,16 @@ Override specs of the ProjectSyn ArgoCD instance.
 type:: string
 default:: `catalog-https-credentials`
 
-The name of the externally managed secret which holds the username and password for fetching the catalog repo over HTTPS in fields `username` and `password`.
+The name of the externally managed secret which holds the username and password for fetching the catalog repo over HTTPS.
+
+The secret must be labeled with `argocd.argoproj.io/secret-type=repo-creds`.
+The secret must have the credentials in fields `username` and `password` and must have the catalog repo HTTPS URL (or a prefix thereof) in field `url`.
+
+NOTE: The `url` field must contain the catalog URL (or prefix) including the leading `https://`.
 
 This parameter is only used when the cluster's catalog repo URL starts with `https://`.
 
-IMPORTANT: Users must ensure that this secret is in place before this component is synced.
+IMPORTANT: Users must ensure that this secret is correctly configured and present before this component is synced.
 
 == `images`
 

diff --git a/docs/modules/ROOT/partials/nav.adoc b/docs/modules/ROOT/partials/nav.adoc
@@ -4,6 +4,7 @@
 * xref:how-tos/upgrade-v3-v4.adoc[Upgrade from `v3.x` to `v4.x`]
 * xref:how-tos/upgrade-v5-v6.adoc[Upgrade from `v5.5.x` to `v6.x`]
 * xref:how-tos/upgrade-v7-v8.adoc[Upgrade from `v7.x` to `v8.x`]
+* xref:how-tos/upgrade-v8-v9.adoc[]
 
 .References
 * xref:references/parameters.adoc[Parameters]
diff --git a/tests/golden/defaults/argocd/argocd/30_argocd/00_repo_secret.yaml b/tests/golden/defaults/argocd/argocd/30_argocd/00_repo_secret.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations: {}
+  labels:
+    argocd.argoproj.io/secret-type: repository
+    name: cluster-catalog
+  name: cluster-catalog
+stringData:
+  type: git
+  url: ssh://git@git.example.com/org/repo.git
+type: Opaque
diff --git a/tests/golden/defaults/argocd/argocd/30_argocd/00_ssh_secret.yaml b/tests/golden/defaults/argocd/argocd/30_argocd/00_ssh_secret.yaml
@@ -3,6 +3,9 @@ kind: Secret
 metadata:
   annotations: {}
   labels:
+    argocd.argoproj.io/secret-type: repo-creds
     name: argo-ssh-key
   name: argo-ssh-key
+stringData:
+  url: ssh://git@git.example.com/org/repo.git
 type: Opaque
diff --git a/tests/golden/defaults/argocd/argocd/30_argocd/10_argocd.yaml b/tests/golden/defaults/argocd/argocd/30_argocd/10_argocd.yaml
@@ -27,7 +27,6 @@ spec:
       "operators.coreos.com/Subscription":
         "health.lua.useOpenLibs": true
   image: quay.io/argoproj/argocd
-  initialRepositories: '- url: ssh://git@git.example.com/org/repo.git'
   initialSSHKnownHosts:
     keys: |
       bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==
@@ -138,11 +137,6 @@ spec:
       - configMap:
           name: kapitan-plugin-config
         name: kapitan-plugin-config
-  repositoryCredentials: |
-    - url: ssh://git@
-      sshPrivateKeySecret:
-        name: argo-ssh-key
-        key: sshPrivateKey
   resourceExclusions: |-
     - "apiGroups":
       - "cilium.io"

