Access Private Git Repos from EKS with AWS CodeConnections

Organizations using GitOps on Amazon EKS often need to pull manifests from private Git repositories. This post guides users through using AWS CodeConnections to securely connect Argo CD capability to these private repositories, overcoming limitations in direct network access.

The architecture involves an Amazon EKS cluster with Argo CD, accessing private Git repositories via an AWS CodeConnections host deployed within the VPC. This host has private network connectivity to the Git server, enabling a secure GitOps pipeline that synchronizes configurations to EKS.

The walkthrough covers creating an AWS CodeConnections host in a VPC, which acts as a Git proxy. It supports GitHub Enterprise Server and self-managed GitLab. Prerequisites include an AWS account, an EKS cluster with Argo CD, AWS CLI, kubectl, and access to a private Git server.

Steps include setting environment variables, configuring VPC subnets for connectivity and DNS, creating security group rules, and defining the host VPC configuration. The process involves creating the host, setting up the connection through redirection to the Git endpoint, and completing the guided setup until the connection status is 'Available'.

Users are guided to create a sample Argo CD application manifest that points to their private Git repository using a specific CodeConnections Git HTTP proxy format. Applying this manifest to the EKS cluster with Argo CD enables the deployment and synchronization of applications from private repositories.

AWS CodeConnections uses cross-account elastic network interfaces (ENIs) within the VPC to connect to private Git servers. A CodeConnections host installs an AWS Connector app on the repository, which obtains temporary credentials for secure interactions. Argo CD utilizes IAM roles for authentication to access these connections.