> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/continuous-delivery/use-gitops/gitops-entities/repositories/add-a-harness-git-ops-repository.md).
# Add a Harness GitOps repository
This topic describes how to add a Harness GitOps repository containing the declarative description of a desired state.
This topic describes how to add a Harness GitOps repository containing the declarative description of a desired state.
Harness GitOps repositories are connections to repos containing the declarative description of a desired state. The declarative description can be in Kubernetes manifests, Helm Chart, Kustomize manifests, etc.
A Harness GitOps Repository is used for Harness GitOps only. Go to the [Git connector settings reference](https://developer.harness.io/docs/platform/connectors/code-repositories/ref-source-repo-provider/git-connector-settings-reference) to connect other Harness features, such as Continuous Integration (CI) or Continuous Delivery (CD) pipelines, to a repository.
## What you will learn from this topic
* How to identify the [supported repository platforms](#supported-platforms) for Harness GitOps, including Git, HTTP Helm, and OCI Helm.
* How to [add a GitOps repository](#add-a-repository) for Git providers, HTTP Helm, OCI Helm, and self-signed certificate scenarios.
* How to [skip server verification](#skip-server-verification) when creating a repository.
* How to [verify the connection](#verify-connection) after adding a repository.
## Before you begin
If you are new to Harness GitOps, familiarize yourself with the following topics:
* Go to [Harness GitOps Basics](/continuous-delivery/use-gitops/get-started/harness-git-ops-basics.md) to understand core GitOps concepts.
* Go to [Harness CD GitOps Quickstart](/continuous-delivery/use-gitops/get-started/harness-cd-git-ops-quickstart.md) to complete an end-to-end GitOps walkthrough.
* Go to [Install a Harness GitOps Agent](/continuous-delivery/use-gitops/gitops-entities/agents/install-a-harness-git-ops-agent.md) to set up the Agent this repository syncs through.
## Supported platforms
The supported GitOps Repository platforms are:
* Git platforms (any Access Token-related connection [supported by Argo CD](https://argo-cd.readthedocs.io/en/release-1.8/user-guide/private-repositories/#access-token), including BitBucket)
* HTTP Helm servers
* OCI Helm repositories
## Add a repository
In the repository setup, you will select the [Agent](/continuous-delivery/use-gitops/gitops-entities/agents/install-a-harness-git-ops-agent.md) to use when syncing state. Be sure you have a GitOps Agent set up already.
Go to [Install a Harness GitOps Agent](/continuous-delivery/use-gitops/gitops-entities/agents/install-a-harness-git-ops-agent.md) to set up a GitOps Agent.
You will also provide the credentials to use when connecting to the Git repository. Ensure you have your credentials available.
If you use a [GitOps repository credentials template](/continuous-delivery/use-gitops/gitops-entities/repositories/add-harness-git-ops-repository-credentials-template.md) with a GitOps repository, then the repository path in the GitOps repository must be a subfolder of the repository path in the repository credentials template.
1. In your Harness project, select **GitOps**, and then select **Settings**.
2. Select **Repositories**.
3. Select **New Repository**.
4. In **Specify Repository Type**, select:
* **Git** to add Git repositories.
* **Helm** to add HTTP Helm and OCI Helm repositories.
{% tabs %}
{% tab title="Git providers" %}
You can use any Git provider or [Harness Code Repository](https://developer.harness.io/code-repository) as your GitOps repository.
1. In **Specify Repository Type**, select **Git**.
2. In **Repository Name**, enter a name.
3. In **GitOps Agent**, select or create the Agent you want to use to fetch manifests from this repository. Go to [Install a Harness GitOps Agent](/continuous-delivery/use-gitops/gitops-entities/agents/install-a-harness-git-ops-agent.md) to set up an Agent.
4. In **Repository URL**, enter the URL to your repository. For example, `https://github.com/argoproj/argocd-example-apps.git`.
5. Select **Continue**.
6. In **Credentials**, select one of the following:
* **Specify Credentials for Repository**
* In **Credentials**, in **Connection Type**, select **HTTPS**, or **SSH**, or **GitHub App**.
* If you use Two-Factor Authentication for your Git repo, you connect over **HTTPS** or **SSH**.
* For **SSH**, use a PEM-format key, not OpenSSH. To generate an SSHv2 key, use: `ssh-keygen -t rsa -m PEM` The `rsa` and `-m PEM` options select the algorithm and the PEM format. Follow the prompts to create the PEM key.
* Go to the [ssh-keygen man page](https://linux.die.net/man/1/ssh-keygen) to review the command options.
* **HTTP** also has the **Anonymous** option. When a repository is configured with an anonymous connection type (public - no credentials), Harness automatically uses the repository credentials if they are available, even if you do not explicitly select them in the UI.
* Go to [Use a GitHub App in a GitHub Connector](https://developer.harness.io/docs/platform/connectors/code-repositories/git-hub-app-support) to set up the GitHub App.
* Select **Save & Continue**. Harness validates the connection.
