argo-cd: v2.4.0-rc5 plz. update documentation about repo-creds (ssh rsa keys can no longer be used to access git repo)

OK. After Lots of testing and playing around with Azure DevOps git repositories I finally figured out exactly what needs to be done to make this work. I am adding here a bunch of my info you may move it to the Docsa if you wish but this may help others if they find this issue and do not understand how to fix it. This is not the only way to accomplish it but it was the easiest way to accomplish it.

Basically even though Azure DevOps has added support for ssh-rsa-2 they do not really talk it. Azure DevOPS will only ever offer rsa-ssh for git communications. If you use ssh access for Azure DevOps you have to add these items below to your configurations.

Articles of Interest I found:

• Stackoverflow on Azure DevOps rsa-sha
• MS Announcement on SHA-2 support
• MS Docs Github on SSH

First I created a configmap that contains the information that is needed in the ssh_config that will be mounted, it also contains the default information that should already be in that file. Then in my kustomization file I added a couple of patches to add this mount to not only the repo-server but also the applicationset controller (needs it for the git generator).

repo-server-ssh-cm.yaml:

apiVersion: v1
kind: ConfigMap
metadata:
  name: repo-server-ssh-cm
data:
  ssh_config: |
    Include /etc/ssh/ssh_config.d/*.conf
    Host *
      SendEnv LANG LC_*
      HashKnownHosts yes
      GSSAPIAuthentication yes

    HOST vs-ssh.visualstudio.com
      HostkeyAlgorithms +ssh-rsa
      PubkeyAcceptedAlgorithms +ssh-rsa

kustomization.yaml:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
- repo-server-ssh-cm.yaml
# base Argo CD components
- https://raw.githubusercontent.com/argoproj/argo-cd/v2.4.0-rc5/manifests/install.yaml

patches:
- patch: |-
    - op: add
      path: /spec/template/spec/containers/0/volumeMounts/-
      value:
        name: config-volume
        mountPath: /etc/ssh/ssh_config
        subPath: ssh_config
    - op: add
      path: /spec/template/spec/volumes/-
      value:
        name: config-volume
        configMap:
          name: repo-server-ssh-cm
  target:
    kind: Deployment
    name: argocd-repo-server

- patch: |-
    - op: add
      path: /spec/template/spec/containers/0/volumeMounts/-
      value:
        name: config-volume
        mountPath: /etc/ssh/ssh_config
        subPath: ssh_config
    - op: add
      path: /spec/template/spec/volumes/-
      value:
        name: config-volume
        configMap:
          name: repo-server-ssh-cm
  target:
    kind: Deployment
    name: argocd-applicationset-controller

Yes you can. That is why I put it here. Here is my updated version based on adding the config to the argocd user rather than the root one.

repo-server-ssh-cm.yaml:

apiVersion: v1
kind: ConfigMap
metadata:
  name: repo-server-ssh-cm
data:
  config: |
    HOST vs-ssh.visualstudio.com
      HostkeyAlgorithms +ssh-rsa
      PubkeyAcceptedAlgorithms +ssh-rsa

kustomization.yaml:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
- repo-server-ssh-cm.yaml
# base Argo CD components
- https://raw.githubusercontent.com/argoproj/argo-cd/v2.4.0-rc5/manifests/install.yaml

patches:
- patch: |-
    - op: add
      path: /spec/template/spec/containers/0/volumeMounts/-
      value:
        name: config-volume
        mountPath: /home/argocd/.ssh/config
        subPath: config
    - op: add
      path: /spec/template/spec/volumes/-
      value:
        name: config-volume
        configMap:
          name: repo-server-ssh-cm
  target:
    kind: Deployment
    name: argocd-repo-server

- patch: |-
    - op: add
      path: /spec/template/spec/containers/0/volumeMounts/-
      value:
        name: config-volume
        mountPath: /home/argocd/.ssh/config
        subPath: config
    - op: add
      path: /spec/template/spec/volumes/-
      value:
        name: config-volume
        configMap:
          name: repo-server-ssh-cm
  target:
    kind: Deployment
    name: argocd-applicationset-controller

@34fathombelow Did not even think about that. But I did just test it and it does work also. I can update the above examples with that if you wish me to.

new key was created as ecdsa

ssh-keygen -t ecdsa -C argocd-ssh-git-creds

and then used again in a secret like [1] in https://github.com/argoproj/argo-cd/issues/9598#issue-1263497264