feat: adds mTLS support in repo-server (#26715)

Signed-off-by: Patroklos Papapetrou <[email protected]>
Signed-off-by: Papapetrou Patroklos <[email protected]>
Co-authored-by: Michael Crenshaw <[email protected]>
Co-authored-by: Regina Voloshin <[email protected]>

cmd/argocd-application-controller/commands/argocd_application_controller.go

@@ -96,7 +96,8 @@ func NewCommand() *cobra.Command {
 		// argocd k8s event logging flag
 		enableK8sEvent []string
 		// feature flag that enables the manifest hydrator controller
-		hydratorEnabled bool
+		hydratorEnabled              bool
+		repoServerClientTLSConfigSrc func() (tls.Configuration, error)
 	)
 	command := cobra.Command{
 		Use:               common.CommandApplicationController,
@@ -146,14 +147,14 @@ func NewCommand() *cobra.Command {
 				resyncDuration = time.Duration(appResyncPeriod) * time.Second
 			}
 
-			tlsConfig := apiclient.TLSConfiguration{
-				DisableTLS:       repoServerPlaintext,
-				StrictValidation: repoServerStrictTLS,
-			}
+			tlsConfig, err := repoServerClientTLSConfigSrc()
+			errors.CheckError(err)
+			tlsConfig.DisableTLS = repoServerPlaintext
+			tlsConfig.StrictValidation = tlsConfig.StrictValidation || repoServerStrictTLS
 
 			// Load CA information to use for validating connections to the
 			// repository server, if strict TLS validation was requested.
-			if !repoServerPlaintext && repoServerStrictTLS {
+			if !repoServerPlaintext && repoServerStrictTLS && tlsConfig.Certificates == nil {
 				pool, err := tls.LoadX509CertPool(
 					env.StringFromEnv(common.EnvAppConfigPath, common.DefaultAppConfigPath)+"/controller/tls/tls.crt",
 					env.StringFromEnv(common.EnvAppConfigPath, common.DefaultAppConfigPath)+"/controller/tls/ca.crt",
@@ -280,6 +281,7 @@ func NewCommand() *cobra.Command {
 	command.Flags().Int64Var(&kubectlParallelismLimit, "kubectl-parallelism-limit", env.ParseInt64FromEnv("ARGOCD_APPLICATION_CONTROLLER_KUBECTL_PARALLELISM_LIMIT", 20, 0, math.MaxInt64), "Number of allowed concurrent kubectl fork/execs. Any value less than 1 means no limit.")
 	command.Flags().BoolVar(&repoServerPlaintext, "repo-server-plaintext", env.ParseBoolFromEnv("ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_PLAINTEXT", false), "Disable TLS on connections to repo server")
 	command.Flags().BoolVar(&repoServerStrictTLS, "repo-server-strict-tls", env.ParseBoolFromEnv("ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_STRICT_TLS", false), "Whether to use strict validation of the TLS cert presented by the repo server")
+	errors.CheckError(command.Flags().MarkDeprecated("repo-server-strict-tls", "use --repo-server-ca-cert-path instead"))
 	command.Flags().StringSliceVar(&metricsAplicationLabels, "metrics-application-labels", []string{}, "List of Application labels that will be added to the argocd_application_labels metric")
 	command.Flags().StringSliceVar(&metricsAplicationConditions, "metrics-application-conditions", []string{}, "List of Application conditions that will be added to the argocd_application_conditions metric")
 	command.Flags().StringSliceVar(&metricsClusterLabels, "metrics-cluster-labels", []string{}, "List of Cluster labels that will be added to the argocd_cluster_labels metric")
@@ -305,6 +307,7 @@ func NewCommand() *cobra.Command {
 	// argocd k8s event logging flag
 	command.Flags().StringSliceVar(&enableK8sEvent, "enable-k8s-event", env.StringsFromEnv("ARGOCD_ENABLE_K8S_EVENT", argo.DefaultEnableEventList(), ","), "Enable ArgoCD to use k8s event. For disabling all events, set the value as `none`. (e.g --enable-k8s-event=none), For enabling specific events, set the value as `event reason`. (e.g --enable-k8s-event=StatusRefreshed,ResourceCreated)")
 	command.Flags().BoolVar(&hydratorEnabled, "hydrator-enabled", env.ParseBoolFromEnv("ARGOCD_HYDRATOR_ENABLED", false), "Feature flag to enable Hydrator. Default (\"false\")")
+	repoServerClientTLSConfigSrc = tls.AddClientTLSFlagsToCmdWithPrefix(&command, "APPLICATION_CONTROLLER")
 	cacheSource = appstatecache.AddCacheFlagsToCmd(&command, cacheutil.Options{
 		OnClientCreated: func(client *redis.Client) {
 			redisClient = client

cmd/argocd-applicationset-controller/commands/applicationset_controller.go

@@ -82,6 +82,7 @@ func NewCommand() *cobra.Command {
 		maxResourcesStatusCount      int
 		cacheSyncPeriod              time.Duration
 		concurrentApplicationUpdates int
+		repoServerClientTLSConfigSrc func() (tls.Configuration, error)
 		scmProxyURL                  string
 		scmNoProxy                   string
 	)
@@ -215,12 +216,12 @@ func NewCommand() *cobra.Command {
 				tokenRefStrictMode, generators.WithProxyURL(scmProxyURL),
 				generators.WithNoProxyList(scmNoProxy))
 
-			tlsConfig := apiclient.TLSConfiguration{
-				DisableTLS:       repoServerPlaintext,
-				StrictValidation: repoServerStrictTLS,
-			}
+			tlsConfig, err := repoServerClientTLSConfigSrc()
+			errors.CheckError(err)
+			tlsConfig.DisableTLS = repoServerPlaintext
+			tlsConfig.StrictValidation = tlsConfig.StrictValidation || repoServerStrictTLS
 
-			if !repoServerPlaintext && repoServerStrictTLS {
+			if !repoServerPlaintext && repoServerStrictTLS && tlsConfig.Certificates == nil {
 				pool, err := tls.LoadX509CertPool(
 					env.StringFromEnv(common.EnvAppConfigPath, common.DefaultAppConfigPath)+"/reposerver/tls/tls.crt",
 					env.StringFromEnv(common.EnvAppConfigPath, common.DefaultAppConfigPath)+"/reposerver/tls/ca.crt",
@@ -311,6 +312,7 @@ func NewCommand() *cobra.Command {
 	command.Flags().BoolVar(&enableNewGitFileGlobbing, "enable-new-git-file-globbing", env.ParseBoolFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_NEW_GIT_FILE_GLOBBING", false), "Enable new globbing in Git files generator.")
 	command.Flags().BoolVar(&repoServerPlaintext, "repo-server-plaintext", env.ParseBoolFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_PLAINTEXT", false), "Disable TLS on connections to repo server")
 	command.Flags().BoolVar(&repoServerStrictTLS, "repo-server-strict-tls", env.ParseBoolFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_STRICT_TLS", false), "Whether to use strict validation of the TLS cert presented by the repo server")
+	errors.CheckError(command.Flags().MarkDeprecated("repo-server-strict-tls", "use --repo-server-ca-cert-path instead"))
 	command.Flags().IntVar(&repoServerTimeoutSeconds, "repo-server-timeout-seconds", env.ParseNumFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS", 60, 0, math.MaxInt64), "Repo server RPC call timeout seconds.")
 	command.Flags().IntVar(&maxConcurrentReconciliations, "concurrent-reconciliations", env.ParseNumFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_CONCURRENT_RECONCILIATIONS", 10, 1, math.MaxInt), "Max concurrent reconciliations limit for the controller")
 	command.Flags().StringVar(&scmRootCAPath, "scm-root-ca-path", env.StringFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_SCM_ROOT_CA_PATH", ""), "Provide Root CA Path for self-signed TLS Certificates")
@@ -324,6 +326,7 @@ func NewCommand() *cobra.Command {
 	command.Flags().IntVar(&maxResourcesStatusCount, "max-resources-status-count", env.ParseNumFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_MAX_RESOURCES_STATUS_COUNT", 5000, 0, math.MaxInt), "Max number of resources stored in appset status.")
 	command.Flags().DurationVar(&cacheSyncPeriod, "cache-sync-period", env.ParseDurationFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_CACHE_SYNC_PERIOD", time.Hour*10, 0, time.Hour*24), "Period at which the manager client cache is forcefully resynced with the Kubernetes API server. 0 disables periodic resync.")
 	command.Flags().IntVar(&concurrentApplicationUpdates, "concurrent-application-updates", env.ParseNumFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_CONCURRENT_APPLICATION_UPDATES", 1, 1, 200), "Number of concurrent Application create/update/delete operations per ApplicationSet reconcile.")
+	repoServerClientTLSConfigSrc = tls.AddClientTLSFlagsToCmdWithPrefix(&command, "APPLICATIONSET_CONTROLLER")
 	return &command
 }
 

cmd/argocd-dex/commands/argocd_dex.go

@@ -80,7 +80,7 @@ func NewRunDexCommand() *cobra.Command {
 			kubeClientset := kubernetes.NewForConfigOrDie(config)
 
 			if !disableTLS {
-				config, err := tls.CreateServerTLSConfig("/tls/tls.crt", "/tls/tls.key", []string{"localhost", "dexserver"})
+				config, err := tls.CreateServerTLSConfig("/tls/tls.crt", "/tls/tls.key", []string{"localhost", "dexserver"}, "")
 				if err != nil {
 					log.Fatalf("could not create TLS config: %v", err)
 				}

cmd/argocd-notification/commands/argocd_notification.go

@@ -51,6 +51,7 @@ func NewCommand() *cobra.Command {
 		secretName                     string
 		applicationNamespaces          []string
 		selfServiceNotificationEnabled bool
+		repoServerClientTLSConfigSrc   func() (tls.Configuration, error)
 	)
 	command := cobra.Command{
 		Use:   common.CommandNotifications,
@@ -112,11 +113,14 @@ func NewCommand() *cobra.Command {
 				}
 			}()
 
-			tlsConfig := apiclient.TLSConfiguration{
-				DisableTLS:       argocdRepoServerPlaintext,
-				StrictValidation: argocdRepoServerStrictTLS,
+			tlsConfig, err := repoServerClientTLSConfigSrc()
+			if err != nil {
+				return fmt.Errorf("failed to get repo-server client TLS configuration: %w", err)
 			}
-			if !tlsConfig.DisableTLS && tlsConfig.StrictValidation {
+			tlsConfig.DisableTLS = argocdRepoServerPlaintext
+			tlsConfig.StrictValidation = tlsConfig.StrictValidation || argocdRepoServerStrictTLS
+
+			if !tlsConfig.DisableTLS && tlsConfig.StrictValidation && tlsConfig.Certificates == nil {
 				pool, err := tls.LoadX509CertPool(
 					env.StringFromEnv(common.EnvAppConfigPath, common.DefaultAppConfigPath)+"/reposerver/tls/tls.crt",
 					env.StringFromEnv(common.EnvAppConfigPath, common.DefaultAppConfigPath)+"/reposerver/tls/ca.crt",
@@ -171,9 +175,11 @@ func NewCommand() *cobra.Command {
 	command.Flags().StringVar(&argocdRepoServer, "argocd-repo-server", common.DefaultRepoServerAddr, "Argo CD repo server address")
 	command.Flags().BoolVar(&argocdRepoServerPlaintext, "argocd-repo-server-plaintext", env.ParseBoolFromEnv("ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_PLAINTEXT", false), "Use a plaintext client (non-TLS) to connect to repository server")
 	command.Flags().BoolVar(&argocdRepoServerStrictTLS, "argocd-repo-server-strict-tls", false, "Perform strict validation of TLS certificates when connecting to repo server")
+	errors.CheckError(command.Flags().MarkDeprecated("argocd-repo-server-strict-tls", "use --argocd-repo-server-ca-cert-path instead"))
 	command.Flags().StringVar(&configMapName, "config-map-name", "argocd-notifications-cm", "Set notifications ConfigMap name")
 	command.Flags().StringVar(&secretName, "secret-name", "argocd-notifications-secret", "Set notifications Secret name")
 	command.Flags().StringSliceVar(&applicationNamespaces, "application-namespaces", env.StringsFromEnv("ARGOCD_APPLICATION_NAMESPACES", []string{}, ","), "List of additional namespaces that this controller should send notifications for")
 	command.Flags().BoolVar(&selfServiceNotificationEnabled, "self-service-notification-enabled", env.ParseBoolFromEnv("ARGOCD_NOTIFICATION_CONTROLLER_SELF_SERVICE_NOTIFICATION_ENABLED", false), "Allows the Argo CD notification controller to pull notification config from the namespace that the resource is in. This is useful for self-service notification.")
+	repoServerClientTLSConfigSrc = tls.AddClientTLSFlagsToCmdWithPrefix(&command, "NOTIFICATION_CONTROLLER")
 	return &command
 }

cmd/argocd-repo-server/commands/argocd_repo_server.go

@@ -1,6 +1,7 @@
 package commands
 
 import (
+	stderrors "errors"
 	"fmt"
 	"math"
 	"net"
@@ -20,23 +21,26 @@ import (
 	"k8s.io/apimachinery/pkg/api/resource"
 
 	cmdutil "github.com/argoproj/argo-cd/v3/cmd/util"
+	reposervercache "github.com/argoproj/argo-cd/v3/reposerver/cache"
+	cacheutil "github.com/argoproj/argo-cd/v3/util/cache"
+	utilio "github.com/argoproj/argo-cd/v3/util/io"
+
 	"github.com/argoproj/argo-cd/v3/common"
 	"github.com/argoproj/argo-cd/v3/reposerver"
 	"github.com/argoproj/argo-cd/v3/reposerver/apiclient"
-	reposervercache "github.com/argoproj/argo-cd/v3/reposerver/cache"
 	"github.com/argoproj/argo-cd/v3/reposerver/metrics"
 	"github.com/argoproj/argo-cd/v3/reposerver/repository"
 	"github.com/argoproj/argo-cd/v3/util/askpass"
-	cacheutil "github.com/argoproj/argo-cd/v3/util/cache"
 	"github.com/argoproj/argo-cd/v3/util/cli"
 	"github.com/argoproj/argo-cd/v3/util/env"
 	"github.com/argoproj/argo-cd/v3/util/errors"
 	"github.com/argoproj/argo-cd/v3/util/healthz"
-	utilio "github.com/argoproj/argo-cd/v3/util/io"
 	"github.com/argoproj/argo-cd/v3/util/profile"
 	"github.com/argoproj/argo-cd/v3/util/sourceintegrity"
 	"github.com/argoproj/argo-cd/v3/util/tls"
 	traceutil "github.com/argoproj/argo-cd/v3/util/trace"
+
+	ctls "crypto/tls"
 )
 
 var (
@@ -63,7 +67,6 @@ func NewCommand() *cobra.Command {
 		tlsConfigCustomizer                tls.ConfigCustomizer
 		tlsConfigCustomizerSrc             func() (tls.ConfigCustomizer, error)
 		redisClient                        *redis.Client
-		disableTLS                         bool
 		maxCombinedDirectoryManifestsSize  string
 		cmpTarExcludedGlobs                []string
 		allowOutOfBoundsSymlinks           bool
@@ -78,6 +81,8 @@ func NewCommand() *cobra.Command {
 		cmpUseManifestGeneratePaths        bool
 		ociMediaTypes                      []string
 		enableBuiltinGitConfig             bool
+		clientCAPath                       string
+		disableTLS                         bool
 	)
 	command := cobra.Command{
 		Use:               common.CommandRepoServer,
@@ -135,6 +140,10 @@ func NewCommand() *cobra.Command {
 			askPassServer := askpass.NewServer(askpass.SocketPath)
 			metricsServer := metrics.NewMetricsServer()
 			cacheutil.CollectMetrics(redisClient, metricsServer, nil)
+			if disableTLS && clientCAPath != "" {
+				return stderrors.New("--client-ca-path cannot be used when --disable-tls is enabled")
+			}
+
 			server, err := reposerver.NewServer(metricsServer, cache, tlsConfigCustomizer, repository.RepoServerInitConstants{
 				ParallelismLimit: parallelismLimit,
 				PauseGenerationAfterFailedGenerationAttempts: pauseGenerationAfterFailedGenerationAttempts,
@@ -155,7 +164,7 @@ func NewCommand() *cobra.Command {
 				OCIMediaTypes:                                ociMediaTypes,
 				EnableBuiltinGitConfig:                       enableBuiltinGitConfig,
 				HelmUserAgent:                                helmUserAgent,
-			}, askPassServer)
+			}, askPassServer, clientCAPath, disableTLS)
 			errors.CheckError(err)
 
 			if otlpAddress != "" {
@@ -173,13 +182,15 @@ func NewCommand() *cobra.Command {
 			listener, err := lc.Listen(ctx, "tcp", fmt.Sprintf("%s:%d", listenHost, listenPort))
 			errors.CheckError(err)
 
+			healthCheckTLSConfig := buildHealthCheckTLSConfig(server.GetHealthCheckClientCert(), disableTLS)
+
 			mux := http.NewServeMux()
 			healthz.ServeHealthCheck(mux, func(r *http.Request) error {
 				if val, ok := r.URL.Query()["full"]; ok && len(val) > 0 && val[0] == "true" {
-					// connect to itself to make sure repo server is able to serve connection
-					// used by liveness probe to auto restart repo server
+					// connect to itself to make sure the repo server is able to serve the connection
+					// used by liveness probe to auto-restart repo server
 					// see https://github.com/argoproj/argo-cd/issues/5110 for more information
-					conn, err := apiclient.NewConnection(fmt.Sprintf("localhost:%d", listenPort), 60, &apiclient.TLSConfiguration{DisableTLS: disableTLS})
+					conn, err := apiclient.NewConnection(fmt.Sprintf("localhost:%d", listenPort), 60, healthCheckTLSConfig)
 					if err != nil {
 						return err
 					}
@@ -251,7 +262,6 @@ func NewCommand() *cobra.Command {
 	command.Flags().BoolVar(&otlpInsecure, "otlp-insecure", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_OTLP_INSECURE", true), "OpenTelemetry collector insecure mode")
 	command.Flags().StringToStringVar(&otlpHeaders, "otlp-headers", env.ParseStringToStringFromEnv("ARGOCD_REPO_OTLP_HEADERS", map[string]string{}, ","), "List of OpenTelemetry collector extra headers sent with traces, headers are comma-separated key-value pairs(e.g. key1=value1,key2=value2)")
 	command.Flags().StringSliceVar(&otlpAttrs, "otlp-attrs", env.StringsFromEnv("ARGOCD_REPO_SERVER_OTLP_ATTRS", []string{}, ","), "List of OpenTelemetry collector extra attrs when send traces, each attribute is separated by a colon(e.g. key:value)")
-	command.Flags().BoolVar(&disableTLS, "disable-tls", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_DISABLE_TLS", false), "Disable TLS on the gRPC endpoint")
 	command.Flags().StringVar(&maxCombinedDirectoryManifestsSize, "max-combined-directory-manifests-size", env.StringFromEnv("ARGOCD_REPO_SERVER_MAX_COMBINED_DIRECTORY_MANIFESTS_SIZE", "10M"), "Max combined size of manifest files in a directory-type Application")
 	command.Flags().StringArrayVar(&cmpTarExcludedGlobs, "plugin-tar-exclude", env.StringsFromEnv("ARGOCD_REPO_SERVER_PLUGIN_TAR_EXCLUSIONS", []string{}, ";"), "Globs to filter when sending tarballs to plugins.")
 	command.Flags().BoolVar(&allowOutOfBoundsSymlinks, "allow-oob-symlinks", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_ALLOW_OUT_OF_BOUNDS_SYMLINKS", false), "Allow out-of-bounds symlinks in repositories (not recommended)")
@@ -266,6 +276,9 @@ func NewCommand() *cobra.Command {
 	command.Flags().BoolVar(&cmpUseManifestGeneratePaths, "plugin-use-manifest-generate-paths", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_PLUGIN_USE_MANIFEST_GENERATE_PATHS", false), "Pass the resources described in argocd.argoproj.io/manifest-generate-paths value to the cmpserver to generate the application manifests.")
 	command.Flags().StringSliceVar(&ociMediaTypes, "oci-layer-media-types", env.StringsFromEnv("ARGOCD_REPO_SERVER_OCI_LAYER_MEDIA_TYPES", []string{"application/vnd.oci.image.layer.v1.tar", "application/vnd.oci.image.layer.v1.tar+gzip", "application/vnd.cncf.helm.chart.content.v1.tar+gzip"}, ","), "Comma separated list of allowed media types for OCI media types. This only accounts for media types within layers.")
 	command.Flags().BoolVar(&enableBuiltinGitConfig, "enable-builtin-git-config", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_ENABLE_BUILTIN_GIT_CONFIG", true), "Enable builtin git configuration options that are required for correct argocd-repo-server operation.")
+	command.Flags().BoolVar(&disableTLS, "disable-tls", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_DISABLE_TLS", false), "Disable TLS for the repo-server gRPC endpoint")
+	command.Flags().StringVar(&clientCAPath, "client-ca-path", env.StringFromEnv("ARGOCD_REPO_SERVER_CLIENT_CA_PATH", "/app/config/reposerver/mtls/client-ca.crt"), "Path to the client CA certificate file for mTLS. Defaults to the auto-mounted Secret path; mTLS is skipped if the file does not exist.")
+
 	tlsConfigCustomizerSrc = tls.AddTLSFlagsToCmd(&command)
 	cacheSrc = reposervercache.AddCacheFlagsToCmd(&command, cacheutil.Options{
 		OnClientCreated: func(client *redis.Client) {
@@ -274,3 +287,16 @@ func NewCommand() *cobra.Command {
 	})
 	return &command
 }
+
+func buildHealthCheckTLSConfig(healthCheckClientCert *ctls.Certificate, disableTLS bool) *tls.Configuration {
+	cfg := &tls.Configuration{
+		DisableTLS: disableTLS,
+		// InsecureSkipVerify=true: it is always a localhost connection, so no reason to re-verify the server
+		// certificate on every probe.
+		StrictValidation: false,
+	}
+	if healthCheckClientCert != nil {
+		cfg.ClientCertificates = []ctls.Certificate{*healthCheckClientCert}
+	}
+	return cfg
+}