* **Use a Credentials Template**
* Select the GitOps credentials template to use.
Go to [Harness GitOps Repository Credentials Template](/continuous-delivery/use-gitops/gitops-entities/repositories/add-harness-git-ops-repository-credentials-template.md) to configure a credentials template.
If you use a repository credentials template for GitOps repository authentication, then the repository path in the GitOps repository must be a subfolder of the repository path in the repository credentials template.
For example, if you created a repository credentials template for the URL `https://something.com`, GitOps repositories that have their URL as `https://something.com/*` are able to use that repository credentials template.
Harness will auto-detect the repository credentials template (if any) based on the GitOps repository **URL** and auto-populate it. If Harness auto-populated the GitOps repository, then you cannot edit the repository credentials template setting.
* **Skip Server Verification**
Select this option to have the GitOps Agent skip verification of the URL and credentials.
Verification is only skipped when you create the GitOps repository. Subsequent uses of the GitOps repository are verified.
* **Enable LFS Support**
Select the option to use [Git Large File Storage](https://github.com/git-lfs/git-lfs/).
* **Proxy**
A proxy for your repository can be specified in the proxy setting.
Harness uses this proxy to access the repository. Harness looks for the standard proxy environment variables in the repository server if the custom proxy is absent.
7. Select **Save & Continue**. Harness validates the connection.
**Example:** The following repository secret specifies a proxy.
```yaml
apiVersion: v1
kind: Secret
metadata:
name: private-repo
namespace: cd
labels:
argocd.argoproj.io/secret-type: repository
stringData:
type: git
url: https://github.com/argoproj/private-repo
proxy: https://proxy-server-url:8888
password: my-password
username: my-username
```
{% endtab %}
{% tab title="HTTP Helm repository" %}
Perform the following steps to add an HTTP Helm repository:
1. In **Specify Repository Type**, select **Helm**.
2. In **Repository Name**, enter a name.
3. In **GitOps Agent**, select or create the Agent you want to use to fetch charts from this repository. Go to [Install a Harness GitOps Agent](/continuous-delivery/use-gitops/gitops-entities/agents/install-a-harness-git-ops-agent.md) to set up an Agent.
4. In **Repository URL**, enter the URL to your HTTP Helm repository. For example, `https://charts.bitnami.com/bitnami`.
5. Select **Continue**.
6. In **Credentials**, select one of the following:
* **Specify Credentials for Repository**
* In **Credentials**, in **Connection Type**, select **HTTPS** or **SSH**.
* If you use Two-Factor Authentication for your Git repository, you connect over **HTTPS** or **SSH**
* For **SSH**, use a PEM-format key, not OpenSSH. To generate an SSHv2 key, use: `ssh-keygen -t rsa -m PEM`. The `rsa` and `-m PEM` options select the algorithm and the PEM format. Follow the prompts to create the PEM key.
* Go to the [ssh-keygen man page](https://linux.die.net/man/1/ssh-keygen) to review the command options.
* **HTTP** also has the **Anonymous** option.
* Select **Save & Continue**. Harness validates the connection.
* **Use a Credentials Template**
* Select the GitOps credentials template to use.
Go to [Harness GitOps Repository Credentials Template](/continuous-delivery/use-gitops/gitops-entities/repositories/add-harness-git-ops-repository-credentials-template.md) to configure a credentials template.
If you use a repository credentials template for GitOps repository authentication, then the repository path in the GitOps repository must be a subfolder of the repository path in the repository credentials template.
For example, if you created a repository credentials template for the URL `https://something.com`, GitOps repositories that have their URL as `https://something.com/*` are able to use that repository credentials template.
Harness will auto-detect the repository credentials template (if any) based on the GitOps repository **URL** and auto-populate it. If Harness auto-populated the GitOps repository, then you cannot edit the repository credentials template setting.
7. Select **Save & Continue**. Harness validates the connection.
{% endtab %}
{% tab title="OCI Helm repository" %}
Perform the following steps to add an OCI Helm repository:
1. In **Specify Repository Type**, select **Helm**.
2. In **Repository Name**, enter a name.
3. In **GitOps Agent**, select or create the Agent you want to use to fetch charts from this repository. Go to [Install a Harness GitOps Agent](/continuous-delivery/use-gitops/gitops-entities/agents/install-a-harness-git-ops-agent.md) to set up an Agent.
4. In **Repository URL**, enter the URL to your OCI Helm repository. For example, `registry-1.docker.io/docker`.
5. Select **Enable OCI**.
6. Select **Continue**.
7. In **Credentials**, select **Specify Credentials for Repository**.
* In **Credentials**, in **Connection Type**, select **HTTPS**, the **Anonymous** option to add a public repository.
* To add a private repository, select the authentication option with username and password, and enter the access token.
8. Select **Save & Continue**. Harness validates the connection.
This authentication is supported for Docker and GitHub. AWS and Google have short-lived tokens, and might not work as expected. If you have an [External Secrets Operator](https://external-secrets.io) installed, you can configure the repository to regenerate tokens. Go to [OCI Helm repository with ESO](#oci-helm-repository-with-eso) to configure token regeneration.
