[EKS] ArgoCD + CodeConnections: cross-repo Kustomize remote components return 403
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
## Summary
We use ArgoCD (deployed via the EKS capability) with private GitLab repositories connected through AWS CodeConnections. We're trying to centralize shared Kustomize components into a dedicated repository and reference them as remote components from consumer repos.
## What we confirmed works
Referencing a remote component **within the same repository** via a CodeConnections URL works correctly:
```yaml
# kustomization.yaml
components:
- https://codeconnections..amazonaws.com/git-http////gitops/k8s-gitops-platform-apps.git//apps/_components/some-component?ref=main
```
ArgoCD can resolve this without errors.
## What fails
Referencing a component from a **separate** repository (a dedicated `kustomize-components` repo) via the same CodeConnections pattern returns HTTP 403:
```yaml
components:
- https://codeconnections..amazonaws.com/git-http////gitops/kustomize-components.git//components/some-component?ref=main
```
**Error from ArgoCD:**
```
Failed to load target state: failed to generate manifest for source 1 of 1:
rpc error: code = Unknown desc = `kustomize build ` failed exit status 1:
Error: accumulating components: loader.New "failed to run
'/usr/bin/git fetch --depth=1
https://codeconnections..amazonaws.com/git-http////gitops/kustomize-components.git main':
fatal: unable to access '...kustomize-components.git/':
The requested URL returned error: 403": exit status 128
```
## Setup
- ArgoCD deployed via **EKS capability** (managed ArgoCD on EKS)
- Source repos: private GitLab, connected via **AWS CodeConnections**
- The `kustomize-components` repository is in the same GitLab group and uses the **same CodeConnections connection**
- The repo is added to `spec.sourceRepos` in the ArgoCD AppProject
## Question
Is cross-repo Kustomize remote component fetching supported when ArgoCD uses CodeConnections-backed credentials?
It appears the CodeConnections credential/token that ArgoCD uses for the consumer repo is **not reused or available** when `kustomize build` internally runs `git fetch` against the second (component) repository. Is this a known limitation? Is there a supported way to configure this?
Any guidance on whether this pattern is on the roadmap or if there is a workaround would be appreciated.
Contributor guide
Research direction
Review the EKS capability's managed ArgoCD setup, the kustomization.yaml remote component examples, and the AppProject spec.sourceRepos configuration. Compare the working same-repository reference with the failing cross-repository CodeConnections URL and its 403 error. Done means determining whether cross-repository fetching is supported and documenting a supported configuration, workaround, or limitation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, git, kubernetes
- Domain
- cloud, devops
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100