aws / aws/containers-roadmap

[EKS] ArgoCD + CodeConnections: cross-repo Kustomize remote components return 403

Open
#2,806 0 comments 2 reactions 0 assignees View on GitHub
EKS EKS Capabilities
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

## Summary

We use ArgoCD (deployed via the EKS capability) with private GitLab repositories connected through AWS CodeConnections. We're trying to centralize shared Kustomize components into a dedicated repository and reference them as remote components from consumer repos.

## What we confirmed works

Referencing a remote component **within the same repository** via a CodeConnections URL works correctly:

```yaml
# kustomization.yaml
components:
- https://codeconnections..amazonaws.com/git-http////gitops/k8s-gitops-platform-apps.git//apps/_components/some-component?ref=main
```

ArgoCD can resolve this without errors.

## What fails

Referencing a component from a **separate** repository (a dedicated `kustomize-components` repo) via the same CodeConnections pattern returns HTTP 403:

```yaml
components:
- https://codeconnections..amazonaws.com/git-http////gitops/kustomize-components.git//components/some-component?ref=main
```

**Error from ArgoCD:**

```
Failed to load target state: failed to generate manifest for source 1 of 1:
rpc error: code = Unknown desc = `kustomize build ` failed exit status 1:
Error: accumulating components: loader.New "failed to run
'/usr/bin/git fetch --depth=1
https://codeconnections..amazonaws.com/git-http////gitops/kustomize-components.git main':
fatal: unable to access '...kustomize-components.git/':
The requested URL returned error: 403": exit status 128
```

## Setup

- ArgoCD deployed via **EKS capability** (managed ArgoCD on EKS)
- Source repos: private GitLab, connected via **AWS CodeConnections**
- The `kustomize-components` repository is in the same GitLab group and uses the **same CodeConnections connection**
- The repo is added to `spec.sourceRepos` in the ArgoCD AppProject

## Question

Is cross-repo Kustomize remote component fetching supported when ArgoCD uses CodeConnections-backed credentials?

It appears the CodeConnections credential/token that ArgoCD uses for the consumer repo is **not reused or available** when `kustomize build` internally runs `git fetch` against the second (component) repository. Is this a known limitation? Is there a supported way to configure this?

Any guidance on whether this pattern is on the roadmap or if there is a workaround would be appreciated.

Contributor guide

Open the contributing guide

Research direction

Review the EKS capability's managed ArgoCD setup, the kustomization.yaml remote component examples, and the AppProject spec.sourceRepos configuration. Compare the working same-repository reference with the failing cross-repository CodeConnections URL and its 403 error. Done means determining whether cross-repository fetching is supported and documenting a supported configuration, workaround, or limitation.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, git, kubernetes
Domain
cloud, devops
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.