cmd/argocd-repo-server/commands/argocd_repo_server_test.go

@@ -0,0 +1,87 @@
+package commands
+
+import (
+	ctls "crypto/tls"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	utilstls "github.com/argoproj/argo-cd/v3/util/tls"
+)
+
+func TestNewCommand_DisableTLSFlag(t *testing.T) {
+	cmd := NewCommand()
+
+	flag := cmd.Flags().Lookup("disable-tls")
+	require.NotNil(t, flag)
+	assert.Equal(t, "false", flag.DefValue)
+
+	require.NoError(t, cmd.Flags().Set("disable-tls", "true"))
+	value, err := cmd.Flags().GetBool("disable-tls")
+	require.NoError(t, err)
+	assert.True(t, value)
+}
+
+func TestNewCommand_DisableTLSAndClientCAPathAreMutuallyExclusive(t *testing.T) {
+	t.Setenv("ARGOCD_EXEC_TIMEOUT", "1ms")
+
+	cmd := NewCommand()
+	cmd.SetArgs([]string{"--disable-tls", "--client-ca-path", "/tmp/client-ca.crt"})
+
+	err := cmd.Execute()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "--client-ca-path cannot be used when --disable-tls is enabled")
+}
+
+func TestBuildHealthCheckTLSConfig_NilCert(t *testing.T) {
+	cfg := buildHealthCheckTLSConfig(nil, false)
+
+	assert.False(t, cfg.StrictValidation, "strict validation must be off: the probe verifies itself over localhost")
+	assert.Empty(t, cfg.ClientCertificates, "no client cert must be present when mTLS is not active")
+	assert.Nil(t, cfg.Certificates, "no CA pool must be set: server-cert verification is skipped for localhost probes")
+	assert.False(t, cfg.DisableTLS, "TLS itself must not be disabled: it is still a TLS connection")
+}
+
+func TestBuildHealthCheckTLSConfig_WithCert(t *testing.T) {
+	hcCert, err := utilstls.GenerateHealthCheckClientCert()
+	require.NoError(t, err)
+	require.NotNil(t, hcCert)
+
+	cfg := buildHealthCheckTLSConfig(hcCert, false)
+
+	assert.False(t, cfg.StrictValidation, "server-cert verification is always skipped for localhost self-connections")
+	require.Len(t, cfg.ClientCertificates, 1, "the ephemeral health-check cert must appear as the client identity")
+	assert.Equal(t, hcCert.Certificate[0], cfg.ClientCertificates[0].Certificate[0], "the propagated cert bytes must match the ephemeral cert exactly")
+	assert.Nil(t, cfg.Certificates, "no CA pool must be set: server-cert verification is skipped")
+}
+
+func TestBuildHealthCheckTLSConfig_IsIdempotent(t *testing.T) {
+	hcCert, err := utilstls.GenerateHealthCheckClientCert()
+	require.NoError(t, err)
+
+	cfg1 := buildHealthCheckTLSConfig(hcCert, false)
+	cfg2 := buildHealthCheckTLSConfig(hcCert, false)
+
+	assert.Equal(t, cfg1.StrictValidation, cfg2.StrictValidation)
+	assert.Equal(t, cfg1.DisableTLS, cfg2.DisableTLS)
+	require.Len(t, cfg1.ClientCertificates, 1)
+	require.Len(t, cfg2.ClientCertificates, 1)
+	assert.Equal(t, cfg1.ClientCertificates[0].Certificate[0], cfg2.ClientCertificates[0].Certificate[0],
+		"repeated calls must return equivalent configs with no shared mutable state")
+}
+
+func TestBuildHealthCheckTLSConfig_MutatingReturnedCertDoesNotAffectSource(t *testing.T) {
+	hcCert, err := utilstls.GenerateHealthCheckClientCert()
+	require.NoError(t, err)
+
+	originalDER := make([]byte, len(hcCert.Certificate[0]))
+	copy(originalDER, hcCert.Certificate[0])
+
+	cfg := buildHealthCheckTLSConfig(hcCert, false)
+	require.Len(t, cfg.ClientCertificates, 1)
+
+	cfg.ClientCertificates[0] = ctls.Certificate{}
+
+	assert.Equal(t, originalDER, hcCert.Certificate[0], "mutating the returned config must not affect the source certificate")
+}

cmd/argocd-server/commands/argocd_server.go

@@ -102,6 +102,8 @@ func NewCommand() *cobra.Command {
 
 		// argocd k8s event logging flag
 		enableK8sEvent []string
+
+		repoServerClientTLSConfigSrc func() (tls.Configuration, error)
 	)
 	command := &cobra.Command{
 		Use:               common.CommandServer,
@@ -156,10 +158,10 @@ func NewCommand() *cobra.Command {
 				appclientsetConfig = kube.AddFailureRetryWrapper(appclientsetConfig, failureRetryCount, failureRetryPeriodMilliSeconds)
 			}
 			appClientSet := appclientset.NewForConfigOrDie(appclientsetConfig)
-			tlsConfig := apiclient.TLSConfiguration{
-				DisableTLS:       repoServerPlaintext,
-				StrictValidation: repoServerStrictTLS,
-			}
+			tlsConfig, err := repoServerClientTLSConfigSrc()
+			errors.CheckError(err)
+			tlsConfig.DisableTLS = repoServerPlaintext
+			tlsConfig.StrictValidation = tlsConfig.StrictValidation || repoServerStrictTLS
 
 			dynamicClient := dynamic.NewForConfigOrDie(config)
 
@@ -172,9 +174,11 @@ func NewCommand() *cobra.Command {
 			controllerClient = client.NewDryRunClient(controllerClient)
 			controllerClient = client.NewNamespacedClient(controllerClient, namespace)
 
-			// Load CA information to use for validating connections to the
-			// repository server, if strict TLS validation was requested.
-			if !repoServerPlaintext && repoServerStrictTLS {
+			// Load CA information to use for validating connections to the repository server, if strict TLS validation
+			// was requested.
+			// Skip loading the embedded cert if the operator already provided anδ explicit CA via --repo-server-ca-cert;
+			// that pool takes precedence.
+			if !repoServerPlaintext && repoServerStrictTLS && tlsConfig.Certificates == nil {
 				pool, err := tls.LoadX509CertPool(
 					env.StringFromEnv(common.EnvAppConfigPath, common.DefaultAppConfigPath)+"/server/tls/tls.crt",
 					env.StringFromEnv(common.EnvAppConfigPath, common.DefaultAppConfigPath)+"/server/tls/ca.crt",
@@ -326,6 +330,7 @@ func NewCommand() *cobra.Command {
 	command.Flags().StringVar(&contentSecurityPolicy, "content-security-policy", env.StringFromEnv("ARGOCD_SERVER_CONTENT_SECURITY_POLICY", "frame-ancestors 'self';"), "Set Content-Security-Policy header in HTTP responses to `value`. To disable, set to \"\".")
 	command.Flags().BoolVar(&repoServerPlaintext, "repo-server-plaintext", env.ParseBoolFromEnv("ARGOCD_SERVER_REPO_SERVER_PLAINTEXT", false), "Use a plaintext client (non-TLS) to connect to repository server")
 	command.Flags().BoolVar(&repoServerStrictTLS, "repo-server-strict-tls", env.ParseBoolFromEnv("ARGOCD_SERVER_REPO_SERVER_STRICT_TLS", false), "Perform strict validation of TLS certificates when connecting to repo server")
+	errors.CheckError(command.Flags().MarkDeprecated("repo-server-strict-tls", "use --repo-server-ca-cert-path instead"))
 	command.Flags().BoolVar(&dexServerPlaintext, "dex-server-plaintext", env.ParseBoolFromEnv("ARGOCD_SERVER_DEX_SERVER_PLAINTEXT", false), "Use a plaintext client (non-TLS) to connect to dex server")
 	command.Flags().BoolVar(&dexServerStrictTLS, "dex-server-strict-tls", env.ParseBoolFromEnv("ARGOCD_SERVER_DEX_SERVER_STRICT_TLS", false), "Perform strict validation of TLS certificates when connecting to dex server")
 	command.Flags().StringSliceVar(&applicationNamespaces, "application-namespaces", env.StringsFromEnv("ARGOCD_APPLICATION_NAMESPACES", []string{}, ","), "List of additional namespaces where application resources can be managed in")
@@ -344,6 +349,7 @@ func NewCommand() *cobra.Command {
 	command.Flags().BoolVar(&enableNewGitFileGlobbing, "appset-enable-new-git-file-globbing", env.ParseBoolFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_NEW_GIT_FILE_GLOBBING", false), "Enable new globbing in Git files generator.")
 	command.Flags().BoolVar(&enableGitHubAPIMetrics, "appset-enable-github-api-metrics", env.ParseBoolFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_GITHUB_API_METRICS", false), "Enable GitHub API metrics for generators that use the GitHub API")
 
+	repoServerClientTLSConfigSrc = tls.AddClientTLSFlagsToCmdWithPrefix(command, "SERVER")
 	tlsConfigCustomizerSrc = tls.AddTLSFlagsToCmd(command)
 	cacheSrc = servercache.AddCacheFlagsToCmd(command, cacheutil.Options{
 		OnClientCreated: func(client *redis.Client) {

cmd/argocd-server/commands/argocd_server_test.go

@@ -0,0 +1,137 @@
+package commands
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewCommand_RegistersMTLSFlags(t *testing.T) {
+	cmd := NewCommand()
+
+	for _, flagName := range []string{
+		"repo-server-ca-cert-path",
+		"repo-server-client-cert-path",
+		"repo-server-client-cert-key-path",
+	} {
+		assert.NotNilf(t, cmd.Flags().Lookup(flagName),
+			"expected flag %q to be registered on argocd-server command", flagName)
+	}
+}
+
+func TestNewCommand_MTLSFlagDefaults(t *testing.T) {
+	cmd := NewCommand()
+
+	caCert, err := cmd.Flags().GetString("repo-server-ca-cert-path")
+	require.NoError(t, err)
+	assert.Empty(t, caCert, "repo-server-ca-cert-path default must be empty")
+
+	clientCert, err := cmd.Flags().GetString("repo-server-client-cert-path")
+	require.NoError(t, err)
+	assert.Equal(t, "/app/config/reposerver/mtls/client.crt", clientCert, "repo-server-client-cert-path must default to the auto-mounted Secret path")
+
+	clientCertKey, err := cmd.Flags().GetString("repo-server-client-cert-key-path")
+	require.NoError(t, err)
+	assert.Equal(t, "/app/config/reposerver/mtls/client.key", clientCertKey, "repo-server-client-cert-key-path must default to the auto-mounted Secret path")
+}
+
+func TestNewCommand_MTLSEnvVarPrefix(t *testing.T) {
+	t.Setenv("ARGOCD_SERVER_REPO_SERVER_CA_CERT_PATH", "/etc/certs/ca.crt")
+	t.Setenv("ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_PATH", "/etc/certs/client.crt")
+	t.Setenv("ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_KEY_PATH", "/etc/certs/client.key")
+
+	// NewCommand reads env vars at flag-definition time.
+	cmd := NewCommand()
+
+	caCert, err := cmd.Flags().GetString("repo-server-ca-cert-path")
+	require.NoError(t, err)
+	assert.Equal(t, "/etc/certs/ca.crt", caCert)
+
+	clientCert, err := cmd.Flags().GetString("repo-server-client-cert-path")
+	require.NoError(t, err)
+	assert.Equal(t, "/etc/certs/client.crt", clientCert)
+
+	clientCertKey, err := cmd.Flags().GetString("repo-server-client-cert-key-path")
+	require.NoError(t, err)
+	assert.Equal(t, "/etc/certs/client.key", clientCertKey)
+}
+
+func TestNewCommand_MTLSEnvVarNotOverriddenByOtherComponents(t *testing.T) {
+	t.Setenv("ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH", "/wrong/ca.crt")
+
+	cmd := NewCommand()
+
+	caCert, err := cmd.Flags().GetString("repo-server-ca-cert-path")
+	require.NoError(t, err)
+	assert.Empty(t, caCert,
+		"APPLICATION_CONTROLLER env var must not affect argocd-server's repo-server-ca-cert-path flag")
+}
+
+func TestNewCommand_MTLSFlagsCanBeSetExplicitly(t *testing.T) {
+	cmd := NewCommand()
+
+	require.NoError(t, cmd.Flags().Set("repo-server-ca-cert-path", "/runtime/ca.crt"))
+	require.NoError(t, cmd.Flags().Set("repo-server-client-cert-path", "/runtime/client.crt"))
+	require.NoError(t, cmd.Flags().Set("repo-server-client-cert-key-path", "/runtime/client.key"))
+
+	caCert, err := cmd.Flags().GetString("repo-server-ca-cert-path")
+	require.NoError(t, err)
+	assert.Equal(t, "/runtime/ca.crt", caCert)
+
+	clientCert, err := cmd.Flags().GetString("repo-server-client-cert-path")
+	require.NoError(t, err)
+	assert.Equal(t, "/runtime/client.crt", clientCert)
+
+	clientCertKey, err := cmd.Flags().GetString("repo-server-client-cert-key-path")
+	require.NoError(t, err)
+	assert.Equal(t, "/runtime/client.key", clientCertKey)
+}
+
+func TestNewCommand_RepoServerCACertTakesPrecedenceOverEmbeddedCert(t *testing.T) {
+	caCertPath := filepath.Join("..", "..", "util", "tls", "testdata", "valid_tls.crt")
+
+	cmd := NewCommand()
+
+	require.NoError(t, cmd.Flags().Set("repo-server-ca-cert-path", caCertPath))
+	require.NoError(t, cmd.Flags().Set("repo-server-strict-tls", "true"))
+	tlsConfigSrcFlag := cmd.Flags().Lookup("repo-server-ca-cert-path")
+	require.NotNil(t, tlsConfigSrcFlag,
+		"--repo-server-ca-cert-path must be registered; if missing the wiring in NewCommand() is broken")
+
+	assert.Equal(t, caCertPath, tlsConfigSrcFlag.Value.String())
+}
+
+func TestNewCommand_StrictTLSWithoutCACertGuardIsAbsent(t *testing.T) {
+	cmd := NewCommand()
+
+	caCertFlag := cmd.Flags().Lookup("repo-server-ca-cert-path")
+	require.NotNil(t, caCertFlag)
+	assert.Empty(t, caCertFlag.Value.String(),
+		"repo-server-ca-cert-path must default to empty so the embedded-cert block is not bypassed")
+
+	require.NoError(t, cmd.Flags().Set("repo-server-strict-tls", "true"))
+
+	strictFlag := cmd.Flags().Lookup("repo-server-strict-tls")
+	require.NotNil(t, strictFlag)
+	assert.Equal(t, "true", strictFlag.Value.String())
+}
+
+func TestNewCommand_CACertFlagRegistrationAndDefault(t *testing.T) {
+	cmd := NewCommand()
+
+	f := cmd.Flags().Lookup("repo-server-ca-cert-path")
+	require.NotNil(t, f, "flag \"repo-server-ca-cert-path\" must be registered on argocd-server")
+	assert.Empty(t, f.DefValue, "flag \"repo-server-ca-cert-path\" must default to empty string")
+
+	clientCertFlag := cmd.Flags().Lookup("repo-server-client-cert-path")
+	require.NotNil(t, clientCertFlag, "flag \"repo-server-client-cert-path\" must be registered on argocd-server")
+	assert.Equal(t, "/app/config/reposerver/mtls/client.crt", clientCertFlag.DefValue,
+		"flag \"repo-server-client-cert-path\" must default to the auto-mounted Secret path")
+
+	clientCertKeyFlag := cmd.Flags().Lookup("repo-server-client-cert-key-path")
+	require.NotNil(t, clientCertKeyFlag, "flag \"repo-server-client-cert-key-path\" must be registered on argocd-server")
+	assert.Equal(t, "/app/config/reposerver/mtls/client.key", clientCertKeyFlag.DefValue,
+		"flag \"repo-server-client-cert-key-path\" must default to the auto-mounted Secret path")
+}

cmd/argocd/commands/admin/app.go

@@ -22,6 +22,8 @@ import (
 	"k8s.io/client-go/tools/clientcmd"
 	"sigs.k8s.io/yaml"
 
+	"github.com/argoproj/argo-cd/v3/util/tls"
+
 	cmdutil "github.com/argoproj/argo-cd/v3/cmd/util"
 	"github.com/argoproj/argo-cd/v3/common"
 	"github.com/argoproj/argo-cd/v3/controller"
@@ -298,7 +300,7 @@ func NewReconcileCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command
 					errors.CheckError(err)
 					repoServerAddress = fmt.Sprintf("localhost:%d", repoServerPort)
 				}
-				repoServerClient := reposerverclient.NewRepoServerClientset(repoServerAddress, 60, reposerverclient.TLSConfiguration{DisableTLS: false, StrictValidation: false})
+				repoServerClient := reposerverclient.NewRepoServerClientset(repoServerAddress, 60, tls.Configuration{DisableTLS: false, StrictValidation: false})
 				result, err = reconcileApplications(ctx, kubeClientset, appClientset, namespace, repoServerClient, selector, newLiveStateCache, serverSideDiff, ignoreNormalizerOpts)
 				errors.CheckError(err)
 			} else {

cmd/argocd/commands/admin/notifications.go

@@ -33,6 +33,8 @@ func NewNotificationsCommand() *cobra.Command {
 
 	var argocdService service.Service
 
+	var repoServerClientTLSConfigSrc func() (tls.Configuration, error)
+
 	toolsCommand := cmd.NewToolsCommand(
 		"notifications",
 		"argocd admin notifications",
@@ -47,11 +49,13 @@ func NewNotificationsCommand() *cobra.Command {
 			if err != nil {
 				log.Fatalf("Failed to parse k8s config: %v", err)
 			}
-			tlsConfig := apiclient.TLSConfiguration{
-				DisableTLS:       argocdRepoServerPlaintext,
-				StrictValidation: argocdRepoServerStrictTLS,
+			tlsConfig, err := repoServerClientTLSConfigSrc()
+			if err != nil {
+				log.Fatalf("Failed to get repo-server client TLS configuration: %v", err)
 			}
-			if !tlsConfig.DisableTLS && tlsConfig.StrictValidation {
+			tlsConfig.DisableTLS = argocdRepoServerPlaintext
+			tlsConfig.StrictValidation = argocdRepoServerStrictTLS || tlsConfig.StrictValidation
+			if !tlsConfig.DisableTLS && tlsConfig.StrictValidation && tlsConfig.Certificates == nil {
 				pool, err := tls.LoadX509CertPool(
 					env.StringFromEnv(common.EnvAppConfigPath, common.DefaultAppConfigPath)+"/reposerver/tls/tls.crt",
 					env.StringFromEnv(common.EnvAppConfigPath, common.DefaultAppConfigPath)+"/reposerver/tls/ca.crt",
@@ -74,5 +78,9 @@ func NewNotificationsCommand() *cobra.Command {
 	toolsCommand.PersistentFlags().StringVar(&argocdRepoServer, "argocd-repo-server", common.DefaultRepoServerAddr, "Argo CD repo server address")
 	toolsCommand.PersistentFlags().BoolVar(&argocdRepoServerPlaintext, "argocd-repo-server-plaintext", false, "Use a plaintext client (non-TLS) to connect to repository server")
 	toolsCommand.PersistentFlags().BoolVar(&argocdRepoServerStrictTLS, "argocd-repo-server-strict-tls", false, "Perform strict validation of TLS certificates when connecting to repo server")
+	if err := toolsCommand.PersistentFlags().MarkDeprecated("argocd-repo-server-strict-tls", "use --argocd-repo-server-ca-cert-path instead"); err != nil {
+		log.Fatal(err)
+	}
+	repoServerClientTLSConfigSrc = tls.AddClientTLSFlagsToCmd(toolsCommand)
 	return toolsCommand
 }

cmd/argocd/commands/headless/headless.go

@@ -23,6 +23,8 @@ import (
 	"k8s.io/client-go/tools/clientcmd"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
+	"github.com/argoproj/argo-cd/v3/util/tls"
+
 	"github.com/argoproj/argo-cd/v3/cmd/argocd/commands/initialize"
 	"github.com/argoproj/argo-cd/v3/common"
 	"github.com/argoproj/argo-cd/v3/pkg/apiclient"
@@ -143,7 +145,7 @@ func (c *forwardRepoClientset) NewRepoServerClient() (utilio.Closer, repoapiclie
 			c.err = err
 			return
 		}
-		c.repoClientset = repoapiclient.NewRepoServerClientset(fmt.Sprintf("localhost:%d", repoServerPort), 60, repoapiclient.TLSConfiguration{
+		c.repoClientset = repoapiclient.NewRepoServerClientset(fmt.Sprintf("localhost:%d", repoServerPort), 60, tls.Configuration{
 			DisableTLS: false, StrictValidation: false,
 		})
 	})

cmd/argocd/commands/testdata/local.config

@@ -0,0 +1,25 @@
+contexts:
+- name: argocd1.example.com:443
+  server: argocd1.example.com:443
+  user: argocd1.example.com:443
+- name: argocd2.example.com:443
+  server: argocd2.example.com:443
+  user: argocd2.example.com:443
+- name: localhost:8080
+  server: localhost:8080
+  user: localhost:8080
+current-context: localhost:8080
+servers:
+- server: argocd1.example.com:443
+- server: argocd2.example.com:443
+- plain-text: true
+  server: localhost:8080
+users:
+- auth-token: vErrYS3c3tReFRe$hToken
+  name: argocd1.example.com:443
+  refresh-token: vErrYS3c3tReFRe$hToken
+- auth-token: vErrYS3c3tReFRe$hToken
+  name: argocd2.example.com:443
+  refresh-token: vErrYS3c3tReFRe$hToken
+- auth-token: vErrYS3c3tReFRe$hToken
+  name: localhost:8080

docs/operator-manual/argocd-cmd-params-cm.yaml

@@ -50,6 +50,12 @@ data:
   controller.repo.server.plaintext: "false"
   # Whether to use strict validation of the TLS cert presented by the repo server
   controller.repo.server.strict.tls: "false"
+  # Path to the CA certificate file for verifying the repo server's TLS certificate 
+  controller.repo.server.ca.cert.path: ""
+  # Path to the client certificate file for mTLS connections to repo server
+  controller.repo.server.client.cert.path: ""
+  # Path to the client certificate key file for mTLS connections to repo server
+  controller.repo.server.client.cert.key.path: ""
   # Number of application status processors (default 20)
   controller.status.processors: "20"
   # Number of application operation processors (default 10)
@@ -171,6 +177,12 @@ data:
   server.repo.server.plaintext: "false"
   # Perform strict validation of TLS certificates when connecting to repo server
   server.repo.server.strict.tls: "false"
+  # Path to the CA certificate file for verifying the repo server's TLS certificate (enables mTLS CA verification)
+  server.repo.server.ca.cert.path: ""
+  # Path to the client certificate file for mTLS connections to repo server
+  server.repo.server.client.cert.path: ""
+  # Path to the client certificate key file for mTLS connections to repo server
+  server.repo.server.client.cert.key.path: ""
   # Dex server address (default "http://argocd-dex-server:5556")
   server.dex.server: "http://argocd-dex-server:5556"
   # Use a plaintext client (non-TLS) to connect to dex server
@@ -246,6 +258,8 @@ data:
   reposerver.tls.maxversion: "1.3"
   # The list of acceptable ciphers to be used when establishing TLS connections. Use 'list' to list available ciphers. (default "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384")
   reposerver.tls.ciphers: "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
+  # Path to the client CA certificate file for mTLS. if the file is not found or empty, mTLS is disabled.
+  reposerver.client.ca.path: ""
   # Cache expiration for repo state, incl. app lists, app details, manifest generation, revision meta-data (default 24h0m0s)
   reposerver.repo.cache.expiration: "24h0m0s"
   # Cache expiration default (default 24h0m0s)
@@ -395,6 +409,12 @@ data:
   # _grpc_config.<hostname> are disabled to prevent excessive DNS queries that can cause timeouts in dual-stack environments.
   # See https://github.com/argoproj/argo-cd/issues/24991
   applicationsetcontroller.grpc.enable.txt.service.config: "false"
+  # Path to the CA certificate file for verifying the repo server's TLS certificate (enables mTLS CA verification)
+  applicationsetcontroller.repo.server.ca.cert.path: ""
+  # Path to the client certificate file for mTLS connections to repo server
+  applicationsetcontroller.repo.server.client.cert.path: ""
+  # Path to the client certificate key file for mTLS connections to repo server
+  applicationsetcontroller.repo.server.client.cert.key.path: ""
 
