Using Google Artifact Registry Helm/OCI Repositories with Argo CD via Workload Identity

Argo CD's built-in Workload Identity support (via gcpServiceAccountKey on a repository secret) authenticates Git repository credentials natively. That same mechanism does not extend to Helm or OCI registries; registering a Helm repo under Settings → Repositories with Workload Identity alone will not authenticate against a private Google Artifact Registry (GAR) Helm/OCI repo, and pulls will fail with an unauthenticated error even after granting the service account Artifact Registry permissions.

For OCI-based GAR repositories specifically, it's possible to work around this by patching the argocd-repo-server deployment so it fetches short-lived GAR credentials via docker-credential-gcr at startup, using the repo-server's own Workload Identity binding. On Akuity, this is applied as a Kustomization patch in the cluster's Advanced Settings → Kustomization field on Akuity UI:

1. Bind the argocd-repo-server Kubernetes service account to the GCP service account with Artifact Registry read access, via the Workload Identity annotation.
2. Add an initContainer to the argocd-repo-server deployment that downloads docker-credential-gcr and writes a Docker config authenticated for Artifact Registry to a shared volume.
3. Mount that Docker config into the argocd-repo-server container so the OCI client can use it to authenticate.

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

patches:
  # 1. Bind the repo-server to the GCP SA (Workload Identity)
  - patch: |-
      apiVersion: v1
      kind: ServiceAccount
      metadata:
        name: argocd-repo-server
        annotations:
          iam.gke.io/gcp-service-account: REPLACE_GSA_EMAIL@REPLACE_PROJECT.iam.gserviceaccount.com
    target:
      kind: ServiceAccount
      name: argocd-repo-server

  - patch: |-
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: argocd-repo-server
      spec:
        template:
          spec:
            initContainers:
            - name: download-tools
              image: alpine:3
              command: [sh, -c]
              args:
              - |
                cd /var/run/docker-credential-gcr
                wget -qO - https://github.com/GoogleCloudPlatform/docker-credential-gcr/releases/download/v2.1.8/docker-credential-gcr_linux_amd64-2.1.8.tar.gz | tar xz
                PATH=.:$PATH HOME=/var/run/config docker-credential-gcr configure-docker --include-artifact-registry
                chmod +r /var/run/config/.docker/config.json
              volumeMounts:
              - mountPath: /var/run/docker-credential-gcr
                name: docker-credential-gcr
              - mountPath: /var/run/config/.docker
                name: docker-config
            containers:
            - name: argocd-repo-server
              volumeMounts:
              - mountPath: /usr/local/bin/docker-credential-gcr
                name: docker-credential-gcr
                subPath: docker-credential-gcr
                readOnly: true
              - mountPath: /home/argocd/.docker
                name: docker-config
                readOnly: true
            volumes:
            - emptyDir: {}
              name: docker-credential-gcr
            - emptyDir: {}
              name: docker-config
    target:
      kind: Deployment
      name: argocd-repo-server

Please refer to Agent Advanced Settings → Kustomization for how to apply cluster-level Kustomization patches on Akuity.