Argo CD "failed to get git client ... authentication required" in CI

Argo CD renders manifests by cloning your Git repo from the repo-server. When it has no valid credentials for a private repo, the clone fails with authentication required and the Application cannot compute manifests at all.

What this error means

The Application shows a ComparisonError with "rpc error: code = Unknown desc = failed to get git client for repo <url>: ... authentication required", and no manifests are generated.

rpc error: code = Unknown desc = failed to get git client for repo
https://github.com/acme/manifests: authentication required: Repository not found

Common causes

No repository credential is registered

The private repo was added without credentials, or the credential secret was never created, so the repo-server clones anonymously and is rejected.

The token or deploy key expired or lost access

A rotated PAT, a revoked deploy key, or a removed machine user makes previously working credentials invalid.

How to fix it

Register repo credentials with the CLI

1. Add the repo with a valid token or SSH key so the repo-server can clone it.
2. Confirm the credential principal has read access to that repository.
3. Hard-refresh the app so it re-clones with the new credentials.

argocd repo add https://github.com/acme/manifests \
  --username git --password "$GIT_TOKEN"
argocd app get my-app --hard-refresh

Store credentials as a repository secret

Argo CD reads repo credentials from labeled secrets; use a repo-creds template so all matching repos share one credential.

apiVersion: v1
kind: Secret
metadata:
  labels:
    argocd.argoproj.io/secret-type: repository
stringData:
  url: https://github.com/acme/manifests
  password: <token>
  username: git

How to prevent it

• Register private repos with credentials, not anonymously.
• Rotate tokens and update the repository secret in one place.
• Grant the credential principal read access to every managed repo.

Related guides