   ## Argo CD Notifications Controller Properties
   # Set the logging level. One of: debug|info|warn|error (default "info")
@@ -407,3 +427,9 @@ data:
   notificationscontroller.selfservice.enabled: "false"
   # Disable TLS on connections to repo server
   notificationscontroller.repo.server.plaintext: "false"
+  # Path to the CA certificate file for verifying the repo server's TLS certificate (enables mTLS CA verification)
+  notificationscontroller.repo.server.ca.cert.path: ""
+  # Path to the client certificate file for mTLS connections to repo server
+  notificationscontroller.repo.server.client.cert.path: ""
+  # Path to the client certificate key file for mTLS connections to repo server
+  notificationscontroller.repo.server.client.cert.key.path: ""

docs/operator-manual/mtls.md

@@ -0,0 +1,249 @@
+# Mutual TLS (mTLS) for repo-server
+
+> [!TIP]
+> Looking for general TLS setup across Argo CD components? See [TLS configuration](./tls.md).
+
+Argo CD supports mutual TLS (mTLS) between the `argocd-server` (API server), `argocd-application-controller`, `argocd-applicationset-controller`, and the `argocd-repo-server`. This ensures the repo-server only accepts connections from authorized clients that present a valid client certificate.
+
+> [!NOTE]
+> The repo-server runs a gRPC endpoint with TLS by default. Enabling mTLS adds client certificate verification on top of server-side TLS.
+
+## Quickstart — default shared-cert setup
+
+This is the simplest and recommended way to enable mTLS. A single client certificate and key are shared by all client components (`argocd-server`, `argocd-application-controller`, `argocd-applicationset-controller`, and `argocd-notifications-controller`). Argo CD auto-mounts the Secret into every relevant deployment — no manual volume or volumeMount configuration is required.
+
+**Step 1 — Create the `argocd-repo-server-mtls` Secret** in the `argocd` namespace with the following keys:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: argocd-repo-server-mtls
+  namespace: argocd
+type: Opaque
+data:
+  # CA used by argocd-repo-server to verify incoming client certificates (enables mTLS)
+  client-ca.crt: <BASE64_CA_PEM>
+  # Shared client certificate and key presented by all client components
+  client.crt: <BASE64_CLIENT_CERT_PEM>
+  client.key: <BASE64_CLIENT_KEY_PEM>
+  # Optional: CA used by clients to verify the repo-server's own TLS certificate
+  # server-ca.crt: <BASE64_SERVER_CA_PEM>
+```
+
+The Secret is automatically mounted at `/app/config/reposerver/mtls` in every relevant pod. All components default to reading their cert/key/CA files from that mount path, so **mTLS is enabled automatically** as soon as the Secret exists — no ConfigMap changes or flag overrides are required.
+
+After creating the Secret, restart the affected deployments (or wait for the rollout). That is all that is needed for the default shared-cert mTLS setup.
+
+> [!NOTE]
+> When mTLS is enabled, the repo-server automatically generates an ephemeral client certificate for its own internal health-check (liveness) self-connection. You don't need to change the readiness/liveness probes. On startup you should see a log line similar to:
+>
+> `Generated ephemeral health-check client certificate (CN=<value>)`
+
+---
+
+## Reference
+
+The sections below document all available ConfigMap keys, environment variables, and advanced configuration options.
+
+## Enabling mTLS on repo-server
+
+To enable mTLS on the `argocd-repo-server`, provide a client CA certificate. When configured, the repo-server requires all clients to present a certificate signed by this CA.
+
+### Environment variables
+
+* `ARGOCD_REPO_SERVER_CLIENT_CA_PATH`: Equivalent to `--client-ca-path`. Defaults to `/app/config/reposerver/mtls/client-ca.crt`.
+* `ARGOCD_REPO_SERVER_DISABLE_TLS`: Equivalent to `--disable-tls`.
+
+### Server certificate location (repo-server)
+
+The repo-server's server certificate and key are read from:
+
+* `/app/config/reposerver/tls/tls.crt`
+* `/app/config/reposerver/tls/tls.key`
+
+## Configuring clients
+
+The `argocd-server`, `argocd-application-controller`, and `argocd-applicationset-controller` must be configured with a client certificate and key to connect to a repo-server that has mTLS enabled. The certificate must be signed by the same CA configured on the repo-server.
+
+> [!NOTE]
+> **Legacy path vs. recommended path for TLS certificate validation**
+>
+> `--repo-server-strict-tls` (and `--argocd-repo-server-strict-tls` for the notifications controller)
+> is the **legacy path**: when set, the component auto-discovers the repo-server certificate from
+> the `argocd-repo-server-tls` Kubernetes secret. This flag is **deprecated** and may be removed
+> in a future release.
+>
+> `--repo-server-ca-cert-path` (and `--argocd-repo-server-ca-cert-path` for the notifications controller)
+> is the **recommended explicit path**: you provide the path to a CA certificate file directly.
+> This is required for mTLS setups and gives you full control over which CA is trusted.
+> Use `--repo-server-ca-cert-path` in all new deployments.
+
+### argocd-cmd-params-cm ConfigMap keys
+
+These environment variables can also be set via the `argocd-cmd-params-cm` ConfigMap, which is the recommended approach for Kubernetes deployments:
+
+#### argocd-repo-server
+* `reposerver.client.ca.path` — path to the client CA certificate file; defaults to `/app/config/reposerver/mtls/client-ca.crt`. The repo-server requires all gRPC clients to present a certificate signed by this CA when the file exists. mTLS is silently skipped if the file is absent.
+
+#### argocd-server
+* `server.repo.server.ca.cert.path` — path to the CA certificate for verifying the repo server's TLS certificate
+* `server.repo.server.client.cert.path` — path to the client certificate for mTLS; defaults to `/app/config/reposerver/mtls/client.crt`
+* `server.repo.server.client.cert.key.path` — path to the client certificate key for mTLS; defaults to `/app/config/reposerver/mtls/client.key`
+
+#### argocd-application-controller
+* `controller.repo.server.ca.cert.path` — path to the CA certificate for verifying the repo server's TLS certificate
+* `controller.repo.server.client.cert.path` — path to the client certificate for mTLS; defaults to `/app/config/reposerver/mtls/client.crt`
+* `controller.repo.server.client.cert.key.path` — path to the client certificate key for mTLS; defaults to `/app/config/reposerver/mtls/client.key`
+
+#### argocd-applicationset-controller
+* `applicationsetcontroller.repo.server.ca.cert.path` — path to the CA certificate for verifying the repo server's TLS certificate
+* `applicationsetcontroller.repo.server.client.cert.path` — path to the client certificate for mTLS; defaults to `/app/config/reposerver/mtls/client.crt`
+* `applicationsetcontroller.repo.server.client.cert.key.path` — path to the client certificate key for mTLS; defaults to `/app/config/reposerver/mtls/client.key`
+
+#### argocd-notifications-controller
+* `notificationscontroller.repo.server.ca.cert.path` — path to the CA certificate for verifying the repo server's TLS certificate
+* `notificationscontroller.repo.server.client.cert.path` — path to the client certificate for mTLS; defaults to `/app/config/reposerver/mtls/client.crt`
+* `notificationscontroller.repo.server.client.cert.key.path` — path to the client certificate key for mTLS; defaults to `/app/config/reposerver/mtls/client.key`
+
+## Shared vs. per-component client certificates
+
+By default, the `argocd-repo-server-mtls` Secret uses a **single shared key/cert pair** (`client.crt` / `client.key`) that is mounted into every client component (`argocd-server`, `argocd-application-controller`, `argocd-applicationset-controller`, and `argocd-notifications-controller`). All components therefore present the same client certificate to the repo-server.
+
+This is enough for most deployments. If you need the repo-server to distinguish which component is connecting (for example, to apply per-component authorization policies), you must issue separate certificates per component and configure each deployment to use its own cert.
+
+> [!NOTE]
+> The repo-server only verifies that the client certificate is signed by the configured client CA. It does not enforce per-component identity by default. Per-component certs are only meaningful if you add your own authorization logic on top of mTLS.
+
+### Option A — Multiple keys in one Secret
+
+Store all component certs in the single `argocd-repo-server-mtls` Secret under different key names, then customize the volume `items` projection in each deployment to expose only the relevant cert.
+
+**1. Create the Secret with per-component keys:**
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: argocd-repo-server-mtls
+  namespace: argocd
+type: Opaque
+data:
+  client-ca.crt: <BASE64_CA_PEM>
+  # argocd-server client cert
+  server-client.crt: <BASE64_SERVER_CLIENT_CERT_PEM>
+  server-client.key: <BASE64_SERVER_CLIENT_KEY_PEM>
+  # argocd-application-controller client cert
+  controller-client.crt: <BASE64_CONTROLLER_CLIENT_CERT_PEM>
+  controller-client.key: <BASE64_CONTROLLER_CLIENT_KEY_PEM>
+  # argocd-applicationset-controller client cert
+  appsetcontroller-client.crt: <BASE64_APPSET_CLIENT_CERT_PEM>
+  appsetcontroller-client.key: <BASE64_APPSET_CLIENT_KEY_PEM>
+  # argocd-notifications-controller client cert
+  notifications-client.crt: <BASE64_NOTIFICATIONS_CLIENT_CERT_PEM>
+  notifications-client.key: <BASE64_NOTIFICATIONS_CLIENT_KEY_PEM>
+```
+
+**2. Patch each deployment's volume to project only the relevant keys as `client.crt` / `client.key`:**
+
+```yaml
+# Example patch for argocd-server deployment
+volumes:
+- name: argocd-repo-server-mtls
+  secret:
+    secretName: argocd-repo-server-mtls
+    items:
+    - key: server-client.crt
+      path: client.crt
+    - key: server-client.key
+      path: client.key
+    - key: client-ca.crt
+      path: client-ca.crt
+```
+
+Repeat with the appropriate key names for each component deployment. The mount path and ConfigMap keys remain unchanged — only the Secret `items` projection differs per deployment.
+
+### Option B — One Secret per component
+
+Create a separate Secret for each component. Each Secret follows the same format as `argocd-repo-server-mtls` but contains only that component's cert.
+
+**1. Create per-component Secrets:**
+
+```yaml
+# argocd-server
+apiVersion: v1
+kind: Secret
+metadata:
+  name: argocd-repo-server-mtls-server
+  namespace: argocd
+type: Opaque
+data:
+  client.crt: <BASE64_SERVER_CLIENT_CERT_PEM>
+  client.key: <BASE64_SERVER_CLIENT_KEY_PEM>
+---
+# argocd-application-controller
+apiVersion: v1
+kind: Secret
+metadata:
+  name: argocd-repo-server-mtls-controller
+  namespace: argocd
+type: Opaque
+data:
+  client.crt: <BASE64_CONTROLLER_CLIENT_CERT_PEM>
+  client.key: <BASE64_CONTROLLER_CLIENT_KEY_PEM>
+# ... repeat for argocd-applicationset-controller and argocd-notifications-controller
+```
+
+**2. Add a separate volume and volumeMount to each deployment, pointing to its own Secret:**
+
+```yaml
+# Example patch for argocd-server deployment
+volumes:
+- name: argocd-repo-server-mtls-server
+  secret:
+    secretName: argocd-repo-server-mtls-server
+volumeMounts:
+- name: argocd-repo-server-mtls-server
+  mountPath: /app/config/reposerver/mtls
+  readOnly: true
+```
+
+Repeat with the appropriate Secret name for each component deployment. The mount path and ConfigMap keys remain unchanged.
+
+> [!IMPORTANT]
+> With Option B, the default `argocd-repo-server-mtls` volume that Argo CD auto-mounts must be removed or overridden in each patched deployment, otherwise both volumes will compete for the same mount path.
+
+## No per-component enforcement on the server side
+
+Even if you configure separate client certificates per component (using Option A or Option B above), the repo-server **does not distinguish between them**. This is a fundamental characteristic of how the server-side TLS verification works, and operators should be aware of it before investing in per-component cert issuance.
+
+The repo-server is configured with a single `--client-ca-path` flag, which points to one CA certificate file. Internally, the repository server loads that file into a single `x509.CertPool`. When a client connects, the TLS layer asks one question: **"Is this certificate signed by the configured CA?"** If yes, the connection is accepted. If no, it is rejected.
+
+There is no binding between a specific component identity and a specific certificate. The server does not inspect the certificate's Subject, SAN, or any other field to determine *which* component is connecting. Any client that holds a certificate signed by the trusted CA will pass — regardless of whether it is `argocd-server`, `argocd-application-controller`, or any other process with access to a valid cert.
+
+All client certificates must be signed by a CA trusted by the repo-server. The `--client-ca-path` flag accepts a PEM file containing one or more CA certificates. 
+If you issue separate certs per component from different CAs, concatenate those CAs into a single bundle file and pass that bundle to `--client-ca-path`. 
+The server will trust any cert signed by any CA in the bundle, but will still not distinguish which component is connecting.
+
+> [!NOTE]
+> Per-component certificates are only meaningful if you implement your own authorization logic on top of mTLS — for example, an Envoy sidecar or a custom gRPC interceptor that inspects the peer certificate's Subject/SAN and enforces component-level access policies. Out of the box, Argo CD mTLS provides **authentication** (only cert-holding clients can connect) but not **authorization** (any authenticated client can call any RPC).
+
+## Verifying mTLS is active
+
+After deploying:
+
+1. Check repo-server logs for the health-check certificate message when `--client-ca-path` is set:
+
+   `Generated ephemeral health-check client certificate (CN=...)`
+
+2. Attempt a connection from a pod without the client certificate — it should fail with a TLS error due to missing client authentication.
+3. Connections from `argocd-server`/`argocd-application-controller`/`argocd-applicationset-controller` should succeed when configured with matching client cert/key.
+
+## Troubleshooting
+
+- Error: `--client-ca-path cannot be used when --disable-tls is enabled`
+  - Remove `--disable-tls` (or unset `ARGOCD_REPO_SERVER_DISABLE_TLS`) when enabling mTLS.
+- One of `--repo-server-client-cert-path` / `--repo-server-client-cert-key-path` missing
+  - Provide both flags (or the corresponding environment variables) together.
+- Custom CA for repo-server server certificate
+  - Provide `--repo-server-ca-cert-path` on clients so they can verify the repo-server's server certificate.

docs/operator-manual/notifications/troubleshooting-commands.md

@@ -27,31 +27,30 @@ argocd admin notifications template get app-sync-succeeded -o=yaml
 ### Options inherited from parent commands
 
 ```
-      --argocd-repo-server string       Argo CD repo server address (default "argocd-repo-server:8081")
-      --argocd-repo-server-plaintext    Use a plaintext client (non-TLS) to connect to repository server
-      --argocd-repo-server-strict-tls   Perform strict validation of TLS certificates when connecting to repo server
-      --as string                       Username to impersonate for the operation
-      --as-group stringArray            Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
-      --as-uid string                   UID to impersonate for the operation
-      --certificate-authority string    Path to a cert file for the certificate authority
-      --client-certificate string       Path to a client certificate file for TLS
-      --client-key string               Path to a client key file for TLS
-      --cluster string                  The name of the kubeconfig cluster to use
-      --config-map string               argocd-notifications-cm.yaml file path
-      --context string                  The name of the kubeconfig context to use
-      --disable-compression             If true, opt-out of response compression for all requests to the server
-      --insecure-skip-tls-verify        If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
-      --kubeconfig string               Path to a kube config. Only required if out-of-cluster
-  -n, --namespace string                If present, the namespace scope for this CLI request
-      --password string                 Password for basic authentication to the API server
-      --proxy-url string                If provided, this URL will be used to connect via proxy
-      --request-timeout string          The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
-      --secret string                   argocd-notifications-secret.yaml file path. Use empty secret if provided value is ':empty'
-      --server string                   The address and port of the Kubernetes API server
-      --tls-server-name string          If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
-      --token string                    Bearer token for authentication to the API server
-      --user string                     The name of the kubeconfig user to use
-      --username string                 Username for basic authentication to the API server
+      --argocd-repo-server string      Argo CD repo server address (default "argocd-repo-server:8081")
+      --argocd-repo-server-plaintext   Use a plaintext client (non-TLS) to connect to repository server
+      --as string                      Username to impersonate for the operation
+      --as-group stringArray           Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
+      --as-uid string                  UID to impersonate for the operation
+      --certificate-authority string   Path to a cert file for the certificate authority
+      --client-certificate string      Path to a client certificate file for TLS
+      --client-key string              Path to a client key file for TLS
+      --cluster string                 The name of the kubeconfig cluster to use
+      --config-map string              argocd-notifications-cm.yaml file path
+      --context string                 The name of the kubeconfig context to use
+      --disable-compression            If true, opt-out of response compression for all requests to the server
+      --insecure-skip-tls-verify       If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
+      --kubeconfig string              Path to a kube config. Only required if out-of-cluster
+  -n, --namespace string               If present, the namespace scope for this CLI request
+      --password string                Password for basic authentication to the API server
+      --proxy-url string               If provided, this URL will be used to connect via proxy
+      --request-timeout string         The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
+      --secret string                  argocd-notifications-secret.yaml file path. Use empty secret if provided value is ':empty'
+      --server string                  The address and port of the Kubernetes API server
+      --tls-server-name string         If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
+      --token string                   Bearer token for authentication to the API server
+      --user string                    The name of the kubeconfig user to use
+      --username string                Username for basic authentication to the API server
 ```
 
 ## argocd admin notifications template notify
@@ -84,31 +83,30 @@ argocd admin notifications template notify app-sync-succeeded guestbook
 ### Options inherited from parent commands
 
 ```
-      --argocd-repo-server string       Argo CD repo server address (default "argocd-repo-server:8081")
-      --argocd-repo-server-plaintext    Use a plaintext client (non-TLS) to connect to repository server
-      --argocd-repo-server-strict-tls   Perform strict validation of TLS certificates when connecting to repo server
-      --as string                       Username to impersonate for the operation
-      --as-group stringArray            Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
-      --as-uid string                   UID to impersonate for the operation
-      --certificate-authority string    Path to a cert file for the certificate authority
-      --client-certificate string       Path to a client certificate file for TLS
-      --client-key string               Path to a client key file for TLS
-      --cluster string                  The name of the kubeconfig cluster to use
-      --config-map string               argocd-notifications-cm.yaml file path
-      --context string                  The name of the kubeconfig context to use
-      --disable-compression             If true, opt-out of response compression for all requests to the server
-      --insecure-skip-tls-verify        If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
-      --kubeconfig string               Path to a kube config. Only required if out-of-cluster
-  -n, --namespace string                If present, the namespace scope for this CLI request
-      --password string                 Password for basic authentication to the API server
-      --proxy-url string                If provided, this URL will be used to connect via proxy
-      --request-timeout string          The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
-      --secret string                   argocd-notifications-secret.yaml file path. Use empty secret if provided value is ':empty'
-      --server string                   The address and port of the Kubernetes API server
-      --tls-server-name string          If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
-      --token string                    Bearer token for authentication to the API server
-      --user string                     The name of the kubeconfig user to use
-      --username string                 Username for basic authentication to the API server
+      --argocd-repo-server string      Argo CD repo server address (default "argocd-repo-server:8081")
+      --argocd-repo-server-plaintext   Use a plaintext client (non-TLS) to connect to repository server
+      --as string                      Username to impersonate for the operation
+      --as-group stringArray           Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
+      --as-uid string                  UID to impersonate for the operation
+      --certificate-authority string   Path to a cert file for the certificate authority
+      --client-certificate string      Path to a client certificate file for TLS
+      --client-key string              Path to a client key file for TLS
+      --cluster string                 The name of the kubeconfig cluster to use
+      --config-map string              argocd-notifications-cm.yaml file path
+      --context string                 The name of the kubeconfig context to use
+      --disable-compression            If true, opt-out of response compression for all requests to the server
+      --insecure-skip-tls-verify       If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
+      --kubeconfig string              Path to a kube config. Only required if out-of-cluster
+  -n, --namespace string               If present, the namespace scope for this CLI request
+      --password string                Password for basic authentication to the API server
+      --proxy-url string               If provided, this URL will be used to connect via proxy
+      --request-timeout string         The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
+      --secret string                  argocd-notifications-secret.yaml file path. Use empty secret if provided value is ':empty'
+      --server string                  The address and port of the Kubernetes API server
+      --tls-server-name string         If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
+      --token string                   Bearer token for authentication to the API server
+      --user string                    The name of the kubeconfig user to use
+      --username string                Username for basic authentication to the API server
 ```
 