diff --git a/tests/golden/https-catalog/argocd/argocd/30_argocd/00_repo_secret.yaml b/tests/golden/https-catalog/argocd/argocd/30_argocd/00_repo_secret.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations: {}
+  labels:
+    argocd.argoproj.io/secret-type: repository
+    name: cluster-catalog
+  name: cluster-catalog
+stringData:
+  type: git
+  url: https://git.example.com/cluster-catalog.git
+type: Opaque
diff --git a/tests/golden/https-catalog/argocd/argocd/30_argocd/10_argocd.yaml b/tests/golden/https-catalog/argocd/argocd/30_argocd/10_argocd.yaml
@@ -27,7 +27,6 @@ spec:
       "operators.coreos.com/Subscription":
         "health.lua.useOpenLibs": true
   image: quay.io/argoproj/argocd
-  initialRepositories: '- url: https://git.example.com/cluster-catalog.git'
   initialSSHKnownHosts:
     keys: |
       bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==
@@ -138,14 +137,6 @@ spec:
       - configMap:
           name: kapitan-plugin-config
         name: kapitan-plugin-config
-  repositoryCredentials: |
-    - url: https://git.example.com/cluster-catalog.git
-      usernameSecret:
-        name: catalog-http-credentials
-        key: username
-      passwordSecret:
-        name: catalog-http-credentials
-        key: password
   resourceExclusions: |-
     - "apiGroups":
       - "cilium.io"

diff --git a/tests/golden/openshift/argocd/argocd/30_argocd/00_repo_secret.yaml b/tests/golden/openshift/argocd/argocd/30_argocd/00_repo_secret.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations: {}
+  labels:
+    argocd.argoproj.io/secret-type: repository
+    name: cluster-catalog
+  name: cluster-catalog
+stringData:
+  type: git
+  url: ssh://git@git.example.com/org/repo.git
+type: Opaque
diff --git a/tests/golden/openshift/argocd/argocd/30_argocd/00_ssh_secret.yaml b/tests/golden/openshift/argocd/argocd/30_argocd/00_ssh_secret.yaml
@@ -3,6 +3,9 @@ kind: Secret
 metadata:
   annotations: {}
   labels:
+    argocd.argoproj.io/secret-type: repo-creds
     name: argo-ssh-key
   name: argo-ssh-key
+stringData:
+  url: ssh://git@git.example.com/org/repo.git
 type: Opaque
diff --git a/tests/golden/openshift/argocd/argocd/30_argocd/10_argocd.yaml b/tests/golden/openshift/argocd/argocd/30_argocd/10_argocd.yaml
@@ -27,7 +27,6 @@ spec:
       "operators.coreos.com/Subscription":
         "health.lua.useOpenLibs": true
   image: quay.io/argoproj/argocd
-  initialRepositories: '- url: ssh://git@git.example.com/org/repo.git'
   initialSSHKnownHosts:
     keys: |
       bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==
@@ -141,11 +140,6 @@ spec:
       - configMap:
           name: kapitan-plugin-config
         name: kapitan-plugin-config
-  repositoryCredentials: |
-    - url: ssh://git@
-      sshPrivateKeySecret:
-        name: argo-ssh-key
-        key: sshPrivateKey
   resourceExclusions: |-
     - "apiGroups":
       - "cilium.io"

diff --git a/tests/golden/params/argocd/argocd/30_argocd/00_repo_secret.yaml b/tests/golden/params/argocd/argocd/30_argocd/00_repo_secret.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations: {}
+  labels:
+    argocd.argoproj.io/secret-type: repository
+    name: cluster-catalog
+  name: cluster-catalog
+stringData:
+  type: git
+  url: ssh://git@git.example.com/org/repo.git
+type: Opaque
diff --git a/tests/golden/params/argocd/argocd/30_argocd/00_ssh_secret.yaml b/tests/golden/params/argocd/argocd/30_argocd/00_ssh_secret.yaml
@@ -3,6 +3,9 @@ kind: Secret
 metadata:
   annotations: {}
   labels:
+    argocd.argoproj.io/secret-type: repo-creds
     name: argo-ssh-key
   name: argo-ssh-key
+stringData:
+  url: ssh://git@git.example.com/org/repo.git
 type: Opaque
diff --git a/tests/golden/params/argocd/argocd/30_argocd/10_argocd.yaml b/tests/golden/params/argocd/argocd/30_argocd/10_argocd.yaml
@@ -21,7 +21,6 @@ spec:
       "operators.coreos.com/Subscription":
         "health.lua.useOpenLibs": true
   image: quay.io/argoproj/argocd
-  initialRepositories: '- url: ssh://git@git.example.com/org/repo.git'
   initialSSHKnownHosts:
     keys: |
       bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==
@@ -117,11 +116,6 @@ spec:
       - configMap:
           name: kapitan-plugin-config
         name: kapitan-plugin-config
-  repositoryCredentials: |
-    - url: ssh://git@
-      sshPrivateKeySecret:
-        name: argo-ssh-key
-        key: sshPrivateKey
   resourceExclusions: |-
     - "apiGroups":
       - "cilium.io"

