Harness GitOps Agent with self-signed certificates

This topic describes how to install and configure Harness GitOps Agent to connect to Harness with self-signed certificates.

Harness supports self-signed certificates. This topic describes how to install and configure a Harness GitOps Agent to connect to Harness using self-signed certificates.

In this topic, you will do the following:

• Create a Kubernetes secret with your certificates.

• Configure the GitOps Agent to use the custom certificates.

Create the secret

Create a Kubernetes secret containing your self-signed certificates in the same namespace where the GitOps Agent is installed.

1. Copy the following YAML to your editor.

   apiVersion: v1  
   kind: Secret  
   metadata:  
     name: addcerts  
     namespace: {agent-namespace}  
   type: Opaque  
   stringData:                             
     ca.bundle: |  
       -----BEGIN CERTIFICATE-----  
       XXXXXXXXXXXXXXXXXXXXXXXXXXX  
       -----END CERTIFICATE-----  
       -----BEGIN CERTIFICATE-----  
       XXXXXXXXXXXXXXXXXXXXXXXXXXX  
       -----END CERTIFICATE-----

2. Replace {agent-namespace} with the namespace where your GitOps Agent is installed.

3. Add your certificates to the ca.bundle field.

   The XXXXXXXXXXXXXXXXXXXXXXXXXXX placeholder indicates the position for the certificate body. Enclose each certificate between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers.

   Certificates must be in PEM format. You can include multiple certificates by adding additional certificate blocks.

   Here is one way to get the certificate using openssl:

   openssl s_client -servername NAME -connect HOST:PORT

   For example, to get the certificate for app.harness.io:

   openssl s_client -servername app.harness.io -connect app.harness.io:443

4. Save the file as addcerts.yaml, then apply the manifest to your cluster.

   kubectl apply -f addcerts.yaml -n {agent-namespace}

Configure the GitOps Agent

Configure the GitOps Agent to mount and use the custom certificates based on your installation method.

Kubernetes manifests

To configure a GitOps Agent installed with Kubernetes manifests to use custom certificates, do the following:

1. Open the gitops-agent.yml file in your editor.

2. In the {GitopsAgentName}-agent ConfigMap, set the value of GITOPS_SERVICE_HTTP_TLS_ENABLED config to true.

3. Save and apply the modified manifest.

   kubectl apply -f gitops-agent.yml -n {agent-namespace}

Helm chart

To configure a GitOps Agent installed with Helm to use custom certificates, do the following:

1. Modify the values.yaml file and add the volumes and volumeMounts section to the agent field.

   agent:
     volumeMounts:
     - mountPath: /tmp/ca.bundle
       name: certs-vol
     volumes:
     - name: certs-vol
       secret:
         secretName: addcerts
         optional: true
         items:
           - key: ca.bundle
             path: ca.bundle

2. Set the GITOPS_SERVICE_HTTP_TLS_ENABLED flag to true by setting the harness.configMap.http.tlsEnabled option in the values.yaml file to true.

   harness:
     nameOverride: harness
     configMap:
       http:
         tlsEnabled: true
         certPath: "/tmp/ca.bundle"

3. If certificates are required to be mounted onto the Argo CD Repo Server and Application Controller, add the following configurations in the values.yaml file.

   Repo Server:

   repoServer:
     name: repo-server
     serviceAccount:
       create: true
     volumeMounts:
     - mountPath: /tmp/ca.bundle
       name: certs-vol
     volumes:
     - name: certs-vol
       secret:
         secretName: addcerts
         optional: true
         items:
           - key: ca.bundle
             path: ca.bundle

   Application Controller:

   controller:
     name: application-controller
     serviceAccount:
       create: true
     volumeMounts:
     - mountPath: /tmp/ca.bundle
       name: certs-vol
     volumes:
     - name: certs-vol
       secret:
         secretName: addcerts
         optional: true
         items:
           - key: ca.bundle
             path: ca.bundle

4. Apply the Helm chart with the updated values.

   helm upgrade --install gitops-agent harness/gitops-agent -n {agent-namespace} -f values.yaml

Verify certificate configuration

After configuring the GitOps Agent with self-signed certificates, verify that the certificate is properly mounted and the agent can connect to Harness.

1. Check if the agent pod is running.

   kubectl get pods -n {agent-namespace} -l app.kubernetes.io/name=gitops-agent

2. Verify the certificate file is mounted in the agent pod.

   kubectl exec -it <agent-pod-name> -n {agent-namespace} -- ls -la /tmp/ca.bundle

   You should see the certificate file at /tmp/ca.bundle.

3. Check the agent logs to confirm TLS is enabled and the certificate is being used.

   kubectl logs <agent-pod-name> -n {agent-namespace} | grep -i "tls\|cert"

   Look for log entries indicating that TLS is enabled and certificates are loaded.

4. Verify the agent is connected in the Harness UI.

   Go to GitOps → Settings → GitOps Agents and confirm that your agent shows a Connected status.

Troubleshooting

If the agent fails to start, check the logs with kubectl logs <agent-pod-name> -n {agent-namespace}.

Common issues:

• Certificate file not found at /tmp/ca.bundle - verify volume mount with kubectl describe pod

• Secret addcerts missing - check with kubectl get secret

• tlsEnabled not set to true - verify ConfigMap

• Invalid certificate format - ensure certificates are in PEM format with proper BEGIN/END markers