 ## argocd admin notifications trigger get
@@ -140,31 +138,30 @@ argocd admin notifications trigger get on-sync-failed -o=yaml
 ### Options inherited from parent commands
 
 ```
-      --argocd-repo-server string       Argo CD repo server address (default "argocd-repo-server:8081")
-      --argocd-repo-server-plaintext    Use a plaintext client (non-TLS) to connect to repository server
-      --argocd-repo-server-strict-tls   Perform strict validation of TLS certificates when connecting to repo server
-      --as string                       Username to impersonate for the operation
-      --as-group stringArray            Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
-      --as-uid string                   UID to impersonate for the operation
-      --certificate-authority string    Path to a cert file for the certificate authority
-      --client-certificate string       Path to a client certificate file for TLS
-      --client-key string               Path to a client key file for TLS
-      --cluster string                  The name of the kubeconfig cluster to use
-      --config-map string               argocd-notifications-cm.yaml file path
-      --context string                  The name of the kubeconfig context to use
-      --disable-compression             If true, opt-out of response compression for all requests to the server
-      --insecure-skip-tls-verify        If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
-      --kubeconfig string               Path to a kube config. Only required if out-of-cluster
-  -n, --namespace string                If present, the namespace scope for this CLI request
-      --password string                 Password for basic authentication to the API server
-      --proxy-url string                If provided, this URL will be used to connect via proxy
-      --request-timeout string          The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
-      --secret string                   argocd-notifications-secret.yaml file path. Use empty secret if provided value is ':empty'
-      --server string                   The address and port of the Kubernetes API server
-      --tls-server-name string          If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
-      --token string                    Bearer token for authentication to the API server
-      --user string                     The name of the kubeconfig user to use
-      --username string                 Username for basic authentication to the API server
+      --argocd-repo-server string      Argo CD repo server address (default "argocd-repo-server:8081")
+      --argocd-repo-server-plaintext   Use a plaintext client (non-TLS) to connect to repository server
+      --as string                      Username to impersonate for the operation
+      --as-group stringArray           Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
+      --as-uid string                  UID to impersonate for the operation
+      --certificate-authority string   Path to a cert file for the certificate authority
+      --client-certificate string      Path to a client certificate file for TLS
+      --client-key string              Path to a client key file for TLS
+      --cluster string                 The name of the kubeconfig cluster to use
+      --config-map string              argocd-notifications-cm.yaml file path
+      --context string                 The name of the kubeconfig context to use
+      --disable-compression            If true, opt-out of response compression for all requests to the server
+      --insecure-skip-tls-verify       If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
+      --kubeconfig string              Path to a kube config. Only required if out-of-cluster
+  -n, --namespace string               If present, the namespace scope for this CLI request
+      --password string                Password for basic authentication to the API server
+      --proxy-url string               If provided, this URL will be used to connect via proxy
+      --request-timeout string         The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
+      --secret string                  argocd-notifications-secret.yaml file path. Use empty secret if provided value is ':empty'
+      --server string                  The address and port of the Kubernetes API server
+      --tls-server-name string         If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
+      --token string                   Bearer token for authentication to the API server
+      --user string                    The name of the kubeconfig user to use
+      --username string                Username for basic authentication to the API server
 ```
 
 ## argocd admin notifications trigger run
@@ -196,30 +193,29 @@ argocd admin notifications trigger run on-sync-status-unknown ./sample-app.yaml
 ### Options inherited from parent commands
 
 ```
-      --argocd-repo-server string       Argo CD repo server address (default "argocd-repo-server:8081")
-      --argocd-repo-server-plaintext    Use a plaintext client (non-TLS) to connect to repository server
-      --argocd-repo-server-strict-tls   Perform strict validation of TLS certificates when connecting to repo server
-      --as string                       Username to impersonate for the operation
-      --as-group stringArray            Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
-      --as-uid string                   UID to impersonate for the operation
-      --certificate-authority string    Path to a cert file for the certificate authority
-      --client-certificate string       Path to a client certificate file for TLS
-      --client-key string               Path to a client key file for TLS
-      --cluster string                  The name of the kubeconfig cluster to use
-      --config-map string               argocd-notifications-cm.yaml file path
-      --context string                  The name of the kubeconfig context to use
-      --disable-compression             If true, opt-out of response compression for all requests to the server
-      --insecure-skip-tls-verify        If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
-      --kubeconfig string               Path to a kube config. Only required if out-of-cluster
-  -n, --namespace string                If present, the namespace scope for this CLI request
-      --password string                 Password for basic authentication to the API server
-      --proxy-url string                If provided, this URL will be used to connect via proxy
-      --request-timeout string          The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
-      --secret string                   argocd-notifications-secret.yaml file path. Use empty secret if provided value is ':empty'
-      --server string                   The address and port of the Kubernetes API server
-      --tls-server-name string          If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
-      --token string                    Bearer token for authentication to the API server
-      --user string                     The name of the kubeconfig user to use
-      --username string                 Username for basic authentication to the API server
+      --argocd-repo-server string      Argo CD repo server address (default "argocd-repo-server:8081")
+      --argocd-repo-server-plaintext   Use a plaintext client (non-TLS) to connect to repository server
+      --as string                      Username to impersonate for the operation
+      --as-group stringArray           Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
+      --as-uid string                  UID to impersonate for the operation
+      --certificate-authority string   Path to a cert file for the certificate authority
+      --client-certificate string      Path to a client certificate file for TLS
+      --client-key string              Path to a client key file for TLS
+      --cluster string                 The name of the kubeconfig cluster to use
+      --config-map string              argocd-notifications-cm.yaml file path
+      --context string                 The name of the kubeconfig context to use
+      --disable-compression            If true, opt-out of response compression for all requests to the server
+      --insecure-skip-tls-verify       If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
+      --kubeconfig string              Path to a kube config. Only required if out-of-cluster
+  -n, --namespace string               If present, the namespace scope for this CLI request
+      --password string                Password for basic authentication to the API server
+      --proxy-url string               If provided, this URL will be used to connect via proxy
+      --request-timeout string         The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
+      --secret string                  argocd-notifications-secret.yaml file path. Use empty secret if provided value is ':empty'
+      --server string                  The address and port of the Kubernetes API server
+      --tls-server-name string         If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
+      --token string                   Bearer token for authentication to the API server
+      --user string                    The name of the kubeconfig user to use
+      --username string                Username for basic authentication to the API server
 ```
 

docs/operator-manual/server-commands/argocd-application-controller.md

@@ -67,8 +67,10 @@ argocd-application-controller [flags]
       --redisdb int                                               Redis database.
       --repo-error-grace-period-seconds int                       Grace period in seconds for ignoring consecutive errors while communicating with repo server. (default 180)
       --repo-server string                                        Repo server address. (default "argocd-repo-server:8081")
+      --repo-server-ca-cert-path string                           Path to the repo-server CA certificate file
+      --repo-server-client-cert-key-path string                   Path to the client certificate key file for mTLS. Defaults to the auto-mounted Secret path; mTLS client cert is skipped if the file does not exist. (default "/app/config/reposerver/mtls/client.key")
+      --repo-server-client-cert-path string                       Path to the client certificate file for mTLS. Defaults to the auto-mounted Secret path; mTLS client cert is skipped if the file does not exist. (default "/app/config/reposerver/mtls/client.crt")
       --repo-server-plaintext                                     Disable TLS on connections to repo server
-      --repo-server-strict-tls                                    Whether to use strict validation of the TLS cert presented by the repo server
       --repo-server-timeout-seconds int                           Repo server RPC call timeout seconds. (default 60)
       --request-timeout string                                    The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
       --self-heal-backoff-cap-seconds int                         Specifies max timeout of exponential backoff between application self heal attempts (default 300)

docs/operator-manual/server-commands/argocd-applicationset-controller.md

@@ -11,58 +11,60 @@ argocd-applicationset-controller [flags]
 ### Options
 
 ```
-      --allowed-scm-providers strings           The list of allowed custom SCM provider API URLs. This restriction does not apply to SCM or PR generators which do not accept a custom API URL. (Default: Empty = all)
-      --applicationset-namespaces strings       Argo CD applicationset namespaces
-      --argocd-repo-server string               Argo CD repo server address (default "argocd-repo-server:8081")
-      --as string                               Username to impersonate for the operation
-      --as-group stringArray                    Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
-      --as-uid string                           UID to impersonate for the operation
-      --cache-sync-period duration              Period at which the manager client cache is forcefully resynced with the Kubernetes API server. 0 disables periodic resync. (default 10h0m0s)
-      --certificate-authority string            Path to a cert file for the certificate authority
-      --client-certificate string               Path to a client certificate file for TLS
-      --client-key string                       Path to a client key file for TLS
-      --cluster string                          The name of the kubeconfig cluster to use
-      --concurrent-application-updates int      Number of concurrent Application create/update/delete operations per ApplicationSet reconcile. (default 1)
-      --concurrent-reconciliations int          Max concurrent reconciliations limit for the controller (default 10)
-      --context string                          The name of the kubeconfig context to use
-      --debug                                   Print debug logs. Takes precedence over loglevel
-      --disable-compression                     If true, opt-out of response compression for all requests to the server
-      --dry-run                                 Enable dry run mode
-      --enable-github-api-metrics               Enable GitHub API metrics for generators that use the GitHub API
-      --enable-leader-election                  Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.
-      --enable-new-git-file-globbing            Enable new globbing in Git files generator.
-      --enable-policy-override                  For security reason if 'policy' is set, it is not possible to override it at applicationSet level. 'allow-policy-override' allows user to define their own policy (default true)
-      --enable-progressive-syncs                Enable use of the experimental progressive syncs feature.
-      --enable-scm-providers                    Enable retrieving information from SCM providers, used by the SCM and PR generators (Default: true) (default true)
-  -h, --help                                    help for argocd-applicationset-controller
-      --insecure-skip-tls-verify                If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
-      --kubeconfig string                       Path to a kube config. Only required if out-of-cluster
-      --logformat string                        Set the logging format. One of: json|text (default "json")
-      --loglevel string                         Set the logging level. One of: debug|info|warn|error (default "info")
-      --max-resources-status-count int          Max number of resources stored in appset status. (default 5000)
-      --metrics-addr string                     The address the metric endpoint binds to. (default ":8080")
-      --metrics-applicationset-labels strings   List of Application labels that will be added to the argocd_applicationset_labels metric
-  -n, --namespace string                        If present, the namespace scope for this CLI request
-      --password string                         Password for basic authentication to the API server
-      --policy string                           Modify how application is synced between the generator and the cluster. Default is '' (empty), which means AppSets default to 'sync', but they may override that default. Setting an explicit value prevents AppSet-level overrides, unless --allow-policy-override is enabled. Explicit options are: 'sync' (create & update & delete), 'create-only', 'create-update' (no deletion), 'create-delete' (no update)
-      --preserved-annotations strings           Sets global preserved field values for annotations
-      --preserved-labels strings                Sets global preserved field values for labels
-      --probe-addr string                       The address the probe endpoint binds to. (default ":8081")
-      --proxy-url string                        If provided, this URL will be used to connect via proxy
-      --repo-server-plaintext                   Disable TLS on connections to repo server
-      --repo-server-strict-tls                  Whether to use strict validation of the TLS cert presented by the repo server
-      --repo-server-timeout-seconds int         Repo server RPC call timeout seconds. (default 60)
-      --request-timeout string                  The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
-      --scm-no-proxy string                     Comma-separated list of hosts that should bypass the --scm-proxy-url proxy.
-      --scm-proxy-url string                    HTTP/HTTPS proxy URL for outbound SCM provider API requests (GitHub, GitLab, etc.). Does NOT affect Kubernetes API server connectivity — use --proxy-url (kubectl flag) for that.
-      --scm-root-ca-path string                 Provide Root CA Path for self-signed TLS Certificates
-      --server string                           The address and port of the Kubernetes API server
-      --tls-server-name string                  If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
-      --token string                            Bearer token for authentication to the API server
-      --token-ref-strict-mode                   Set to true to require secrets referenced by SCM providers to have the argocd.argoproj.io/secret-type=scm-creds label set (Default: false)
-      --user string                             The name of the kubeconfig user to use
-      --username string                         Username for basic authentication to the API server
-      --webhook-addr string                     The address the webhook endpoint binds to. (default ":7000")
-      --webhook-parallelism-limit int           Number of webhook requests processed concurrently (default 50)
+      --allowed-scm-providers strings             The list of allowed custom SCM provider API URLs. This restriction does not apply to SCM or PR generators which do not accept a custom API URL. (Default: Empty = all)
+      --applicationset-namespaces strings         Argo CD applicationset namespaces
+      --argocd-repo-server string                 Argo CD repo server address (default "argocd-repo-server:8081")
+      --as string                                 Username to impersonate for the operation
+      --as-group stringArray                      Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
+      --as-uid string                             UID to impersonate for the operation
+      --cache-sync-period duration                Period at which the manager client cache is forcefully resynced with the Kubernetes API server. 0 disables periodic resync. (default 10h0m0s)
+      --certificate-authority string              Path to a cert file for the certificate authority
+      --client-certificate string                 Path to a client certificate file for TLS
+      --client-key string                         Path to a client key file for TLS
+      --cluster string                            The name of the kubeconfig cluster to use
+      --concurrent-application-updates int        Number of concurrent Application create/update/delete operations per ApplicationSet reconcile. (default 1)
+      --concurrent-reconciliations int            Max concurrent reconciliations limit for the controller (default 10)
+      --context string                            The name of the kubeconfig context to use
+      --debug                                     Print debug logs. Takes precedence over loglevel
+      --disable-compression                       If true, opt-out of response compression for all requests to the server
+      --dry-run                                   Enable dry run mode
+      --enable-github-api-metrics                 Enable GitHub API metrics for generators that use the GitHub API
+      --enable-leader-election                    Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.
+      --enable-new-git-file-globbing              Enable new globbing in Git files generator.
+      --enable-policy-override                    For security reason if 'policy' is set, it is not possible to override it at applicationSet level. 'allow-policy-override' allows user to define their own policy (default true)
+      --enable-progressive-syncs                  Enable use of the experimental progressive syncs feature.
+      --enable-scm-providers                      Enable retrieving information from SCM providers, used by the SCM and PR generators (Default: true) (default true)
+  -h, --help                                      help for argocd-applicationset-controller
+      --insecure-skip-tls-verify                  If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
+      --kubeconfig string                         Path to a kube config. Only required if out-of-cluster
+      --logformat string                          Set the logging format. One of: json|text (default "json")
+      --loglevel string                           Set the logging level. One of: debug|info|warn|error (default "info")
+      --max-resources-status-count int            Max number of resources stored in appset status. (default 5000)
+      --metrics-addr string                       The address the metric endpoint binds to. (default ":8080")
+      --metrics-applicationset-labels strings     List of Application labels that will be added to the argocd_applicationset_labels metric
+  -n, --namespace string                          If present, the namespace scope for this CLI request
+      --password string                           Password for basic authentication to the API server
+      --policy string                             Modify how application is synced between the generator and the cluster. Default is '' (empty), which means AppSets default to 'sync', but they may override that default. Setting an explicit value prevents AppSet-level overrides, unless --allow-policy-override is enabled. Explicit options are: 'sync' (create & update & delete), 'create-only', 'create-update' (no deletion), 'create-delete' (no update)
+      --preserved-annotations strings             Sets global preserved field values for annotations
+      --preserved-labels strings                  Sets global preserved field values for labels
+      --probe-addr string                         The address the probe endpoint binds to. (default ":8081")
+      --proxy-url string                          If provided, this URL will be used to connect via proxy
+      --repo-server-ca-cert-path string           Path to the repo-server CA certificate file
+      --repo-server-client-cert-key-path string   Path to the client certificate key file for mTLS. Defaults to the auto-mounted Secret path; mTLS client cert is skipped if the file does not exist. (default "/app/config/reposerver/mtls/client.key")
+      --repo-server-client-cert-path string       Path to the client certificate file for mTLS. Defaults to the auto-mounted Secret path; mTLS client cert is skipped if the file does not exist. (default "/app/config/reposerver/mtls/client.crt")
+      --repo-server-plaintext                     Disable TLS on connections to repo server
+      --repo-server-timeout-seconds int           Repo server RPC call timeout seconds. (default 60)
+      --request-timeout string                    The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
+      --scm-no-proxy string                       Comma-separated list of hosts that should bypass the --scm-proxy-url proxy.
+      --scm-proxy-url string                      HTTP/HTTPS proxy URL for outbound SCM provider API requests (GitHub, GitLab, etc.). Does NOT affect Kubernetes API server connectivity — use --proxy-url (kubectl flag) for that.
+      --scm-root-ca-path string                   Provide Root CA Path for self-signed TLS Certificates
+      --server string                             The address and port of the Kubernetes API server
+      --tls-server-name string                    If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
+      --token string                              Bearer token for authentication to the API server
+      --token-ref-strict-mode                     Set to true to require secrets referenced by SCM providers to have the argocd.argoproj.io/secret-type=scm-creds label set (Default: false)
+      --user string                               The name of the kubeconfig user to use
+      --username string                           Username for basic authentication to the API server
+      --webhook-addr string                       The address the webhook endpoint binds to. (default ":7000")
+      --webhook-parallelism-limit int             Number of webhook requests processed concurrently (default 50)
 ```
 

