ArgoCD can not authenticate to Azure DevOps SERVER

Question

ArgoCD can not authenticate to Azure DevOps SERVER

Andres Colodrero 0

HI,

I succesfully connected an ArgoCD instance to a azure devops services repo (dev.azure.com).

Now i cant not connect an ArgoCD instance to our internal Azure DevOPS server.

IM running Azure DevOps Server 2022.0.1 RC1.

Steps:

Add a repo in ArgoCD, type "git", URL: https://tfs.internal.com/projectname/_git/reponame.
Select username: something, password: token.
i tried TLS and skip tls.

Connection seems ok on ArgoCD (i guess it is just a basic ping), but when trying to connect to a new application:

Unable to create application: application spec for s is invalid: InvalidSpecError: Unable to generate manifests in app/: rpc error: code = Unknown desc = failed to initialize repository resources: rpc error: code = Internal desc = Failed to fetch default: git fetch origin --tags --force --prune failed exit status 128: fatal: Authentication failed for 'https://tfs.internal.com/projectname/_git/reponame/

token is full admin for testing
same token works for other applications (like linux git)

is there a limitation?

Siddhesh Desai 2,960 Reputation points Microsoft External Staff Moderator

2026-01-16T09:56:42.5266667+00:00
Hi @Andres Colodrero

Thank you for reaching out to Microsoft Q&A.

ArgoCD does not natively support NTLM/Kerberos.

If your Azure DevOps Server is behind a proxy or uses self-signed certs, you must configure ArgoCD with --insecure or provide the CA bundle.

Git LFS or custom authentication extensions are not supported out-of-the-box.

Inorder to configure ArgoCD with Azure DevOps Server (on-prem) for GitOps, Refer the steps below:

Add the Repo in ArgoCD

In ArgoCD UI or CLI:

argocd repo add https://tfs.internal.com/DefaultCollection/projectname/_git/reponame \ --username PAT \ --password <your-PAT> \ --insecure-ignore-host-key

Handle TLS Certificates

If using self-signed certs:

Export your internal CA cert.

Mount it into the ArgoCD repo-server pod.

Configure:

argocd repo add <repo-url> --tls-ca-cert /path/to/ca.crt

Disable Git Credential Helpers

Inside the ArgoCD repo-server container:

git config --global credential.helper ""

Validate Connectivity

kubectl exec -it <repo-server-pod> -- git ls-remote https://tfs.internal.com/DefaultCollection/projectname/_git/reponame

Create the Application

argocd app create my-app \ --repo https://tfs.internal.com/DefaultCollection/projectname/_git/reponame \ --path app/ \ --dest-server https://kubernetes.default.svc \ --dest-namespace default

Optional: Use SSH Instead of HTTPS

Configure SSH keys in Azure DevOps Server.

Add the private key to ArgoCD

argocd repo add ******@tfs.internal.com:projectname/reponame.git --ssh-private-key-path /path/to/key

1 answer

Your answer

Siddhesh Desai 2,960 Reputation points Microsoft External Staff Moderator

2026-01-16T09:56:42.5266667+00:00

Hi @Andres Colodrero

Thank you for reaching out to Microsoft Q&A.

ArgoCD does not natively support NTLM/Kerberos.

If your Azure DevOps Server is behind a proxy or uses self-signed certs, you must configure ArgoCD with --insecure or provide the CA bundle.

Git LFS or custom authentication extensions are not supported out-of-the-box.

Inorder to configure ArgoCD with Azure DevOps Server (on-prem) for GitOps, Refer the steps below:

Add the Repo in ArgoCD

In ArgoCD UI or CLI:

argocd repo add https://tfs.internal.com/DefaultCollection/projectname/_git/reponame \ --username PAT \ --password <your-PAT> \ --insecure-ignore-host-key

Handle TLS Certificates

If using self-signed certs:

Export your internal CA cert.

Mount it into the ArgoCD repo-server pod.

Configure:

argocd repo add <repo-url> --tls-ca-cert /path/to/ca.crt

Disable Git Credential Helpers

Inside the ArgoCD repo-server container:

git config --global credential.helper ""

Validate Connectivity

kubectl exec -it <repo-server-pod> -- git ls-remote https://tfs.internal.com/DefaultCollection/projectname/_git/reponame

Create the Application

argocd app create my-app \ --repo https://tfs.internal.com/DefaultCollection/projectname/_git/reponame \ --path app/ \ --dest-server https://kubernetes.default.svc \ --dest-namespace default

Optional: Use SSH Instead of HTTPS

Configure SSH keys in Azure DevOps Server.

Add the private key to ArgoCD

argocd repo add ******@tfs.internal.com:projectname/reponame.git --ssh-private-key-path /path/to/key

Answer 1

It seems that you are experiencing an authentication issue when trying to connect ArgoCD to your internal Azure DevOps Server. Here are some troubleshooting steps and considerations that might help you resolve the issue:

Token Permissions: Ensure that the token you are using has the necessary permissions for the repository you are trying to access. Even if the token is an admin token, double-check that it is set up correctly in Azure DevOps Server.
URL Format: Verify that the URL you are using is correct and accessible from the ArgoCD instance. The format should typically be https://tfs.internal.com/projectname/_git/reponame.
Authentication Method: Since you mentioned using a username and token, ensure that the username is not empty and that the token is being used correctly. You might want to try using a Personal Access Token (PAT) if you are not already doing so.
TLS Settings: If you are having issues with TLS, ensure that your ArgoCD instance can properly validate the TLS certificate of your Azure DevOps Server. If you are using a self-signed certificate, you might need to configure ArgoCD to trust it.
Git Configuration: Check your Git configuration on the ArgoCD instance. You can manually approve the credentials using the command git credential approve https://tfs.internal.com/projectname/_git/reponame to ensure they are stored correctly.
Logs and Error Messages: Review the logs from ArgoCD for any additional error messages that might provide more context on the failure. The error message you provided indicates an authentication failure, which could be due to incorrect credentials or configuration.

If you continue to face issues, consider checking the Azure DevOps Server documentation for any specific settings or limitations that may apply to your version.

References:

Share via

ArgoCD can not authenticate to Azure DevOps SERVER

1 answer

Your answer