> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/continuous-delivery/use-gitops/gitops-entities/agents/harness-git-ops-agent-with-self-signed-certificates.md).

# Harness GitOps Agent with self-signed certificates

This topic describes how to install and configure Harness GitOps Agent to connect to Harness with self-signed certificates.

Harness supports self-signed certificates. This topic describes how to install and configure a Harness GitOps Agent to connect to Harness using self-signed certificates.

In this topic, you will do the following:

* Create a Kubernetes secret with your certificates.
* Configure the GitOps Agent to use the custom certificates.

## Create the secret <a href="#create-the-secret" id="create-the-secret"></a>

Create a Kubernetes secret containing your self-signed certificates in the same namespace where the GitOps Agent is installed.

1. Copy the following YAML to your editor.

   ```yaml
   apiVersion: v1  
   kind: Secret  
   metadata:  
     name: addcerts  
     namespace: {agent-namespace}  
   type: Opaque  
   stringData:                             
     ca.bundle: |  
       -----BEGIN CERTIFICATE-----  
       XXXXXXXXXXXXXXXXXXXXXXXXXXX  
       -----END CERTIFICATE-----  
       -----BEGIN CERTIFICATE-----  
       XXXXXXXXXXXXXXXXXXXXXXXXXXX  
       -----END CERTIFICATE-----
   ```
2. Replace `{agent-namespace}` with the namespace where your GitOps Agent is installed.
3. Add your certificates to the `ca.bundle` field.

   The `XXXXXXXXXXXXXXXXXXXXXXXXXXX` placeholder indicates the position for the certificate body. Enclose each certificate between `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` markers.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Certificates must be in PEM format. You can include multiple certificates by adding additional certificate blocks.</p></div>

   Here is one way to get the certificate using `openssl`:

   ```bash
   openssl s_client -servername NAME -connect HOST:PORT
   ```

   For example, to get the certificate for app.harness.io:

   ```bash
   openssl s_client -servername app.harness.io -connect app.harness.io:443
   ```
4. Save the file as `addcerts.yaml`, then apply the manifest to your cluster.

   ```bash
   kubectl apply -f addcerts.yaml -n {agent-namespace}
   ```

## Configure the GitOps Agent <a href="#configure-the-gitops-agent" id="configure-the-gitops-agent"></a>

Configure the GitOps Agent to mount and use the custom certificates based on your installation method.

{% tabs %}
{% tab title="Kubernetes manifests" %}
To configure a GitOps Agent installed with Kubernetes manifests to use custom certificates, do the following:

1. Open the `gitops-agent.yml` file in your editor.
2. In the `{GitopsAgentName}-agent` ConfigMap, set the value of `GITOPS_SERVICE_HTTP_TLS_ENABLED` config to `true`.
3. Save and apply the modified manifest.

   ```bash
   kubectl apply -f gitops-agent.yml -n {agent-namespace}
   ```

{% endtab %}

{% tab title="Helm chart" %}
To configure a GitOps Agent installed with Helm to use custom certificates, do the following:

1. Modify the `values.yaml` file and add the `volumes` and `volumeMounts` section to the `agent` field.

   ```yaml
   agent:
     volumeMounts:
     - mountPath: /tmp/ca.bundle
       name: certs-vol
     volumes:
     - name: certs-vol
       secret:
         secretName: addcerts
         optional: true
         items:
           - key: ca.bundle
             path: ca.bundle
   ```
2. Set the `GITOPS_SERVICE_HTTP_TLS_ENABLED` flag to `true` by setting the `harness.configMap.http.tlsEnabled` option in the `values.yaml` file to `true`.

   ```yaml
   harness:
     nameOverride: harness
     configMap:
       http:
         tlsEnabled: true
         certPath: "/tmp/ca.bundle"
   ```
3. If certificates are required to be mounted onto the Argo CD Repo Server and Application Controller, add the following configurations in the `values.yaml` file.

   **Repo Server:**

   ```yaml
   repoServer:
     name: repo-server
     serviceAccount:
       create: true
     volumeMounts:
     - mountPath: /tmp/ca.bundle
       name: certs-vol
     volumes:
     - name: certs-vol
       secret:
         secretName: addcerts
         optional: true
         items:
           - key: ca.bundle
             path: ca.bundle
   ```

   **Application Controller:**

   ```yaml
   controller:
     name: application-controller
     serviceAccount:
       create: true
     volumeMounts:
     - mountPath: /tmp/ca.bundle
       name: certs-vol
     volumes:
     - name: certs-vol
       secret:
         secretName: addcerts
         optional: true
         items:
           - key: ca.bundle
             path: ca.bundle
   ```
4. Apply the Helm chart with the updated values.

   ```bash
   helm upgrade --install gitops-agent harness/gitops-agent -n {agent-namespace} -f values.yaml
   ```

{% endtab %}
{% endtabs %}

## Verify certificate configuration <a href="#verify-certificate-configuration" id="verify-certificate-configuration"></a>

After configuring the GitOps Agent with self-signed certificates, verify that the certificate is properly mounted and the agent can connect to Harness.

1. Check if the agent pod is running.

   ```bash
   kubectl get pods -n {agent-namespace} -l app.kubernetes.io/name=gitops-agent
   ```
2. Verify the certificate file is mounted in the agent pod.

   ```bash
   kubectl exec -it <agent-pod-name> -n {agent-namespace} -- ls -la /tmp/ca.bundle
   ```

   You should see the certificate file at `/tmp/ca.bundle`.
3. Check the agent logs to confirm TLS is enabled and the certificate is being used.

   ```bash
   kubectl logs <agent-pod-name> -n {agent-namespace} | grep -i "tls\|cert"
   ```

   Look for log entries indicating that TLS is enabled and certificates are loaded.
4. Verify the agent is connected in the Harness UI.

   Go to **GitOps** → **Settings** → **GitOps Agents** and confirm that your agent shows a **Connected** status.

{% hint style="info" %}
**Troubleshooting**

If the agent fails to start, check the logs with `kubectl logs <agent-pod-name> -n {agent-namespace}`.

Common issues:

* Certificate file not found at `/tmp/ca.bundle` - verify volume mount with `kubectl describe pod`
* Secret `addcerts` missing - check with `kubectl get secret`
* `tlsEnabled` not set to `true` - verify ConfigMap
* Invalid certificate format - ensure certificates are in PEM format with proper BEGIN/END markers
  {% endhint %}

{% @harness-feedback/feedback %}