docs/operator-manual/server-commands/argocd-repo-server.md

@@ -17,10 +17,11 @@ argocd-repo-server [flags]
 ```
       --address string                                 Listen on given address for incoming connections (default "0.0.0.0")
       --allow-oob-symlinks                             Allow out-of-bounds symlinks in repositories (not recommended)
+      --client-ca-path string                          Path to the client CA certificate file for mTLS. Defaults to the auto-mounted Secret path; mTLS is skipped if the file does not exist. (default "/app/config/reposerver/mtls/client-ca.crt")
       --default-cache-expiration duration              Cache expiration default (default 24h0m0s)
       --disable-helm-manifest-max-extracted-size       Disable maximum size of helm manifest archives when extracted
       --disable-oci-manifest-max-extracted-size        Disable maximum size of oci manifest archives when extracted
-      --disable-tls                                    Disable TLS on the gRPC endpoint
+      --disable-tls                                    Disable TLS for the repo-server gRPC endpoint
       --enable-builtin-git-config                      Enable builtin git configuration options that are required for correct argocd-repo-server operation. (default true)
       --helm-manifest-max-extracted-size string        Maximum size of helm manifest archives when extracted (default "1G")
       --helm-registry-max-index-size string            Maximum size of registry index file (default "1G")

docs/operator-manual/server-commands/argocd-server.md

@@ -85,6 +85,9 @@ argocd-server [flags]
       --redisdb int                                     Redis database.
       --repo-cache-expiration duration                  Cache expiration for repo state, incl. app lists, app details, manifest generation, revision meta-data (default 24h0m0s)
       --repo-server string                              Repo server address (default "argocd-repo-server:8081")
+      --repo-server-ca-cert-path string                 Path to the repo-server CA certificate file
+      --repo-server-client-cert-key-path string         Path to the client certificate key file for mTLS. Defaults to the auto-mounted Secret path; mTLS client cert is skipped if the file does not exist. (default "/app/config/reposerver/mtls/client.key")
+      --repo-server-client-cert-path string             Path to the client certificate file for mTLS. Defaults to the auto-mounted Secret path; mTLS client cert is skipped if the file does not exist. (default "/app/config/reposerver/mtls/client.crt")
       --repo-server-default-cache-expiration duration   Cache expiration default (default 24h0m0s)
       --repo-server-plaintext                           Use a plaintext client (non-TLS) to connect to repository server
       --repo-server-redis string                        Redis server hostname and port (e.g. argocd-redis:6379). 
@@ -97,7 +100,6 @@ argocd-server [flags]
       --repo-server-redisdb int                         Redis database.
       --repo-server-sentinel stringArray                Redis sentinel hostname and port (e.g. argocd-redis-ha-announce-0:6379). 
       --repo-server-sentinelmaster string               Redis sentinel master group name. (default "master")
-      --repo-server-strict-tls                          Perform strict validation of TLS certificates when connecting to repo server
       --repo-server-timeout-seconds int                 Repo server RPC call timeout seconds. (default 60)
       --request-timeout string                          The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
       --revision-cache-expiration duration              Cache expiration for cached revision (default 3m0s)

docs/operator-manual/tls.md

@@ -1,5 +1,8 @@
 # TLS configuration
 
+> [!TIP]
+> Need repo-server mutual TLS between components? See [Mutual TLS (mTLS) for repo-server](./mtls.md).
+
 Argo CD provides three inbound TLS endpoints that can be configured:
 
 * The user-facing endpoint of the `argocd-server` workload, which serves the UI
@@ -28,13 +31,13 @@ their own dedicated Certificate Authority.
 
 ### Inter-Component TLS
 
-| Connection | Strict TLS Parameter | Plain Text Parameter | Default Behavior |
-|------------|---------------------|---------------------|------------------|
-| `argocd-server` → `argocd-repo-server` | `--repo-server-strict-tls` | `--repo-server-plaintext` | Non-validating TLS |
-| `argocd-server` → `argocd-dex-server` | `--dex-server-strict-tls` | `--dex-server-plaintext` | Non-validating TLS |
-| `argocd-application-controller` → `argocd-repo-server` | `--repo-server-strict-tls` | `--repo-server-plaintext` | Non-validating TLS |
-| `argocd-applicationset-controller` → `argocd-repo-server` | `--repo-server-strict-tls` | `--repo-server-plaintext` | Non-validating TLS |
-| `argocd-notifications-controller` → `argocd-repo-server` | `--argocd-repo-server-strict-tls` | `--argocd-repo-server-plaintext` | Non-validating TLS |
+| Connection | Recommended Parameter | Legacy Parameter (deprecated) | Plain Text Parameter | Default Behavior |
+|------------|----------------------|-------------------------------|---------------------|------------------|
+| `argocd-server` → `argocd-repo-server` | `--repo-server-ca-cert-path` | `--repo-server-strict-tls` | `--repo-server-plaintext` | Non-validating TLS |
+| `argocd-server` → `argocd-dex-server` | — | `--dex-server-strict-tls` | `--dex-server-plaintext` | Non-validating TLS |
+| `argocd-application-controller` → `argocd-repo-server` | `--repo-server-ca-cert-path` | `--repo-server-strict-tls` | `--repo-server-plaintext` | Non-validating TLS |
+| `argocd-applicationset-controller` → `argocd-repo-server` | `--repo-server-ca-cert-path` | `--repo-server-strict-tls` | `--repo-server-plaintext` | Non-validating TLS |
+| `argocd-notifications-controller` → `argocd-repo-server` | `--argocd-repo-server-ca-cert-path` | `--argocd-repo-server-strict-tls` | `--argocd-repo-server-plaintext` | Non-validating TLS |
 
 ### Certificate Priority (argocd-server only)
 
@@ -198,14 +201,26 @@ To change this behavior to be more secure by having these components validate th
 * Restart the `argocd-repo-server` pod(s)
 * Modify the pod startup parameters for `argocd-server`, `argocd-application-controller`,
   and `argocd-applicationset-controller` to include the
-  `--repo-server-strict-tls` parameter.
+  `--repo-server-ca-cert-path` parameter pointing to the CA certificate file.
 * Modify the pod startup parameters for `argocd-notifications-controller` to include the
-  `--argocd-repo-server-strict-tls` parameter
+  `--argocd-repo-server-ca-cert-path` parameter pointing to the CA certificate file.
 
-The `argocd-server`, `argocd-application-controller`, `argocd-notifications-controller`, 
+The `argocd-server`, `argocd-application-controller`, `argocd-notifications-controller`,
 and `argocd-applicationset-controller` workloads will now
-validate the TLS certificate of the `argocd-repo-server` by using the
-certificate stored in the `argocd-repo-server-tls` secret.
+validate the TLS certificate of the `argocd-repo-server` using the provided CA certificate.
+
+> [!NOTE]
+> **Legacy path vs. recommended path**
+>
+> `--repo-server-strict-tls` (and `--argocd-repo-server-strict-tls` for the notifications controller)
+> is the **legacy path**: when set, the component auto-discovers the repo-server certificate from
+> the `argocd-repo-server-tls` Kubernetes secret. This flag is **deprecated** and may be removed
+> in a future release.
+>
+> `--repo-server-ca-cert-path` (and `--argocd-repo-server-ca-cert-path` for the notifications controller)
+> is the **recommended explicit path**: you provide the path to a CA certificate file directly.
+> This is required for mTLS setups and gives you full control over which CA is trusted.
+> See [Mutual TLS (mTLS) for repo-server](./mtls.md) for details.
 
 > [!NOTE]
 > **Certificate expiry**

docs/operator-manual/upgrading/3.4-3.5.md

@@ -182,3 +182,140 @@ Helm was upgraded to `4.2.1`, resulting in some breaking changes described in th
 For normal GitHub releases, **`sbom.tar.gz`** still includes **`bom-go-mod.spdx`** (Go dependencies, tag-value SPDX from `spdx-sbom-generator`) and **`bom-docker-image.spdx`** (the published release image, tag-value SPDX from `sigs.k8s.io/bom`). The UI dependency list is now **`bom-ui-pnpm.spdx.json`**: **SPDX 2.3 JSON** from **`pnpm sbom`**, replacing the old tag-value **`./ui`** output from `spdx-sbom-generator`.
 
 If you consume this archive with tooling that only looked at **`*.spdx`** files, extend it to handle **`bom-ui-pnpm.spdx.json`** as well, or verify **`sbom.tar.gz`** using **`argocd-sbom.intoto.jsonl`** without depending on a fixed internal file list.
+
+### mTLS support for repo-server
+
+mTLS is opt-in and disabled by default — no action is required for operators who do not configure it.
+
+To enable mTLS, create the `argocd-repo-server-mtls` Secret with the following keys:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: argocd-repo-server-mtls
+  namespace: argocd
+type: Opaque
+stringData:
+  client-ca.crt: |
+    <PEM-encoded CA certificate that signed the client certs>
+  client.crt: |
+    <PEM-encoded shared client certificate>
+  client.key: |
+    <PEM-encoded private key for the shared client certificate>
+```
+
+The Secret is automatically mounted at `/app/config/reposerver/mtls` in every relevant pod. All components default to reading their cert/key/CA files from that mount path, so **mTLS is enabled automatically as soon as the Secret exists** — no ConfigMap changes, flag overrides, or additional configuration are required.
+
+Key points:
+
+- Repo server (server-side):
+  - `--client-ca-path` defaults to `/app/config/reposerver/mtls/client-ca.crt` (the auto-mounted Secret path). mTLS is enabled when the file exists; silently skipped if absent.
+  - Cannot be combined with `--disable-tls`.
+  - Server TLS cert/key are loaded from `/app/config/reposerver/tls/tls.crt` and `/app/config/reposerver/tls/tls.key`.
+- Clients (argocd-server, application-controller, applicationset-controller, notifications-controller):
+  - `--repo-server-client-cert-path` defaults to `/app/config/reposerver/mtls/client.crt`; mTLS client cert is skipped if the file does not exist.
+  - `--repo-server-client-cert-key-path` defaults to `/app/config/reposerver/mtls/client.key`; mTLS client cert is skipped if the file does not exist.
+  - `--repo-server-ca-cert-path` is optional and used if the repo-server’s server certificate is signed by a custom CA.
+
+Operational notes:
+
+- When mTLS is enabled on repo-server, it automatically generates an ephemeral client certificate for its own liveness self-check; you do not need to modify probes.
+- Equivalent environment variables and `argocd-cmd-params-cm` ConfigMap keys exist for all settings above; see the linked docs for names and examples.
+
+See the dedicated [mTLS documentation](../mtls.md) for full setup instructions, per-component cert options, verification steps, and troubleshooting.
+
+
+### The --repo-server-strict-tls flag (deprecated in favor of --repo-server-ca-cert-path)
+
+The `--repo-server-strict-tls` boolean flag is deprecated across all components:
+- `argocd-server`
+- `argocd-application-controller`
+- `argocd-applicationset-controller`
+- `argocd-notification`
+
+**Reason for deprecation:** The old flag used implicit behavior (automatically loading embedded certificates from `/app/config/server/tls/`),
+making it difficult to maintain consistency across components. The new approach is more explicit and aligns with Kubernetes Secret mounting patterns.
+
+**Important:** This deprecation does **NOT** affect TLS capabilities. Operators can still configure TLS-only connections (without mTLS) using the new flag.
+
+#### Migration Guide
+
+The deprecated flag will continue to work in 3.5 (with warnings), but you should migrate to the new approach:
+
+**Option 1: Migrate to `--repo-server-ca-cert-path` (Recommended)**
+
+Replace the deprecated flag with an explicit CA certificate path:
+
+```bash
+# Before (3.4 and earlier):
+argocd-server \
+  --repo-server-strict-tls
+
+# After (3.5):
+argocd-server \
+  --repo-server-ca-cert-path=/app/config/server/tls/ca.crt
+```
+
+**Kubernetes manifests:**
+
+```yaml
+# Before:
+spec:
+  containers:
+  - name: argocd-server
+    args:
+    - argocd-server
+    - --repo-server-strict-tls
+    volumeMounts:
+    - name: server-tls
+      mountPath: /app/config/server/tls
+
+# After:
+spec:
+  containers:
+  - name: argocd-server
+    args:
+    - argocd-server
+    - --repo-server-ca-cert-path=/app/config/server/tls/ca.crt
+    volumeMounts:
+    - name: server-tls
+      mountPath: /app/config/server/tls
+```
+
+**Option 2: Use environment variable (Alternative)**
+
+Instead of a flag, use the corresponding environment variable:
+
+```bash
+# Before:
+argocd-server --repo-server-strict-tls
+
+# After:
+export ARGOCD_SERVER_REPO_SERVER_CA_CERT_PATH=/app/config/server/tls/ca.crt
+argocd-server
+```
+
+**Option 3: Continue using deprecated flag (Not recommended, temporary only)**
+
+The flag will continue to work in 3.5 but will issue a deprecation warning. Using both flags together is supported:
+
+```bash
+# This continues to work in 3.5 (but will show deprecation warning):
+argocd-server \
+  --repo-server-strict-tls \
+  --repo-server-ca-cert-path=/app/config/server/tls/ca.crt
+```
+
+#### Backward Compatibility
+
+- Both flags work together using OR semantics: if either is set to true, strict validation is enabled
+- No functionality is lost; TLS validation capabilities remain unchanged
+- The new flag is more explicit and maintainable
+
+#### Timeline
+
+- **v3.5:** Deprecated flag still works (with warnings)
+- **v3.6+:** Flag may be removed; plan migration accordingly
+
+All components affected (server, application-controller, applicationset-controller, notification-controller) follow the same migration pattern.

docs/user-guide/commands/argocd_admin_notifications.md

@@ -11,32 +11,34 @@ argocd admin notifications [flags]
 ### Options
 