{% hint style="info" %}
* Credentials Template is not supported for OCI Helm repository.
* When you add an application with a Helm-based source configured through OCI, the application wizard does not automatically load the available charts. This is a limitation from Argo CD. As a workaround, specify the chart details manually when you configure the application.
{% endhint %}
{% endtab %}
{% tab title="Using a self-signed certificate" %}
If you intend to establish an HTTPS connection to a repository and plan to use either a self-signed certificate or one signed by a private Certificate Authority (CA), it is essential to generate the repository certificate prior to setting up the repository itself.
1. To create a repository certificate:
* In **GitOps**, in **Settings**, select **Repository Certificates**, and then select **New Repository Certificate**.
* In **Repository Type**, select **TLS Repository Certificate**.
* In **Repository Server Name**, enter the name of the repository server issuing the certificate. For example, `github.mycompany.internal`.
* Paste the certificate in **TLS Certificate (PEM Format)**. Enclose each certificate in `BEGIN CERTIFICATE` and `END CERTIFICATE` comments.
{% endtab %}
{% tab title="OCI Helm repository with ESO" %}
### OCI Helm repository with ESO
Perform the following steps to add an OCI Helm repository using an External Secrets Operator (ESO) refresh token:
1. In **Specify Repository Type**, select **Helm**.
2. In **Repository Name**, enter a name.
3. In **GitOps Agent**, select or create the Agent you want to use to fetch charts from this repository. Go to [Install a Harness GitOps Agent](/continuous-delivery/use-gitops/gitops-entities/agents/install-a-harness-git-ops-agent.md) to set up an Agent.
4. In **Repository URL**, enter the URL to your OCI Helm repository. For example, `us-east4-docker.pkg.dev//`.
5. Select **Enable OCI**
6. Select **Continue**.
7. In **Credentials**, select **Specify Credentials for Repository**.
* Select the authentication option with **Username and password**,
* In the **Username** field, if you are authenticating to AWS, enter `AWS`. If you are authenticating to Google, enter `oauth2accesstoken`.
* In **Password** enter your short-lived token (obtained with `aws ecr get-login-password` for AWS and `gcloud auth print-access-token` for Google). If you have an [External Secrets Operator](https://external-secrets.io), a **Refresh token** checkbox appears. Enable the checkbox.
* If you checked **Refresh Token**, specify a **Refresh Interval** (for example, 1m, 1h, 12h, or 1d). This is the interval with which you want the token to be refreshed.
* Harness uses the URL you enter to determine whether the registry is a Google or AWS registry. You can select the type of authentication that you want to use with the registry.
* For Google, you can select **Google Service Account** or **Google Workload Identity**.
* If you select **Google Service Account**, you must upload the service [account key file](https://cloud.google.com/iam/docs/keys-create-delete). Paste the contents of the file in the **Account Key** field. Contents of the file must be on a single line.
* If you select **Google Workload Identity**, you must enter the GCP Workload parameters. Go to [Google Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity) to configure the required parameters.
* The `project_id` is the project where the registry is located.
* For AWS, you can select **AWS Access Credentials** or **AWS Service Account**.
* If you select **AWS Access Credentials**, enter the AWS access key ID, the AWS secret access key, and, optionally, the AWS session token. Go to [AWS Credentials](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) to review the available credential types.
* If you select **AWS Service Account**, enter the service account.
* **Region** is the region in which the registry is located.
* **Role** is the role ARN that will be assumed with given credentials.
8. Select **Save & Continue**. Harness validates the connection.
**Example:** A single-line Google service account key file pasted into the **Account Key** field looks like the following.
```json
{ "type": "service_account", "project_id": "", "private_key_id": "", "private_key": "...", "universe_domain": "googleapis.com" }
```
{% hint style="info" %}
Credentials Template is not supported for OCI Helm repository.
{% endhint %}
{% endtab %}
{% endtabs %}
## Skip server verification
Select this option to have the GitOps Agent skip verification of the URL and credentials.
Verification is only skipped when you create the GitOps repository. Subsequent uses of the GitOps repository are verified.
## Verify connection
The connection is verified.
If you encounter errors, check that you have the correct repository URL and your authentication method has the required permissions.
Select **Finish**. You now have a Harness GitOps repository added.
## Next steps
* [Harness GitOps Repository Credentials Template](/continuous-delivery/use-gitops/gitops-entities/repositories/add-harness-git-ops-repository-credentials-template.md): Share authentication across repositories that fall under a common URL prefix.
* [Harness CD GitOps Quickstart](/continuous-delivery/use-gitops/get-started/harness-cd-git-ops-quickstart.md#step-3-add-a-harness-gitops-cluster): Add a destination cluster to deploy manifests from this repository.
* [Manage GitOps applications](/continuous-delivery/use-gitops/application/manage-gitops-applications.md): Create an application that pulls manifests from this repository.
{% @harness-feedback/feedback %}