Argo CD "failed to get git client ... authentication required" in CI

By Kaveh Alemi·Latchkey

Argo CD renders manifests by cloning your Git repo from the repo-server. When it has no valid credentials for a private repo, the clone fails with authentication required and the Application cannot compute manifests at all.

What this error means

The Application shows a ComparisonError with "rpc error: code = Unknown desc = failed to get git client for repo <url>: ... authentication required", and no manifests are generated.

argocd

rpc error: code = Unknown desc = failed to get git client for repo
https://github.com/acme/manifests: authentication required: Repository not found

Common causes

No repository credential is registered

The private repo was added without credentials, or the credential secret was never created, so the repo-server clones anonymously and is rejected.

The token or deploy key expired or lost access

A rotated PAT, a revoked deploy key, or a removed machine user makes previously working credentials invalid.

How to fix it

Register repo credentials with the CLI

Add the repo with a valid token or SSH key so the repo-server can clone it.
Confirm the credential principal has read access to that repository.
Hard-refresh the app so it re-clones with the new credentials.

Terminal

argocd repo add https://github.com/acme/manifests \
  --username git --password "$GIT_TOKEN"
argocd app get my-app --hard-refresh

Store credentials as a repository secret

Argo CD reads repo credentials from labeled secrets; use a repo-creds template so all matching repos share one credential.

repo-secret.yaml

apiVersion: v1
kind: Secret
metadata:
  labels:
    argocd.argoproj.io/secret-type: repository
stringData:
  url: https://github.com/acme/manifests
  password: <token>
  username: git

How to prevent it

Register private repos with credentials, not anonymously.
Rotate tokens and update the repository secret in one place.
Grant the credential principal read access to every managed repo.

Frequently asked questions

What causes ""failed to get git client ... authentication required""?