 ```
-      --argocd-repo-server string       Argo CD repo server address (default "argocd-repo-server:8081")
-      --argocd-repo-server-plaintext    Use a plaintext client (non-TLS) to connect to repository server
-      --argocd-repo-server-strict-tls   Perform strict validation of TLS certificates when connecting to repo server
-      --as string                       Username to impersonate for the operation
-      --as-group stringArray            Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
-      --as-uid string                   UID to impersonate for the operation
-      --certificate-authority string    Path to a cert file for the certificate authority
-      --client-certificate string       Path to a client certificate file for TLS
-      --client-key string               Path to a client key file for TLS
-      --cluster string                  The name of the kubeconfig cluster to use
-      --config-map string               argocd-notifications-cm.yaml file path
-      --context string                  The name of the kubeconfig context to use
-      --disable-compression             If true, opt-out of response compression for all requests to the server
-  -h, --help                            help for notifications
-      --insecure-skip-tls-verify        If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
-      --kubeconfig string               Path to a kube config. Only required if out-of-cluster
-  -n, --namespace string                If present, the namespace scope for this CLI request
-      --password string                 Password for basic authentication to the API server
-      --proxy-url string                If provided, this URL will be used to connect via proxy
-      --request-timeout string          The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
-      --secret string                   argocd-notifications-secret.yaml file path. Use empty secret if provided value is ':empty'
-      --server string                   The address and port of the Kubernetes API server
-      --tls-server-name string          If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
-      --token string                    Bearer token for authentication to the API server
-      --user string                     The name of the kubeconfig user to use
-      --username string                 Username for basic authentication to the API server
+      --argocd-repo-server string                 Argo CD repo server address (default "argocd-repo-server:8081")
+      --argocd-repo-server-plaintext              Use a plaintext client (non-TLS) to connect to repository server
+      --as string                                 Username to impersonate for the operation
+      --as-group stringArray                      Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
+      --as-uid string                             UID to impersonate for the operation
+      --certificate-authority string              Path to a cert file for the certificate authority
+      --client-certificate string                 Path to a client certificate file for TLS
+      --client-key string                         Path to a client key file for TLS
+      --cluster string                            The name of the kubeconfig cluster to use
+      --config-map string                         argocd-notifications-cm.yaml file path
+      --context string                            The name of the kubeconfig context to use
+      --disable-compression                       If true, opt-out of response compression for all requests to the server
+  -h, --help                                      help for notifications
+      --insecure-skip-tls-verify                  If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
+      --kubeconfig string                         Path to a kube config. Only required if out-of-cluster
+  -n, --namespace string                          If present, the namespace scope for this CLI request
+      --password string                           Password for basic authentication to the API server
+      --proxy-url string                          If provided, this URL will be used to connect via proxy
+      --repo-server-ca-cert-path string           Path to the repo-server CA certificate file
+      --repo-server-client-cert-key-path string   Path to the client certificate key file for mTLS. Defaults to the auto-mounted Secret path; mTLS client cert is skipped if the file does not exist. (default "/app/config/reposerver/mtls/client.key")
+      --repo-server-client-cert-path string       Path to the client certificate file for mTLS. Defaults to the auto-mounted Secret path; mTLS client cert is skipped if the file does not exist. (default "/app/config/reposerver/mtls/client.crt")
+      --request-timeout string                    The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
+      --secret string                             argocd-notifications-secret.yaml file path. Use empty secret if provided value is ':empty'
+      --server string                             The address and port of the Kubernetes API server
+      --tls-server-name string                    If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
+      --token string                              Bearer token for authentication to the API server
+      --user string                               The name of the kubeconfig user to use
+      --username string                           Username for basic authentication to the API server
 ```
 
 ### Options inherited from parent commands

docs/user-guide/commands/argocd_admin_notifications_template.md

@@ -20,7 +20,6 @@ argocd admin notifications template [flags]
       --argocd-context string           The name of the Argo-CD server context to use
       --argocd-repo-server string       Argo CD repo server address (default "argocd-repo-server:8081")
       --argocd-repo-server-plaintext    Use a plaintext client (non-TLS) to connect to repository server
-      --argocd-repo-server-strict-tls   Perform strict validation of TLS certificates when connecting to repo server
       --as string                       Username to impersonate for the operation
       --as-group stringArray            Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
       --as-uid string                   UID to impersonate for the operation

docs/user-guide/commands/argocd_admin_notifications_template_get.md

@@ -32,7 +32,6 @@ argocd admin notifications template get app-sync-succeeded -o=yaml
       --argocd-context string           The name of the Argo-CD server context to use
       --argocd-repo-server string       Argo CD repo server address (default "argocd-repo-server:8081")
       --argocd-repo-server-plaintext    Use a plaintext client (non-TLS) to connect to repository server
-      --argocd-repo-server-strict-tls   Perform strict validation of TLS certificates when connecting to repo server
       --as string                       Username to impersonate for the operation
       --as-group stringArray            Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
       --as-uid string                   UID to impersonate for the operation

docs/user-guide/commands/argocd_admin_notifications_template_notify.md

@@ -33,7 +33,6 @@ argocd admin notifications template notify app-sync-succeeded guestbook
       --argocd-context string           The name of the Argo-CD server context to use
       --argocd-repo-server string       Argo CD repo server address (default "argocd-repo-server:8081")
       --argocd-repo-server-plaintext    Use a plaintext client (non-TLS) to connect to repository server
-      --argocd-repo-server-strict-tls   Perform strict validation of TLS certificates when connecting to repo server
       --as string                       Username to impersonate for the operation
       --as-group stringArray            Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
       --as-uid string                   UID to impersonate for the operation

docs/user-guide/commands/argocd_admin_notifications_trigger.md

@@ -20,7 +20,6 @@ argocd admin notifications trigger [flags]
       --argocd-context string           The name of the Argo-CD server context to use
       --argocd-repo-server string       Argo CD repo server address (default "argocd-repo-server:8081")
       --argocd-repo-server-plaintext    Use a plaintext client (non-TLS) to connect to repository server
-      --argocd-repo-server-strict-tls   Perform strict validation of TLS certificates when connecting to repo server
       --as string                       Username to impersonate for the operation
       --as-group stringArray            Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
       --as-uid string                   UID to impersonate for the operation

docs/user-guide/commands/argocd_admin_notifications_trigger_get.md

@@ -32,7 +32,6 @@ argocd admin notifications trigger get on-sync-failed -o=yaml
       --argocd-context string           The name of the Argo-CD server context to use
       --argocd-repo-server string       Argo CD repo server address (default "argocd-repo-server:8081")
       --argocd-repo-server-plaintext    Use a plaintext client (non-TLS) to connect to repository server
-      --argocd-repo-server-strict-tls   Perform strict validation of TLS certificates when connecting to repo server
       --as string                       Username to impersonate for the operation
       --as-group stringArray            Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
       --as-uid string                   UID to impersonate for the operation

docs/user-guide/commands/argocd_admin_notifications_trigger_run.md

@@ -32,7 +32,6 @@ argocd admin notifications trigger run on-sync-status-unknown ./sample-app.yaml
       --argocd-context string           The name of the Argo-CD server context to use
       --argocd-repo-server string       Argo CD repo server address (default "argocd-repo-server:8081")
       --argocd-repo-server-plaintext    Use a plaintext client (non-TLS) to connect to repository server
-      --argocd-repo-server-strict-tls   Perform strict validation of TLS certificates when connecting to repo server
       --as string                       Username to impersonate for the operation
       --as-group stringArray            Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
       --as-uid string                   UID to impersonate for the operation

manifests/base/application-controller/argocd-application-controller-statefulset.yaml

@@ -208,6 +208,24 @@ spec:
               name: argocd-cmd-params-cm
               key: controller.repo.server.strict.tls
               optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              name: argocd-cmd-params-cm
+              key: controller.repo.server.ca.cert.path
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              name: argocd-cmd-params-cm
+              key: controller.repo.server.client.cert.path
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              name: argocd-cmd-params-cm
+              key: controller.repo.server.client.cert.key.path
+              optional: true
         - name: ARGOCD_APPLICATION_CONTROLLER_PERSIST_RESOURCE_HEALTH
           valueFrom:
             configMapKeyRef:
@@ -360,6 +378,8 @@ spec:
         volumeMounts:
         - name: argocd-repo-server-tls
           mountPath: /app/config/controller/tls
+        - name: argocd-repo-server-mtls
+          mountPath: /app/config/reposerver/mtls
         - name: argocd-home
           mountPath: /home/argocd
         - name: argocd-cmd-params-cm
@@ -398,6 +418,17 @@ spec:
             path: tls.key
           - key: ca.crt
             path: ca.crt
+      - name: argocd-repo-server-mtls
+        secret:
+          secretName: argocd-repo-server-mtls
+          optional: true
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
       - name: argocd-cmd-params-cm
         configMap:
           optional: true

manifests/base/applicationset-controller/argocd-applicationset-controller-deployment.yaml

@@ -181,6 +181,24 @@ spec:
                   name: argocd-cmd-params-cm
                   key: applicationsetcontroller.repo.server.strict.tls
                   optional: true
+            - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+              valueFrom:
+                configMapKeyRef:
+                  name: argocd-cmd-params-cm
+                  key: applicationsetcontroller.repo.server.ca.cert.path
+                  optional: true
+            - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+              valueFrom:
+                configMapKeyRef:
+                  name: argocd-cmd-params-cm
+                  key: applicationsetcontroller.repo.server.client.cert.path
+                  optional: true
+            - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+              valueFrom:
+                configMapKeyRef:
+                  name: argocd-cmd-params-cm
+                  key: applicationsetcontroller.repo.server.client.cert.key.path
+                  optional: true
             - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS
               valueFrom:
                 configMapKeyRef:
@@ -254,6 +272,8 @@ spec:
               name: tmp
             - name: argocd-repo-server-tls
               mountPath: /app/config/reposerver/tls
+            - name: argocd-repo-server-mtls
+              mountPath: /app/config/reposerver/mtls
             - name: argocd-cmd-params-cm
               mountPath: /home/argocd/params
           securityContext:
@@ -291,6 +311,17 @@ spec:
                 path: tls.key
               - key: ca.crt
                 path: ca.crt
+        - name: argocd-repo-server-mtls
+          secret:
+            secretName: argocd-repo-server-mtls
+            optional: true
+            items:
+              - key: client.crt
+                path: client.crt
+              - key: client.key
+                path: client.key
+              - key: server-ca.crt
+                path: server-ca.crt
         - name: argocd-cmd-params-cm
           configMap:
             optional: true

manifests/base/notification/argocd-notifications-controller-deployment.yaml

@@ -32,6 +32,17 @@ spec:
               path: tls.key
             - key: ca.crt
               path: ca.crt
+        - name: argocd-repo-server-mtls
+          secret:
+            secretName: argocd-repo-server-mtls
+            optional: true
+            items:
+            - key: client.crt
+              path: client.crt
+            - key: client.key
+              path: client.key
+            - key: server-ca.crt
+              path: server-ca.crt
       containers:
         - args:
             - /usr/local/bin/argocd-notifications
@@ -78,6 +89,24 @@ spec:
                   key: notificationscontroller.repo.server.plaintext
                   name: argocd-cmd-params-cm
                   optional: true
+            - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+              valueFrom:
+                configMapKeyRef:
+                  key: notificationscontroller.repo.server.ca.cert.path
+                  name: argocd-cmd-params-cm
+                  optional: true
+            - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+              valueFrom:
+                configMapKeyRef:
+                  key: notificationscontroller.repo.server.client.cert.path
+                  name: argocd-cmd-params-cm
+                  optional: true
+            - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+              valueFrom:
+                configMapKeyRef:
+                  key: notificationscontroller.repo.server.client.cert.key.path
+                  name: argocd-cmd-params-cm
+                  optional: true
           workingDir: /app
           livenessProbe:
             tcpSocket:
@@ -90,6 +119,8 @@ spec:
               mountPath: /app/config/tls
             - name: argocd-repo-server-tls
               mountPath: /app/config/reposerver/tls
+            - name: argocd-repo-server-mtls
+              mountPath: /app/config/reposerver/mtls
           securityContext:
             capabilities:
               drop:

manifests/base/repo-server/argocd-repo-server-deployment.yaml

@@ -101,6 +101,12 @@ spec:
                   name: argocd-cmd-params-cm
                   key: reposerver.tls.ciphers
                   optional: true
+          - name: ARGOCD_REPO_SERVER_CLIENT_CA_PATH
+            valueFrom:
+              configMapKeyRef:
+                name: argocd-cmd-params-cm
+                key: reposerver.client.ca.path
+                optional: true
           - name: ARGOCD_REPO_CACHE_EXPIRATION
             valueFrom:
                 configMapKeyRef:
@@ -312,6 +318,8 @@ spec:
           mountPath: /app/config/gpg/keys
         - name: argocd-repo-server-tls
           mountPath: /app/config/reposerver/tls
+        - name: argocd-repo-server-mtls
+          mountPath: /app/config/reposerver/mtls
         - name: tmp
           mountPath: /tmp
         - mountPath: /helm-working-dir
@@ -365,6 +373,13 @@ spec:
               path: tls.key
             - key: ca.crt
               path: ca.crt
+        - name: argocd-repo-server-mtls
+          secret:
+            secretName: argocd-repo-server-mtls
+            optional: true
+            items:
+            - key: client-ca.crt
+              path: client-ca.crt
         - emptyDir: {}
           name: var-files
         - emptyDir: {}

manifests/base/server/argocd-server-deployment.yaml

@@ -160,6 +160,24 @@ spec:
                   name: argocd-cmd-params-cm
                   key: server.repo.server.strict.tls
                   optional: true
+            - name: ARGOCD_SERVER_REPO_SERVER_CA_CERT_PATH
+              valueFrom:
+                configMapKeyRef:
+                  name: argocd-cmd-params-cm
+                  key: server.repo.server.ca.cert.path
+                  optional: true
+            - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_PATH
+              valueFrom:
+                configMapKeyRef:
+                  name: argocd-cmd-params-cm
+                  key: server.repo.server.client.cert.path
+                  optional: true
+            - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+              valueFrom:
+                configMapKeyRef:
+                  name: argocd-cmd-params-cm
+                  key: server.repo.server.client.cert.key.path
+                  optional: true
             - name: ARGOCD_SERVER_DEX_SERVER_PLAINTEXT
               valueFrom:
                 configMapKeyRef:
@@ -377,6 +395,8 @@ spec:
               mountPath: /app/config/tls
             - name: argocd-repo-server-tls
               mountPath: /app/config/server/tls
+            - name: argocd-repo-server-mtls
+              mountPath: /app/config/reposerver/mtls
             - name: argocd-dex-server-tls
               mountPath: /app/config/dex/tls
             - mountPath: /home/argocd
@@ -441,6 +461,17 @@ spec:
                 path: tls.crt
               - key: ca.crt
                 path: ca.crt
+        - name: argocd-repo-server-mtls
+          secret:
+            secretName: argocd-repo-server-mtls
+            optional: true
+            items:
+              - key: client.crt
+                path: client.crt
+              - key: client.key
+                path: client.key
+              - key: server-ca.crt
+                path: server-ca.crt
         - name: argocd-cmd-params-cm
           configMap:
             optional: true

manifests/core-install-with-hydrator.yaml

@@ -31601,6 +31601,24 @@ spec:
               key: applicationsetcontroller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS
           valueFrom:
             configMapKeyRef:
@@ -31691,6 +31709,8 @@ spec:
           name: tmp
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd/params
           name: argocd-cmd-params-cm
       nodeSelector:
@@ -31721,6 +31741,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: applicationsetcontroller.profile.enabled
@@ -32065,6 +32096,12 @@ spec:
               key: reposerver.tls.ciphers
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_REPO_SERVER_CLIENT_CA_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: reposerver.client.ca.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_REPO_CACHE_EXPIRATION
           valueFrom:
             configMapKeyRef:
@@ -32279,6 +32316,8 @@ spec:
           name: gpg-keyring
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /tmp
           name: tmp
         - mountPath: /helm-working-dir
@@ -32336,6 +32375,13 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client-ca.crt
+            path: client-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - emptyDir: {}
         name: var-files
       - emptyDir: {}
@@ -32573,6 +32619,24 @@ spec:
               key: controller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATION_CONTROLLER_PERSIST_RESOURCE_HEALTH
           valueFrom:
             configMapKeyRef:
@@ -32724,6 +32788,8 @@ spec:
         volumeMounts:
         - mountPath: /app/config/controller/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd
           name: argocd-home
         - mountPath: /home/argocd/params
@@ -32750,6 +32816,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: controller.profile.enabled

manifests/core-install.yaml

@@ -31569,6 +31569,24 @@ spec:
               key: applicationsetcontroller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS
           valueFrom:
             configMapKeyRef:
@@ -31659,6 +31677,8 @@ spec:
           name: tmp
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd/params
           name: argocd-cmd-params-cm
       nodeSelector:
@@ -31689,6 +31709,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: applicationsetcontroller.profile.enabled
@@ -31893,6 +31924,12 @@ spec:
               key: reposerver.tls.ciphers
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_REPO_SERVER_CLIENT_CA_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: reposerver.client.ca.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_REPO_CACHE_EXPIRATION
           valueFrom:
             configMapKeyRef:
@@ -32107,6 +32144,8 @@ spec:
           name: gpg-keyring
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /tmp
           name: tmp
         - mountPath: /helm-working-dir
@@ -32164,6 +32203,13 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client-ca.crt
+            path: client-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - emptyDir: {}
         name: var-files
       - emptyDir: {}
@@ -32401,6 +32447,24 @@ spec:
               key: controller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATION_CONTROLLER_PERSIST_RESOURCE_HEALTH
           valueFrom:
             configMapKeyRef:
@@ -32552,6 +32616,8 @@ spec:
         volumeMounts:
         - mountPath: /app/config/controller/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd
           name: argocd-home
         - mountPath: /home/argocd/params
@@ -32578,6 +32644,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: controller.profile.enabled

manifests/ha/install-with-hydrator.yaml

@@ -33027,6 +33027,24 @@ spec:
               key: applicationsetcontroller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS
           valueFrom:
             configMapKeyRef:
@@ -33117,6 +33135,8 @@ spec:
           name: tmp
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd/params
           name: argocd-cmd-params-cm
       nodeSelector:
@@ -33147,6 +33167,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: applicationsetcontroller.profile.enabled
@@ -33488,6 +33519,24 @@ spec:
               key: notificationscontroller.repo.server.plaintext
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         image: quay.io/argoproj/argocd:latest
         imagePullPolicy: Always
         livenessProbe:
@@ -33505,6 +33554,8 @@ spec:
           name: tls-certs
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         workingDir: /app
       nodeSelector:
         kubernetes.io/os: linux
@@ -33528,6 +33579,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -33773,6 +33835,12 @@ spec:
               key: reposerver.tls.ciphers
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_REPO_SERVER_CLIENT_CA_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: reposerver.client.ca.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_REPO_CACHE_EXPIRATION
           valueFrom:
             configMapKeyRef:
@@ -33987,6 +34055,8 @@ spec:
           name: gpg-keyring
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /tmp
           name: tmp
         - mountPath: /helm-working-dir
@@ -34044,6 +34114,13 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client-ca.crt
+            path: client-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - emptyDir: {}
         name: var-files
       - emptyDir: {}
@@ -34231,6 +34308,24 @@ spec:
               key: server.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_SERVER_DEX_SERVER_PLAINTEXT
           valueFrom:
             configMapKeyRef:
@@ -34476,6 +34571,8 @@ spec:
           name: tls-certs
         - mountPath: /app/config/server/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /app/config/dex/tls
           name: argocd-dex-server-tls
         - mountPath: /home/argocd
@@ -34518,6 +34615,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-dex-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: server.profile.enabled
@@ -34751,6 +34859,24 @@ spec:
               key: controller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATION_CONTROLLER_PERSIST_RESOURCE_HEALTH
           valueFrom:
             configMapKeyRef:
@@ -34902,6 +35028,8 @@ spec:
         volumeMounts:
         - mountPath: /app/config/controller/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd
           name: argocd-home
         - mountPath: /home/argocd/params
@@ -34928,6 +35056,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: controller.profile.enabled

manifests/ha/install.yaml

@@ -32997,6 +32997,24 @@ spec:
               key: applicationsetcontroller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS
           valueFrom:
             configMapKeyRef:
@@ -33087,6 +33105,8 @@ spec:
           name: tmp
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd/params
           name: argocd-cmd-params-cm
       nodeSelector:
@@ -33117,6 +33137,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: applicationsetcontroller.profile.enabled
@@ -33318,6 +33349,24 @@ spec:
               key: notificationscontroller.repo.server.plaintext
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         image: quay.io/argoproj/argocd:latest
         imagePullPolicy: Always
         livenessProbe:
@@ -33335,6 +33384,8 @@ spec:
           name: tls-certs
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         workingDir: /app
       nodeSelector:
         kubernetes.io/os: linux
@@ -33358,6 +33409,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -33603,6 +33665,12 @@ spec:
               key: reposerver.tls.ciphers
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_REPO_SERVER_CLIENT_CA_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: reposerver.client.ca.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_REPO_CACHE_EXPIRATION
           valueFrom:
             configMapKeyRef:
@@ -33817,6 +33885,8 @@ spec:
           name: gpg-keyring
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /tmp
           name: tmp
         - mountPath: /helm-working-dir
@@ -33874,6 +33944,13 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client-ca.crt
+            path: client-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - emptyDir: {}