diff --git a/tests/golden/prometheus/argocd/argocd/30_argocd/00_repo_secret.yaml b/tests/golden/prometheus/argocd/argocd/30_argocd/00_repo_secret.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations: {}
+  labels:
+    argocd.argoproj.io/secret-type: repository
+    name: cluster-catalog
+  name: cluster-catalog
+stringData:
+  type: git
+  url: ssh://git@git.example.com/org/repo.git
+type: Opaque
diff --git a/tests/golden/prometheus/argocd/argocd/30_argocd/00_ssh_secret.yaml b/tests/golden/prometheus/argocd/argocd/30_argocd/00_ssh_secret.yaml
@@ -3,6 +3,9 @@ kind: Secret
 metadata:
   annotations: {}
   labels:
+    argocd.argoproj.io/secret-type: repo-creds
     name: argo-ssh-key
   name: argo-ssh-key
+stringData:
+  url: ssh://git@git.example.com/org/repo.git
 type: Opaque
diff --git a/tests/golden/prometheus/argocd/argocd/30_argocd/10_argocd.yaml b/tests/golden/prometheus/argocd/argocd/30_argocd/10_argocd.yaml
@@ -27,7 +27,6 @@ spec:
       "operators.coreos.com/Subscription":
         "health.lua.useOpenLibs": true
   image: quay.io/argoproj/argocd
-  initialRepositories: '- url: ssh://git@git.example.com/org/repo.git'
   initialSSHKnownHosts:
     keys: |
       bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==
@@ -138,11 +137,6 @@ spec:
       - configMap:
           name: kapitan-plugin-config
         name: kapitan-plugin-config
-  repositoryCredentials: |
-    - url: ssh://git@
-      sshPrivateKeySecret:
-        name: argo-ssh-key
-        key: sshPrivateKey
   resourceExclusions: |-
     - "apiGroups":
       - "cilium.io"

diff --git a/tests/golden/syn-teams/argocd/argocd/30_argocd/00_repo_secret.yaml b/tests/golden/syn-teams/argocd/argocd/30_argocd/00_repo_secret.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations: {}
+  labels:
+    argocd.argoproj.io/secret-type: repository
+    name: cluster-catalog
+  name: cluster-catalog
+stringData:
+  type: git
+  url: ssh://git@git.example.com/org/repo.git
+type: Opaque
diff --git a/tests/golden/syn-teams/argocd/argocd/30_argocd/00_ssh_secret.yaml b/tests/golden/syn-teams/argocd/argocd/30_argocd/00_ssh_secret.yaml
@@ -3,6 +3,9 @@ kind: Secret
 metadata:
   annotations: {}
   labels:
+    argocd.argoproj.io/secret-type: repo-creds
     name: argo-ssh-key
   name: argo-ssh-key
+stringData:
+  url: ssh://git@git.example.com/org/repo.git
 type: Opaque
diff --git a/tests/golden/syn-teams/argocd/argocd/30_argocd/10_argocd.yaml b/tests/golden/syn-teams/argocd/argocd/30_argocd/10_argocd.yaml
@@ -27,7 +27,6 @@ spec:
       "operators.coreos.com/Subscription":
         "health.lua.useOpenLibs": true
   image: quay.io/argoproj/argocd
-  initialRepositories: '- url: ssh://git@git.example.com/org/repo.git'
   initialSSHKnownHosts:
     keys: |
       bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==
@@ -138,11 +137,6 @@ spec:
       - configMap:
           name: kapitan-plugin-config
         name: kapitan-plugin-config
-  repositoryCredentials: |
-    - url: ssh://git@
-      sshPrivateKeySecret:
-        name: argo-ssh-key
-        key: sshPrivateKey
   resourceExclusions: |-
     - "apiGroups":
       - "cilium.io"