         name: var-files
       - emptyDir: {}
@@ -34061,6 +34138,24 @@ spec:
               key: server.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_SERVER_DEX_SERVER_PLAINTEXT
           valueFrom:
             configMapKeyRef:
@@ -34306,6 +34401,8 @@ spec:
           name: tls-certs
         - mountPath: /app/config/server/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /app/config/dex/tls
           name: argocd-dex-server-tls
         - mountPath: /home/argocd
@@ -34348,6 +34445,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-dex-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: server.profile.enabled
@@ -34581,6 +34689,24 @@ spec:
               key: controller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATION_CONTROLLER_PERSIST_RESOURCE_HEALTH
           valueFrom:
             configMapKeyRef:
@@ -34732,6 +34858,8 @@ spec:
         volumeMounts:
         - mountPath: /app/config/controller/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd
           name: argocd-home
         - mountPath: /home/argocd/params
@@ -34758,6 +34886,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: controller.profile.enabled

manifests/ha/namespace-install-with-hydrator.yaml

@@ -1945,6 +1945,24 @@ spec:
               key: applicationsetcontroller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS
           valueFrom:
             configMapKeyRef:
@@ -2035,6 +2053,8 @@ spec:
           name: tmp
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd/params
           name: argocd-cmd-params-cm
       nodeSelector:
@@ -2065,6 +2085,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: applicationsetcontroller.profile.enabled
@@ -2406,6 +2437,24 @@ spec:
               key: notificationscontroller.repo.server.plaintext
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         image: quay.io/argoproj/argocd:latest
         imagePullPolicy: Always
         livenessProbe:
@@ -2423,6 +2472,8 @@ spec:
           name: tls-certs
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         workingDir: /app
       nodeSelector:
         kubernetes.io/os: linux
@@ -2446,6 +2497,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -2691,6 +2753,12 @@ spec:
               key: reposerver.tls.ciphers
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_REPO_SERVER_CLIENT_CA_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: reposerver.client.ca.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_REPO_CACHE_EXPIRATION
           valueFrom:
             configMapKeyRef:
@@ -2905,6 +2973,8 @@ spec:
           name: gpg-keyring
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /tmp
           name: tmp
         - mountPath: /helm-working-dir
@@ -2962,6 +3032,13 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client-ca.crt
+            path: client-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - emptyDir: {}
         name: var-files
       - emptyDir: {}
@@ -3149,6 +3226,24 @@ spec:
               key: server.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_SERVER_DEX_SERVER_PLAINTEXT
           valueFrom:
             configMapKeyRef:
@@ -3394,6 +3489,8 @@ spec:
           name: tls-certs
         - mountPath: /app/config/server/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /app/config/dex/tls
           name: argocd-dex-server-tls
         - mountPath: /home/argocd
@@ -3436,6 +3533,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-dex-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: server.profile.enabled
@@ -3669,6 +3777,24 @@ spec:
               key: controller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATION_CONTROLLER_PERSIST_RESOURCE_HEALTH
           valueFrom:
             configMapKeyRef:
@@ -3820,6 +3946,8 @@ spec:
         volumeMounts:
         - mountPath: /app/config/controller/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd
           name: argocd-home
         - mountPath: /home/argocd/params
@@ -3846,6 +3974,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: controller.profile.enabled

manifests/ha/namespace-install.yaml

@@ -1915,6 +1915,24 @@ spec:
               key: applicationsetcontroller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS
           valueFrom:
             configMapKeyRef:
@@ -2005,6 +2023,8 @@ spec:
           name: tmp
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd/params
           name: argocd-cmd-params-cm
       nodeSelector:
@@ -2035,6 +2055,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: applicationsetcontroller.profile.enabled
@@ -2236,6 +2267,24 @@ spec:
               key: notificationscontroller.repo.server.plaintext
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         image: quay.io/argoproj/argocd:latest
         imagePullPolicy: Always
         livenessProbe:
@@ -2253,6 +2302,8 @@ spec:
           name: tls-certs
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         workingDir: /app
       nodeSelector:
         kubernetes.io/os: linux
@@ -2276,6 +2327,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -2521,6 +2583,12 @@ spec:
               key: reposerver.tls.ciphers
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_REPO_SERVER_CLIENT_CA_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: reposerver.client.ca.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_REPO_CACHE_EXPIRATION
           valueFrom:
             configMapKeyRef:
@@ -2735,6 +2803,8 @@ spec:
           name: gpg-keyring
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /tmp
           name: tmp
         - mountPath: /helm-working-dir
@@ -2792,6 +2862,13 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client-ca.crt
+            path: client-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - emptyDir: {}
         name: var-files
       - emptyDir: {}
@@ -2979,6 +3056,24 @@ spec:
               key: server.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_SERVER_DEX_SERVER_PLAINTEXT
           valueFrom:
             configMapKeyRef:
@@ -3224,6 +3319,8 @@ spec:
           name: tls-certs
         - mountPath: /app/config/server/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /app/config/dex/tls
           name: argocd-dex-server-tls
         - mountPath: /home/argocd
@@ -3266,6 +3363,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-dex-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: server.profile.enabled
@@ -3499,6 +3607,24 @@ spec:
               key: controller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATION_CONTROLLER_PERSIST_RESOURCE_HEALTH
           valueFrom:
             configMapKeyRef:
@@ -3650,6 +3776,8 @@ spec:
         volumeMounts:
         - mountPath: /app/config/controller/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd
           name: argocd-home
         - mountPath: /home/argocd/params
@@ -3676,6 +3804,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: controller.profile.enabled

manifests/install-with-hydrator.yaml

@@ -32045,6 +32045,24 @@ spec:
               key: applicationsetcontroller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS
           valueFrom:
             configMapKeyRef:
@@ -32135,6 +32153,8 @@ spec:
           name: tmp
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd/params
           name: argocd-cmd-params-cm
       nodeSelector:
@@ -32165,6 +32185,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: applicationsetcontroller.profile.enabled
@@ -32506,6 +32537,24 @@ spec:
               key: notificationscontroller.repo.server.plaintext
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         image: quay.io/argoproj/argocd:latest
         imagePullPolicy: Always
         livenessProbe:
@@ -32523,6 +32572,8 @@ spec:
           name: tls-certs
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         workingDir: /app
       nodeSelector:
         kubernetes.io/os: linux
@@ -32546,6 +32597,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -32743,6 +32805,12 @@ spec:
               key: reposerver.tls.ciphers
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_REPO_SERVER_CLIENT_CA_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: reposerver.client.ca.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_REPO_CACHE_EXPIRATION
           valueFrom:
             configMapKeyRef:
@@ -32957,6 +33025,8 @@ spec:
           name: gpg-keyring
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /tmp
           name: tmp
         - mountPath: /helm-working-dir
@@ -33014,6 +33084,13 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client-ca.crt
+            path: client-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - emptyDir: {}
         name: var-files
       - emptyDir: {}
@@ -33199,6 +33276,24 @@ spec:
               key: server.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_SERVER_DEX_SERVER_PLAINTEXT
           valueFrom:
             configMapKeyRef:
@@ -33444,6 +33539,8 @@ spec:
           name: tls-certs
         - mountPath: /app/config/server/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /app/config/dex/tls
           name: argocd-dex-server-tls
         - mountPath: /home/argocd
@@ -33486,6 +33583,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-dex-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: server.profile.enabled
@@ -33719,6 +33827,24 @@ spec:
               key: controller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATION_CONTROLLER_PERSIST_RESOURCE_HEALTH
           valueFrom:
             configMapKeyRef:
@@ -33870,6 +33996,8 @@ spec:
         volumeMounts:
         - mountPath: /app/config/controller/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd
           name: argocd-home
         - mountPath: /home/argocd/params
@@ -33896,6 +34024,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: controller.profile.enabled

manifests/install.yaml

@@ -32013,6 +32013,24 @@ spec:
               key: applicationsetcontroller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS
           valueFrom:
             configMapKeyRef:
@@ -32103,6 +32121,8 @@ spec:
           name: tmp
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd/params
           name: argocd-cmd-params-cm
       nodeSelector:
@@ -32133,6 +32153,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: applicationsetcontroller.profile.enabled
@@ -32334,6 +32365,24 @@ spec:
               key: notificationscontroller.repo.server.plaintext
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         image: quay.io/argoproj/argocd:latest
         imagePullPolicy: Always
         livenessProbe:
@@ -32351,6 +32400,8 @@ spec:
           name: tls-certs
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         workingDir: /app
       nodeSelector:
         kubernetes.io/os: linux
@@ -32374,6 +32425,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -32571,6 +32633,12 @@ spec:
               key: reposerver.tls.ciphers
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_REPO_SERVER_CLIENT_CA_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: reposerver.client.ca.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_REPO_CACHE_EXPIRATION
           valueFrom:
             configMapKeyRef:
@@ -32785,6 +32853,8 @@ spec:
           name: gpg-keyring
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /tmp
           name: tmp
         - mountPath: /helm-working-dir
@@ -32842,6 +32912,13 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client-ca.crt
+            path: client-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - emptyDir: {}
         name: var-files
       - emptyDir: {}
@@ -33027,6 +33104,24 @@ spec:
               key: server.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_SERVER_DEX_SERVER_PLAINTEXT
           valueFrom:
             configMapKeyRef:
@@ -33272,6 +33367,8 @@ spec:
           name: tls-certs
         - mountPath: /app/config/server/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /app/config/dex/tls
           name: argocd-dex-server-tls
         - mountPath: /home/argocd
@@ -33314,6 +33411,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-dex-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: server.profile.enabled
@@ -33547,6 +33655,24 @@ spec:
               key: controller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATION_CONTROLLER_PERSIST_RESOURCE_HEALTH
           valueFrom:
             configMapKeyRef:
@@ -33698,6 +33824,8 @@ spec:
         volumeMounts:
         - mountPath: /app/config/controller/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd
           name: argocd-home
         - mountPath: /home/argocd/params
@@ -33724,6 +33852,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: controller.profile.enabled

manifests/namespace-install-with-hydrator.yaml

@@ -963,6 +963,24 @@ spec:
               key: applicationsetcontroller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS
           valueFrom:
             configMapKeyRef:
@@ -1053,6 +1071,8 @@ spec:
           name: tmp
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd/params
           name: argocd-cmd-params-cm
       nodeSelector:
@@ -1083,6 +1103,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: applicationsetcontroller.profile.enabled
@@ -1424,6 +1455,24 @@ spec:
               key: notificationscontroller.repo.server.plaintext
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         image: quay.io/argoproj/argocd:latest
         imagePullPolicy: Always
         livenessProbe:
@@ -1441,6 +1490,8 @@ spec:
           name: tls-certs
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         workingDir: /app
       nodeSelector:
         kubernetes.io/os: linux
@@ -1464,6 +1515,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -1661,6 +1723,12 @@ spec:
               key: reposerver.tls.ciphers
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_REPO_SERVER_CLIENT_CA_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: reposerver.client.ca.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_REPO_CACHE_EXPIRATION
           valueFrom:
             configMapKeyRef:
@@ -1875,6 +1943,8 @@ spec:
           name: gpg-keyring
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /tmp
           name: tmp
         - mountPath: /helm-working-dir
@@ -1932,6 +2002,13 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client-ca.crt
+            path: client-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - emptyDir: {}
         name: var-files
       - emptyDir: {}
@@ -2117,6 +2194,24 @@ spec:
               key: server.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_SERVER_DEX_SERVER_PLAINTEXT
           valueFrom:
             configMapKeyRef:
@@ -2362,6 +2457,8 @@ spec:
           name: tls-certs
         - mountPath: /app/config/server/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /app/config/dex/tls
           name: argocd-dex-server-tls
         - mountPath: /home/argocd
@@ -2404,6 +2501,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-dex-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: server.profile.enabled
@@ -2637,6 +2745,24 @@ spec:
               key: controller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATION_CONTROLLER_PERSIST_RESOURCE_HEALTH
           valueFrom:
             configMapKeyRef:
@@ -2788,6 +2914,8 @@ spec:
         volumeMounts:
         - mountPath: /app/config/controller/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd
           name: argocd-home
         - mountPath: /home/argocd/params
@@ -2814,6 +2942,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: controller.profile.enabled

manifests/namespace-install.yaml

@@ -931,6 +931,24 @@ spec:
               key: applicationsetcontroller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: applicationsetcontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS
           valueFrom:
             configMapKeyRef:
@@ -1021,6 +1039,8 @@ spec:
           name: tmp
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd/params
           name: argocd-cmd-params-cm
       nodeSelector:
@@ -1051,6 +1071,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: applicationsetcontroller.profile.enabled
@@ -1252,6 +1283,24 @@ spec:
               key: notificationscontroller.repo.server.plaintext
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: notificationscontroller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         image: quay.io/argoproj/argocd:latest
         imagePullPolicy: Always
         livenessProbe:
@@ -1269,6 +1318,8 @@ spec:
           name: tls-certs
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         workingDir: /app
       nodeSelector:
         kubernetes.io/os: linux
@@ -1292,6 +1343,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -1489,6 +1551,12 @@ spec:
               key: reposerver.tls.ciphers
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_REPO_SERVER_CLIENT_CA_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: reposerver.client.ca.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_REPO_CACHE_EXPIRATION
           valueFrom:
             configMapKeyRef:
@@ -1703,6 +1771,8 @@ spec:
           name: gpg-keyring
         - mountPath: /app/config/reposerver/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /tmp
           name: tmp
         - mountPath: /helm-working-dir
@@ -1760,6 +1830,13 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client-ca.crt
+            path: client-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - emptyDir: {}
         name: var-files
       - emptyDir: {}
@@ -1945,6 +2022,24 @@ spec:
               key: server.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_SERVER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: server.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_SERVER_DEX_SERVER_PLAINTEXT
           valueFrom:
             configMapKeyRef:
@@ -2190,6 +2285,8 @@ spec:
           name: tls-certs
         - mountPath: /app/config/server/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /app/config/dex/tls
           name: argocd-dex-server-tls
         - mountPath: /home/argocd
@@ -2232,6 +2329,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-dex-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: server.profile.enabled
@@ -2465,6 +2573,24 @@ spec:
               key: controller.repo.server.strict.tls
               name: argocd-cmd-params-cm
               optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.ca.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.path
+              name: argocd-cmd-params-cm
+              optional: true
+        - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CLIENT_CERT_KEY_PATH
+          valueFrom:
+            configMapKeyRef:
+              key: controller.repo.server.client.cert.key.path
+              name: argocd-cmd-params-cm
+              optional: true
         - name: ARGOCD_APPLICATION_CONTROLLER_PERSIST_RESOURCE_HEALTH
           valueFrom:
             configMapKeyRef:
@@ -2616,6 +2742,8 @@ spec:
         volumeMounts:
         - mountPath: /app/config/controller/tls
           name: argocd-repo-server-tls
+        - mountPath: /app/config/reposerver/mtls
+          name: argocd-repo-server-mtls
         - mountPath: /home/argocd
           name: argocd-home
         - mountPath: /home/argocd/params
@@ -2642,6 +2770,17 @@ spec:
             path: ca.crt
           optional: true
           secretName: argocd-repo-server-tls
+      - name: argocd-repo-server-mtls
+        secret:
+          items:
+          - key: client.crt
+            path: client.crt
+          - key: client.key
+            path: client.key
+          - key: server-ca.crt
+            path: server-ca.crt
+          optional: true
+          secretName: argocd-repo-server-mtls
       - configMap:
           items:
           - key: controller.profile.enabled

mkdocs.yml

@@ -49,6 +49,7 @@ nav:
     - snyk/index.md
     - operator-manual/signed-release-assets.md
   - operator-manual/tls.md
+  - operator-manual/mtls.md
   - operator-manual/cluster-management.md
   - operator-manual/cluster-bootstrapping.md
   - operator-manual/secret-management.md

reposerver/apiclient/clientset.go

@@ -2,13 +2,16 @@ package apiclient
 
 import (
 	"crypto/tls"
-	"crypto/x509"
+	"errors"
 	"fmt"
 	"math"
+	"os"
+	"sync"
 	"time"
 
 	"github.com/argoproj/argo-cd/v3/common"
 	"github.com/argoproj/argo-cd/v3/util/env"
+	utiltls "github.com/argoproj/argo-cd/v3/util/tls"
 
 	grpc_retry "github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/retry"
 	"github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/timeout"
@@ -25,16 +28,6 @@ import (
 // MaxGRPCMessageSize contains max grpc message size
 var MaxGRPCMessageSize = env.ParseNumFromEnv(common.EnvGRPCMaxSizeMB, 100, 0, math.MaxInt32) * 1024 * 1024
 
-// TLSConfiguration describes parameters for TLS configuration to be used by a repo server API client
-type TLSConfiguration struct {
-	// Whether to disable TLS for connections
-	DisableTLS bool
-	// Whether to enforce strict validation of TLS certificates
-	StrictValidation bool
-	// List of certificates to validate the peer against (if StrictCerts is true)
-	Certificates *x509.CertPool
-}
-
 // Clientset represents repository server api clients
 type Clientset interface {
 	NewRepoServerClient() (utilio.Closer, RepoServerServiceClient, error)
@@ -43,7 +36,78 @@ type Clientset interface {
 type clientSet struct {
 	address        string
 	timeoutSeconds int
-	tlsConfig      TLSConfiguration
+	tlsConfig      utiltls.Configuration
+}
+
+type clientCertEntry struct {
+	cert        tls.Certificate
+	certModTime time.Time
+	keyModTime  time.Time
+}
+
+var clientCertCache = struct {
+	mu      sync.RWMutex
+	entries map[string]*clientCertEntry
+}{
+	entries: map[string]*clientCertEntry{},
+}
+
+// ResetClientCertCache clears the client certificate cache. // Intended for tests.
+func ResetClientCertCache() {
+	clientCertCache.mu.Lock()
+	defer clientCertCache.mu.Unlock()
+	clear(clientCertCache.entries)
+}
+
+func getClientCertFromCache(certFile, keyFile string) (tls.Certificate, error) {
+	cacheKey := certFile + "\x00" + keyFile
+
+	// Stat both files before acquiring the write lock.
+	// os.Stat is cheap; we do it outside the lock to minimise contention.
+	certInfo, err := os.Stat(certFile)
+	if err != nil {
+		return tls.Certificate{}, fmt.Errorf("cannot stat client cert file %s: %w", certFile, err)
+	}
+	keyInfo, err := os.Stat(keyFile)
+	if err != nil {
+		return tls.Certificate{}, fmt.Errorf("cannot stat client cert key file %s: %w", keyFile, err)
+	}
+
+	// Fast path: read lock, return cached cert if still fresh.
+	clientCertCache.mu.RLock()
+	if entry, ok := clientCertCache.entries[cacheKey]; ok {
+		if !certInfo.ModTime().After(entry.certModTime) && !keyInfo.ModTime().After(entry.keyModTime) {
+			cert := entry.cert
+			clientCertCache.mu.RUnlock()
+			return cert, nil
+		}
+	}
+	clientCertCache.mu.RUnlock()
+
+	// Slow path: files changed or not yet cached — reload from disk.
+	cert, err := tls.LoadX509KeyPair(certFile, keyFile)
+	if err != nil {
+		return tls.Certificate{}, fmt.Errorf("failed to load client certificate: %w", err)
+	}
+
+	clientCertCache.mu.Lock()
+	// Double-check: another goroutine may have loaded between our RUnlock and Lock.
+	if entry, ok := clientCertCache.entries[cacheKey]; ok {
+		if !certInfo.ModTime().After(entry.certModTime) && !keyInfo.ModTime().After(entry.keyModTime) {
+			cert := entry.cert
+			clientCertCache.mu.Unlock()
+			return cert, nil
+		}
+	}
+	clientCertCache.entries[cacheKey] = &clientCertEntry{
+		cert:        cert,
+		certModTime: certInfo.ModTime(),
+		keyModTime:  keyInfo.ModTime(),
+	}
+	clientCertCache.mu.Unlock()
+
+	log.Infof("Client certificate reloaded from %s (mtime changed)", certFile)
+	return cert, nil
 }
 
 func (c *clientSet) NewRepoServerClient() (utilio.Closer, RepoServerServiceClient, error) {
@@ -54,7 +118,7 @@ func (c *clientSet) NewRepoServerClient() (utilio.Closer, RepoServerServiceClien
 	return conn, NewRepoServerServiceClient(conn), nil
 }
 
-func NewConnection(address string, timeoutSeconds int, tlsConfig *TLSConfiguration) (*grpc.ClientConn, error) {
+func NewConnection(address string, timeoutSeconds int, tlsConfig *utiltls.Configuration) (*grpc.ClientConn, error) {
 	retryOpts := []grpc_retry.CallOption{
 		grpc_retry.WithMax(3),
 		grpc_retry.WithBackoff(grpc_retry.BackoffLinear(1000 * time.Millisecond)),
@@ -70,16 +134,14 @@ func NewConnection(address string, timeoutSeconds int, tlsConfig *TLSConfigurati
 		grpc.WithStatsHandler(otelgrpc.NewClientHandler()),
 	}
 
-	tlsC := &tls.Config{}
-	if !tlsConfig.DisableTLS {
-		if !tlsConfig.StrictValidation {
-			tlsC.InsecureSkipVerify = true
-		} else {
-			tlsC.RootCAs = tlsConfig.Certificates
+	if tlsConfig.DisableTLS {
+		opts = append(opts, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	} else {
+		tlsC, err := buildTLSClientConfig(tlsConfig)
+		if err != nil {
+			return nil, err
 		}
 		opts = append(opts, grpc.WithTransportCredentials(credentials.NewTLS(tlsC)))
-	} else {
-		opts = append(opts, grpc.WithTransportCredentials(insecure.NewCredentials()))
 	}
 
 	conn, err := grpc.NewClient(address, opts...)
@@ -91,6 +153,58 @@ func NewConnection(address string, timeoutSeconds int, tlsConfig *TLSConfigurati
 }
 
 // NewRepoServerClientset creates new instance of repo server Clientset
-func NewRepoServerClientset(address string, timeoutSeconds int, tlsConfig TLSConfiguration) Clientset {
-	return &clientSet{address: address, timeoutSeconds: timeoutSeconds, tlsConfig: tlsConfig}
+func NewRepoServerClientset(address string, timeoutSeconds int, tlsConfig utiltls.Configuration) Clientset {
+	return &clientSet{
+		address:        address,
+		timeoutSeconds: timeoutSeconds,
+		tlsConfig:      tlsConfig,
+	}
+}
+
+func buildTLSClientConfig(tlsConfig *utiltls.Configuration) (*tls.Config, error) {
+	tlsC := &tls.Config{}
+
+	strictValidation := tlsConfig.StrictValidation || tlsConfig.Certificates != nil
+	if !strictValidation {
+		tlsC.InsecureSkipVerify = true
+	} else {
+		tlsC.RootCAs = tlsConfig.Certificates
+	}
+
+	if tlsConfig.ClientCertFile != "" && tlsConfig.ClientCertKeyFile != "" {
+		certFile := tlsConfig.ClientCertFile
+		keyFile := tlsConfig.ClientCertKeyFile
+
+		// Check whether the cert files actually exist before installing the callback. If they don't, mTLS is skipped.
+		if _, err := os.Stat(certFile); err != nil {
+			if !errors.Is(err, os.ErrNotExist) {
+				return nil, fmt.Errorf("could not stat client cert file %s: %w", certFile, err)
+			}
+			log.Debugf("Client cert file %s does not exist — skipping mTLS client certificate", certFile)
+		} else {
+			// File exists: do an eager load to catch configuration errors at startup.
+			if _, err := getClientCertFromCache(certFile, keyFile); err != nil {
+				return nil, fmt.Errorf("failed to load initial client certificate: %w", err)
+			}
+
+			tlsC.GetClientCertificate = func(_ *tls.CertificateRequestInfo) (*tls.Certificate, error) {
+				if _, statErr := os.Stat(certFile); statErr != nil {
+					if errors.Is(statErr, os.ErrNotExist) {
+						log.Debugf("Client cert file %s no longer exists — skipping mTLS client certificate", certFile)
+						return new(tls.Certificate), nil
+					}
+					return nil, fmt.Errorf("could not stat client cert file %s: %w", certFile, statErr)
+				}
+				cert, err := getClientCertFromCache(certFile, keyFile)
+				if err != nil {
+					return nil, err
+				}
+				return &cert, nil
+			}
+		}
+	} else if len(tlsConfig.ClientCertificates) > 0 {
+		tlsC.Certificates = tlsConfig.ClientCertificates
+	}
+
+	return tlsC, nil
 }

reposerver/apiclient/clientset_test.go

@@ -1,10 +1,27 @@
 package apiclient_test
 
 import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/health"
+	"google.golang.org/grpc/health/grpc_health_v1"
+	"google.golang.org/grpc/status"
+
+	utilstls "github.com/argoproj/argo-cd/v3/util/tls"
 
 	"github.com/argoproj/argo-cd/v3/reposerver/apiclient"
 	"github.com/argoproj/argo-cd/v3/reposerver/apiclient/mocks"
@@ -27,7 +44,7 @@ func TestNewRepoServerClient_CorrectClientReturned(t *testing.T) {
 func TestNewRepoServerClientset_InvalidInput(t *testing.T) {
 	t.Parallel()
 	// Call the function with invalid inputs
-	invalidClientset := apiclient.NewRepoServerClientset("", -1, apiclient.TLSConfiguration{})
+	invalidClientset := apiclient.NewRepoServerClientset("", -1, utilstls.Configuration{})
 
 	assert.NotNil(t, invalidClientset)
 	assert.Implements(t, (*apiclient.Clientset)(nil), invalidClientset)
@@ -36,7 +53,7 @@ func TestNewRepoServerClientset_InvalidInput(t *testing.T) {
 func TestNewRepoServerClientset_SuccessfulConnection(t *testing.T) {
 	t.Parallel()
 	// Call the function with valid inputs
-	clientset := apiclient.NewRepoServerClientset("localhost:8080", 1, apiclient.TLSConfiguration{})
+	clientset := apiclient.NewRepoServerClientset("localhost:8080", 1, utilstls.Configuration{})
 
 	assert.NotNil(t, clientset)
 	assert.Implements(t, (*apiclient.Clientset)(nil), clientset)
@@ -45,7 +62,7 @@ func TestNewRepoServerClientset_SuccessfulConnection(t *testing.T) {
 func TestNewRepoServerClientset_SuccessfulConnectionWithTLS(t *testing.T) {
 	t.Parallel()
 	// Call the function with valid inputs
-	clientset := apiclient.NewRepoServerClientset("localhost:8080", 1, apiclient.TLSConfiguration{
+	clientset := apiclient.NewRepoServerClientset("localhost:8080", 1, utilstls.Configuration{
 		DisableTLS:       false,
 		StrictValidation: true,
 		Certificates:     nil,
@@ -57,7 +74,7 @@ func TestNewRepoServerClientset_SuccessfulConnectionWithTLS(t *testing.T) {
 
 func TestNewConnection_TLSWithStrictValidation(t *testing.T) {
 	t.Parallel()
-	tlsConfig := apiclient.TLSConfiguration{
+	tlsConfig := utilstls.Configuration{
 		DisableTLS:       false,
 		StrictValidation: true,
 		Certificates:     nil,
@@ -71,7 +88,7 @@ func TestNewConnection_TLSWithStrictValidation(t *testing.T) {
 
 func TestNewConnection_TLSWithStrictValidationAndCertificates(t *testing.T) {
 	t.Parallel()
-	tlsConfig := apiclient.TLSConfiguration{
+	tlsConfig := utilstls.Configuration{
 		DisableTLS:       false,
 		StrictValidation: true,
 		Certificates:     nil,
@@ -86,7 +103,7 @@ func TestNewConnection_TLSWithStrictValidationAndCertificates(t *testing.T) {
 func TestNewConnection_InsecureConnection(t *testing.T) {
 	t.Parallel()
 	// Create a TLS configuration with TLS disabled
-	tlsConfig := apiclient.TLSConfiguration{
+	tlsConfig := utilstls.Configuration{
 		DisableTLS:       true,
 		StrictValidation: false,
 		Certificates:     nil,
@@ -97,3 +114,525 @@ func TestNewConnection_InsecureConnection(t *testing.T) {
 	require.NoError(t, err)
 	assert.NotNil(t, conn)
 }
+
+func TestNewConnection_InMemoryCertificates(t *testing.T) {
+	tlsConfig := utilstls.Configuration{
+		DisableTLS:         false,
+		StrictValidation:   false,
+		ClientCertificates: []tls.Certificate{{}},
+	}
+
+	conn, err := apiclient.NewConnection("example.com:443", 10, &tlsConfig)
+
+	require.NoError(t, err)
+	assert.NotNil(t, conn)
+}
+
+func TestNewConnection_ServesFromCacheWhenFilesUnchanged(t *testing.T) {
+	t.Cleanup(apiclient.ResetClientCertCache)
+	apiclient.ResetClientCertCache()
+
+	certFile := filepath.Join("..", "..", "util", "tls", "testdata", "valid_tls.crt")
+	keyFile := filepath.Join("..", "..", "util", "tls", "testdata", "valid_tls.key")
+
+	tempCertFile := filepath.Join(t.TempDir(), "client.crt")
+	tempKeyFile := filepath.Join(t.TempDir(), "client.key")
+
+	certBytes, err := os.ReadFile(certFile)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(tempCertFile, certBytes, 0o600))
+
+	keyBytes, err := os.ReadFile(keyFile)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(tempKeyFile, keyBytes, 0o600))
+
+	tlsConfig := utilstls.Configuration{
+		StrictValidation:  false,
+		ClientCertFile:    tempCertFile,
+		ClientCertKeyFile: tempKeyFile,
+	}
+
+	// First call: loads from disk and populates the cache.
+	conn, err := apiclient.NewConnection("example.com:443", 10, &tlsConfig)
+	require.NoError(t, err)
+	assert.NotNil(t, conn)
+
+	// Second call: files are untouched, mtime is unchanged — cert must be served from the cache without re-reading disk.
+	conn, err = apiclient.NewConnection("example.com:443", 10, &tlsConfig)
+	require.NoError(t, err)
+	assert.NotNil(t, conn)
+}
+
+func TestNewConnection_ReloadsClientCertificateWhenFileChanges(t *testing.T) {
+	t.Cleanup(apiclient.ResetClientCertCache)
+	apiclient.ResetClientCertCache()
+
+	certFile := filepath.Join("..", "..", "util", "tls", "testdata", "valid_tls.crt")
+	keyFile := filepath.Join("..", "..", "util", "tls", "testdata", "valid_tls.key")
+
+	tempCertFile := filepath.Join(t.TempDir(), "client.crt")
+	tempKeyFile := filepath.Join(t.TempDir(), "client.key")
+
+	certBytes, err := os.ReadFile(certFile)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(tempCertFile, certBytes, 0o600))
+
+	keyBytes, err := os.ReadFile(keyFile)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(tempKeyFile, keyBytes, 0o600))
+
+	tlsConfig := utilstls.Configuration{
+		StrictValidation:  false,
+		ClientCertFile:    tempCertFile,
+		ClientCertKeyFile: tempKeyFile,
+	}
+
+	// First call: loads and caches the cert.
+	conn, err := apiclient.NewConnection("example.com:443", 10, &tlsConfig)
+	require.NoError(t, err)
+	assert.NotNil(t, conn)
+
+	// Simulate cert rotation: overwrite with fresh (still valid) cert bytes.
+	// Writing updates the mtime, which is enough to trigger a reload.
+	require.NoError(t, os.WriteFile(tempCertFile, certBytes, 0o600))
+	require.NoError(t, os.WriteFile(tempKeyFile, keyBytes, 0o600))
+
+	// Second call: mtime changed → cache invalidated → reloads from disk.
+	// The new cert is valid, so the call must succeed.
+	conn, err = apiclient.NewConnection("example.com:443", 10, &tlsConfig)
+	require.NoError(t, err)
+	assert.NotNil(t, conn)
+}
+
+func TestNewConnection_ErrorWhenRotatedCertIsInvalid(t *testing.T) {
+	t.Cleanup(apiclient.ResetClientCertCache)
+	apiclient.ResetClientCertCache()
+
+	certFile := filepath.Join("..", "..", "util", "tls", "testdata", "valid_tls.crt")
+	keyFile := filepath.Join("..", "..", "util", "tls", "testdata", "valid_tls.key")
+
+	tempCertFile := filepath.Join(t.TempDir(), "client.crt")
+	tempKeyFile := filepath.Join(t.TempDir(), "client.key")
+
+	certBytes, err := os.ReadFile(certFile)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(tempCertFile, certBytes, 0o600))
+
+	keyBytes, err := os.ReadFile(keyFile)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(tempKeyFile, keyBytes, 0o600))
+
+	tlsConfig := utilstls.Configuration{
+		StrictValidation:  false,
+		ClientCertFile:    tempCertFile,
+		ClientCertKeyFile: tempKeyFile,
+	}
+
+	// First call: succeeds and populates the cache.
+	conn, err := apiclient.NewConnection("example.com:443", 10, &tlsConfig)
+	require.NoError(t, err)
+	assert.NotNil(t, conn)
+
+	require.NoError(t, os.WriteFile(tempCertFile, []byte("not a valid certificate"), 0o600))
+	require.NoError(t, os.WriteFile(tempKeyFile, []byte("not a valid key"), 0o600))
+
+	// Second call: mtime changed → reload attempted → parse fails → error returned.
+	// The stale (valid) cached cert must NOT be silently served.
+	_, err = apiclient.NewConnection("example.com:443", 10, &tlsConfig)
+	require.Error(t, err,
+		"a corrupt cert file must cause an error after cache invalidation, "+
+			"not silently serve the stale cached cert")
+	assert.Contains(t, err.Error(), "failed to load client certificate",
+		"error must identify the cert load as the failure site")
+}
+
+func TestNewConnection_DoesNotCacheClientCertificateLoadError(t *testing.T) {
+	t.Cleanup(apiclient.ResetClientCertCache)
+	apiclient.ResetClientCertCache()
+
+	tempDir := t.TempDir()
+	tempCertFile := filepath.Join(tempDir, "client.crt")
+	tempKeyFile := filepath.Join(tempDir, "client.key")
+
+	tlsConfig := utilstls.Configuration{
+		StrictValidation:  false,
+		ClientCertFile:    tempCertFile,
+		ClientCertKeyFile: tempKeyFile,
+	}
+
+	conn, err := apiclient.NewConnection("example.com:443", 10, &tlsConfig)
+	require.NoError(t, err, "missing cert file must not cause an error — mTLS is skipped gracefully")
+	assert.NotNil(t, conn)
+
+	certFile := filepath.Join("..", "..", "util", "tls", "testdata", "valid_tls.crt")
+	keyFile := filepath.Join("..", "..", "util", "tls", "testdata", "valid_tls.key")
+
+	certBytes, err := os.ReadFile(certFile)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(tempCertFile, certBytes, 0o600))
+
+	keyBytes, err := os.ReadFile(keyFile)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(tempKeyFile, keyBytes, 0o600))
+
+	conn, err = apiclient.NewConnection("example.com:443", 10, &tlsConfig)
+	require.NoError(t, err)
+	assert.NotNil(t, conn)
+}
+
+func TestMTLSIntegration_NoClientCert_IsRejected(t *testing.T) {
+	t.Parallel()
+
+	_, parsedClientCert := generateClientCA(t, "test-client")
+
+	pool := x509.NewCertPool()
+	pool.AddCert(parsedClientCert)
+	fixture := newMTLSServer(t, pool)
+
+	conn, err := apiclient.NewConnection(fixture.addr, 5, &utilstls.Configuration{
+		StrictValidation: false,
+	})
+	require.NoError(t, err, "NewConnection is lazy — dial error surfaces on first RPC")
+	defer func(conn *grpc.ClientConn) {
+		err := conn.Close()
+		if err != nil {
+			t.Logf("failed to close connection: %v", err)
+		}
+	}(conn)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	conn.Connect()
+	for {
+		st := conn.GetState()
+		if st == connectivity.Ready || st == connectivity.TransientFailure || st == connectivity.Shutdown {
+			break
+		}
+		if !conn.WaitForStateChange(ctx, st) {
+			break
+		}
+	}
+
+	err = healthCheck(t, conn)
+	require.Error(t, err, "the server enforces mTLS; a client without a certificate must be rejected")
+	// gRPC may surface the TLS alert as "certificate required" or as a transport-level
+	// "broken pipe" when the server closes the connection after detecting the missing cert.
+	// Both are valid indicators of an mTLS rejection.
+	assert.True(t,
+		strings.Contains(err.Error(), "certificate") || strings.Contains(err.Error(), "broken pipe"),
+		"rejection must be a TLS-related error (certificate or broken pipe), got: %v", err,
+	)
+}
+
+func TestMTLSIntegration_ValidClientCert_IsAccepted(t *testing.T) {
+	t.Parallel()
+	t.Cleanup(apiclient.ResetClientCertCache)
+
+	clientCert, parsedClientCert := generateClientCA(t, "test-client")
+
+	pool := x509.NewCertPool()
+	pool.AddCert(parsedClientCert)
+	fixture := newMTLSServer(t, pool)
+
+	conn, err := apiclient.NewConnection(fixture.addr, 5, &utilstls.Configuration{
+		StrictValidation:   false,
+		ClientCertificates: []tls.Certificate{*clientCert},
+	})
+	require.NoError(t, err)
+	defer func(conn *grpc.ClientConn) {
+		err := conn.Close()
+		if err != nil {
+			t.Logf("failed to close connection: %v", err)
+		}
+	}(conn)
+
+	require.NoError(t, healthCheck(t, conn), "client presenting a cert trusted by the server's ClientCAs must succeed")
+}
+
+func TestMTLSIntegration_UntrustedClientCert_IsRejected(t *testing.T) {
+	t.Parallel()
+
+	_, trustedParsed := generateClientCA(t, "trusted-ca")
+	trustedPool := x509.NewCertPool()
+	trustedPool.AddCert(trustedParsed)
+	fixture := newMTLSServer(t, trustedPool)
+
+	untrustedCert, _ := generateClientCA(t, "untrusted-client")
+
+	conn, err := apiclient.NewConnection(fixture.addr, 5, &utilstls.Configuration{
+		StrictValidation:   false,
+		ClientCertificates: []tls.Certificate{*untrustedCert},
+	})
+	require.NoError(t, err, "NewConnection is lazy")
+	defer func(conn *grpc.ClientConn) {
+		err := conn.Close()
+		if err != nil {
+			t.Logf("failed to close connection: %v", err)
+		}
+	}(conn)
+
+	require.Error(t, healthCheck(t, conn), "a cert signed by an unknown CA must be rejected by the server")
+}
+
+func TestMTLSIntegration_HealthCheckEphemeralCert_IsAccepted(t *testing.T) {
+	t.Parallel()
+
+	hcCert, err := utilstls.GenerateHealthCheckClientCert()
+	require.NoError(t, err, "GenerateHealthCheckClientCert")
+
+	parsedHCCert, err := x509.ParseCertificate(hcCert.Certificate[0])
+	require.NoError(t, err)
+
+	pool := x509.NewCertPool()
+	pool.AddCert(parsedHCCert)
+	fixture := newMTLSServer(t, pool)
+
+	conn, err := apiclient.NewConnection(fixture.addr, 5, &utilstls.Configuration{
+		StrictValidation:   false, // liveness probe skips server cert verification
+		ClientCertificates: []tls.Certificate{*hcCert},
+	})
+	require.NoError(t, err)
+	defer func(conn *grpc.ClientConn) {
+		err := conn.Close()
+		if err != nil {
+			t.Logf("failed to close connection: %v", err)
+		}
+	}(conn)
+
+	require.NoError(t, healthCheck(t, conn), "liveness probe using the ephemeral health-check cert must be accepted")
+}
+
+// TestMTLSIntegration_DisableTLS_PlaintextConnection verifies that a server
+// running without TLS accepts a plaintext client, establishing the baseline
+// that DisableTLS=true on the client side still works after this PR.
+func TestMTLSIntegration_DisableTLS_PlaintextConnection(t *testing.T) {
+	t.Parallel()
+	lis, err := new(net.ListenConfig).Listen(context.Background(), "tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	srv := grpc.NewServer() // no TLS credentials
+	hsvc := health.NewServer()
+	hsvc.SetServingStatus("", grpc_health_v1.HealthCheckResponse_SERVING)
+	grpc_health_v1.RegisterHealthServer(srv, hsvc)
+	go func() { _ = srv.Serve(lis) }()
+	t.Cleanup(srv.Stop)
+
+	conn, err := apiclient.NewConnection(lis.Addr().String(), 5, &utilstls.Configuration{
+		DisableTLS: true,
+	})
+	require.NoError(t, err)
+	defer conn.Close()
+
+	err = healthCheck(t, conn)
+	require.NoError(t, err, "plaintext connection to a plaintext server must succeed")
+}
+
+// TestMTLSIntegration_StrictValidation_CertificatesPoolTakesPrecedence
+// exercises the buildTLSClientConfig fix: when Certificates is non-nil,
+// InsecureSkipVerify must be false even if StrictValidation=false in the
+// struct.  This is the `strictValidation := tlsConfig.StrictValidation ||
+// tlsConfig.Certificates != nil` guard in buildTLSClientConfig.
+//
+// The test verifies observable behaviour: the connection succeeds only when
+// the client presents the correct CA pool (i.e. server cert verification is
+// actually being performed, not skipped).
+func TestMTLSIntegration_StrictValidation_CertificatesPoolTakesPrecedence(t *testing.T) {
+	t.Parallel()
+
+	clientCert, parsedClientCert := generateClientCA(t, "test-client-strict")
+	clientPool := x509.NewCertPool()
+	clientPool.AddCert(parsedClientCert)
+	fixture := newMTLSServer(t, clientPool)
+
+	// We need the client to verify the server's certificate, so we must tell
+	// it which CA signed the server cert.  The server is self-signed, so we
+	// extract its cert and build a server-CA pool from it.
+	serverTLSState, err := extractServerCert(t, fixture.addr, clientCert)
+	require.NoError(t, err)
+	serverCAParsed, err := x509.ParseCertificate(serverTLSState.Certificate[0])
+	require.NoError(t, err)
+	serverCAPool := x509.NewCertPool()
+	serverCAPool.AddCert(serverCAParsed)
+
+	// StrictValidation=false BUT Certificates is non-nil.
+	// buildTLSClientConfig must treat this as strict=true (the fix).
+	conn, err := apiclient.NewConnection(fixture.addr, 5, &utilstls.Configuration{
+		StrictValidation:   false,        // struct field says "not strict" …
+		Certificates:       serverCAPool, // … but a pool is present, so strict wins
+		ClientCertificates: []tls.Certificate{*clientCert},
+	})
+	require.NoError(t, err)
+	defer conn.Close()
+
+	err = healthCheck(t, conn)
+	require.NoError(t, err,
+		"when Certificates pool is set, server cert must be verified and the "+
+			"connection must succeed when the pool contains the server's CA")
+}
+
+func TestNewConnection_ClientCertFileDoesNotExist_SkipsMTLS(t *testing.T) {
+	t.Cleanup(apiclient.ResetClientCertCache)
+	apiclient.ResetClientCertCache()
+
+	tlsConfig := utilstls.Configuration{
+		StrictValidation:  false,
+		ClientCertFile:    "/nonexistent/path/client.crt",
+		ClientCertKeyFile: "/nonexistent/path/client.key",
+	}
+
+	conn, err := apiclient.NewConnection("example.com:443", 10, &tlsConfig)
+	require.NoError(t, err)
+	assert.NotNil(t, conn)
+}
+
+func TestNewConnection_ClientCertFileStatNonErrNotExist_ReturnsError(t *testing.T) {
+	t.Cleanup(apiclient.ResetClientCertCache)
+	apiclient.ResetClientCertCache()
+
+	dir := t.TempDir()
+	require.NoError(t, os.Chmod(dir, 0o000))
+	t.Cleanup(func() { _ = os.Chmod(dir, 0o700) })
+
+	tlsConfig := utilstls.Configuration{
+		StrictValidation:  false,
+		ClientCertFile:    filepath.Join(dir, "client.crt"),
+		ClientCertKeyFile: filepath.Join(dir, "client.key"),
+	}
+
+	_, err := apiclient.NewConnection("example.com:443", 10, &tlsConfig)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "could not stat client cert file")
+}
+
+func TestNewConnection_ClientCertCallbackReturnsEmptyCertWhenFileDisappears(t *testing.T) {
+	t.Cleanup(apiclient.ResetClientCertCache)
+	apiclient.ResetClientCertCache()
+
+	srcCert := filepath.Join("..", "..", "util", "tls", "testdata", "valid_tls.crt")
+	srcKey := filepath.Join("..", "..", "util", "tls", "testdata", "valid_tls.key")
+
+	dir := t.TempDir()
+	tempCert := filepath.Join(dir, "client.crt")
+	tempKey := filepath.Join(dir, "client.key")
+
+	certBytes, err := os.ReadFile(srcCert)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(tempCert, certBytes, 0o600))
+
+	keyBytes, err := os.ReadFile(srcKey)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(tempKey, keyBytes, 0o600))
+
+	tlsConfig := utilstls.Configuration{
+		StrictValidation:  false,
+		ClientCertFile:    tempCert,
+		ClientCertKeyFile: tempKey,
+	}
+
+	conn, err := apiclient.NewConnection("example.com:443", 10, &tlsConfig)
+	require.NoError(t, err)
+	assert.NotNil(t, conn)
+
+	require.NoError(t, os.Remove(tempCert))
+	require.NoError(t, os.Remove(tempKey))
+
+	apiclient.ResetClientCertCache()
+	conn, err = apiclient.NewConnection("example.com:443", 10, &tlsConfig)
+	require.NoError(t, err)
+	assert.NotNil(t, conn)
+}
+
+func extractServerCert(t *testing.T, addr string, clientCert *tls.Certificate) (*tls.Certificate, error) {
+	t.Helper()
+	cfg := &tls.Config{
+		InsecureSkipVerify: true, //nolint:gosec // intentional: only used to fetch the cert bytes
+		Certificates:       []tls.Certificate{*clientCert},
+	}
+	d := &tls.Dialer{Config: cfg}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	conn, err := d.DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return nil, err
+	}
+	defer conn.Close()
+	tlsConnection, ok := conn.(*tls.Conn)
+	if !ok {
+		t.Fatal("expected *tls.Conn from tls.Dialer")
+	}
+	state := tlsConnection.ConnectionState()
+	if len(state.PeerCertificates) == 0 {
+		t.Fatal("server sent no certificate")
+	}
+	raw := state.PeerCertificates[0].Raw
+	tlsCert := &tls.Certificate{Certificate: [][]byte{raw}}
+	return tlsCert, nil
+}
+
+type mTLSServerFixture struct {
+	addr   string
+	server *grpc.Server //nolint:unused // for some reason this linter complains
+}
+
+func newMTLSServer(t *testing.T, clientCAs *x509.CertPool) *mTLSServerFixture {
+	t.Helper()
+
+	serverCert, err := utilstls.GenerateX509KeyPair(utilstls.CertOptions{
+		Hosts:        []string{"localhost", "127.0.0.1"},
+		Organization: "Argo CD Integration Test Server",
+		IsCA:         false,
+		ECDSACurve:   "P256",
+		ValidFor:     time.Hour,
+	})
+	require.NoError(t, err, "generating server certificate")
+
+	serverTLSCfg := &tls.Config{
+		Certificates: []tls.Certificate{*serverCert},
+		ClientCAs:    clientCAs,
+		ClientAuth:   tls.RequireAndVerifyClientCert,
+		MinVersion:   tls.VersionTLS12,
+	}
+
+	lis, err := new(net.ListenConfig).Listen(context.Background(), "tcp", "127.0.0.1:0")
+	require.NoError(t, err, "binding test listener")
+
+	srv := grpc.NewServer(grpc.Creds(credentials.NewTLS(serverTLSCfg)))
+	hsvc := health.NewServer()
+	hsvc.SetServingStatus("", grpc_health_v1.HealthCheckResponse_SERVING)
+	grpc_health_v1.RegisterHealthServer(srv, hsvc)
+
+	go func() { _ = srv.Serve(lis) }()
+	t.Cleanup(srv.Stop)
+
+	return &mTLSServerFixture{addr: lis.Addr().String(), server: srv}
+}
+
+func healthCheck(t *testing.T, conn *grpc.ClientConn) error {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	resp, err := grpc_health_v1.NewHealthClient(conn).Check(ctx, &grpc_health_v1.HealthCheckRequest{})
+	if err != nil {
+		return err
+	}
+	if resp.GetStatus() != grpc_health_v1.HealthCheckResponse_SERVING {
+		return status.Errorf(codes.Unavailable, "server status: %v", resp.GetStatus())
+	}
+	return nil
+}
+
+func generateClientCA(t *testing.T, cn string) (*tls.Certificate, *x509.Certificate) {
+	t.Helper()
+	cert, err := utilstls.GenerateX509KeyPair(utilstls.CertOptions{
+		Hosts:        []string{cn},
+		Organization: "Argo CD Integration Test",
+		IsCA:         true,
+		ECDSACurve:   "P256",
+		ValidFor:     time.Hour,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+	})
+	require.NoError(t, err)
+	parsed, err := x509.ParseCertificate(cert.Certificate[0])
+	require.NoError(t, err)
+	return cert, parsed
+}

reposerver/server.go

@@ -2,6 +2,7 @@ package reposerver
 
 import (
 	"crypto/tls"
+	"crypto/x509"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -35,26 +36,52 @@ import (
 type ArgoCDRepoServer struct {
 	repoService *repository.Service
 	opts        []grpc.ServerOption
+	tlsConfig   *tls.Config
+	// healthCheckClientCert is an ephemeral cert generated at startup for the liveness probe self-connection.
+	// It is nil when mTLS is not enabled.
+	healthCheckClientCert *tls.Certificate
 }
 
-// The hostnames to generate self-signed issues with
+// The hostnames to generate self-signed certificates with
 var tlsHostList = []string{"localhost", "reposerver"}
 
 // NewServer returns a new instance of the Argo CD Repo server
-func NewServer(metricsServer *metrics.MetricsServer, cache *reposervercache.Cache, tlsConfCustomizer tlsutil.ConfigCustomizer, initConstants repository.RepoServerInitConstants, gitCredsStore git.CredsStore) (*ArgoCDRepoServer, error) {
+func NewServer(metricsServer *metrics.MetricsServer, cache *reposervercache.Cache, tlsConfCustomizer tlsutil.ConfigCustomizer, initConstants repository.RepoServerInitConstants, gitCredsStore git.CredsStore, clientCAPath string, disableTLS bool) (*ArgoCDRepoServer, error) {
 	var tlsConfig *tls.Config
+	var healthCheckClientCert *tls.Certificate
 
-	// Generate or load TLS server certificates to use with this instance of
-	// repository server.
-	if tlsConfCustomizer != nil {
+	if !disableTLS {
 		var err error
 		certPath := env.StringFromEnv(common.EnvAppConfigPath, common.DefaultAppConfigPath) + "/reposerver/tls/tls.crt"
 		keyPath := env.StringFromEnv(common.EnvAppConfigPath, common.DefaultAppConfigPath) + "/reposerver/tls/tls.key"
-		tlsConfig, err = tlsutil.CreateServerTLSConfig(certPath, keyPath, tlsHostList)
+		tlsConfig, err = tlsutil.CreateServerTLSConfig(certPath, keyPath, tlsHostList, clientCAPath)
 		if err != nil {
 			return nil, fmt.Errorf("error creating server TLS config: %w", err)
 		}
-		tlsConfCustomizer(tlsConfig)
+		if tlsConfCustomizer != nil {
+			tlsConfCustomizer(tlsConfig)
+		}
+
+		// When mTLS is active the server will reject any connection that does not present a valid client cert.
+		// The liveness probe connects to localhost, so we generate a dedicated ephemeral cert and register it with the
+		// server's ClientCAs pool.
+		if clientCAPath != "" && tlsConfig.ClientCAs != nil {
+			hcCert, err := tlsutil.GenerateHealthCheckClientCert()
+			if err != nil {
+				return nil, fmt.Errorf("error generating health-check client certificate: %w", err)
+			}
+			parsedCert, err := x509.ParseCertificate(hcCert.Certificate[0])
+			if err != nil {
+				return nil, fmt.Errorf("error parsing health-check certificate: %w", err)
+			}
+			tlsConfig.ClientCAs.AddCert(parsedCert)
+			healthCheckClientCert = hcCert
+			log.Infof("Generated ephemeral health-check client certificate (CN=%s)", parsedCert.Subject.CommonName)
+		}
+	}
+	// Always ensure ClientAuth is set if we have a CA pool, as we might have customized the config.
+	if tlsConfig != nil && tlsConfig.ClientCAs != nil {
+		tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
 	}
 
 	var serverMetricsOptions []grpc_prometheus.ServerMetricsOption
@@ -101,8 +128,10 @@ func NewServer(metricsServer *metrics.MetricsServer, cache *reposervercache.Cach
 	}
 
 	return &ArgoCDRepoServer{
-		opts:        serverOpts,
-		repoService: repoService,
+		opts:                  serverOpts,
+		repoService:           repoService,
+		tlsConfig:             tlsConfig,
+		healthCheckClientCert: healthCheckClientCert,
 	}, nil
 }
 
@@ -122,3 +151,13 @@ func (a *ArgoCDRepoServer) CreateGRPC() *grpc.Server {
 
 	return server
 }
+
+// GetTLSConfig returns the TLS configuration of the server
+func (a *ArgoCDRepoServer) GetTLSConfig() *tls.Config {
+	return a.tlsConfig
+}
+
+// GetHealthCheckClientCert returns the ephemeral client certificate used by the liveness probe self-connection
+func (a *ArgoCDRepoServer) GetHealthCheckClientCert() *tls.Certificate {
+	return a.healthCheckClientCert
+}

reposerver/server_test.go

@@ -0,0 +1,193 @@
+package reposerver_test
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/argoproj/argo-cd/v3/reposerver"
+	reposervercache "github.com/argoproj/argo-cd/v3/reposerver/cache"
+	"github.com/argoproj/argo-cd/v3/reposerver/metrics"
+	"github.com/argoproj/argo-cd/v3/reposerver/repository"
+	"github.com/argoproj/argo-cd/v3/util/askpass"
+	cacheutil "github.com/argoproj/argo-cd/v3/util/cache"
+	utilstls "github.com/argoproj/argo-cd/v3/util/tls"
+)
+
+func TestNewServer_DisableTLS(t *testing.T) {
+	srv, err := newTestServer(t, "", true)
+	require.NoError(t, err)
+	require.NotNil(t, srv)
+
+	assert.Nil(t, srv.GetTLSConfig(), "TLS config must be nil when --disable-tls is set")
+	assert.Nil(t, srv.GetHealthCheckClientCert(), "health-check client cert must be nil when TLS is disabled")
+}
+
+func TestNewServer_TLSOnly_NoMTLS(t *testing.T) {
+	srv, err := newTestServer(t, "", false)
+	require.NoError(t, err)
+	require.NotNil(t, srv)
+
+	tlsCfg := srv.GetTLSConfig()
+	require.NotNil(t, tlsCfg, "TLS config must be non-nil when TLS is enabled")
+
+	assert.Nil(t, srv.GetHealthCheckClientCert(), "health-check client cert must be nil when clientCAPath is not set")
+	assert.NotEqual(t, tls.RequireAndVerifyClientCert, tlsCfg.ClientAuth, "ClientAuth must not be RequireAndVerifyClientCert when mTLS is not configured")
+	assert.Nil(t, tlsCfg.ClientCAs, "ClientCAs pool must be nil when no client CA path is provided")
+}
+
+func TestNewServer_MTLS_HealthCheckCertGenerated(t *testing.T) {
+	caPath := writeTempCACert(t)
+
+	srv, err := newTestServer(t, caPath, false)
+	require.NoError(t, err)
+	require.NotNil(t, srv)
+
+	hcCert := srv.GetHealthCheckClientCert()
+	require.NotNil(t, hcCert, "an ephemeral health-check client cert must be generated when mTLS is enabled")
+	require.NotEmpty(t, hcCert.Certificate, "the health-check cert must contain at least one DER-encoded certificate")
+}
+
+func TestNewServer_MTLS_ServerRequiresClientCert(t *testing.T) {
+	caPath := writeTempCACert(t)
+
+	srv, err := newTestServer(t, caPath, false)
+	require.NoError(t, err)
+
+	tlsCfg := srv.GetTLSConfig()
+	require.NotNil(t, tlsCfg)
+
+	assert.Equal(t, tls.RequireAndVerifyClientCert, tlsCfg.ClientAuth, "server must enforce RequireAndVerifyClientCert when a client CA path is set")
+	assert.NotNil(t, tlsCfg.ClientCAs, "ClientCAs pool must be populated from the provided client CA path")
+}
+
+func TestNewServer_MTLS_HealthCheckCertRegisteredInClientCAs(t *testing.T) {
+	caPath := writeTempCACert(t)
+
+	srv, err := newTestServer(t, caPath, false)
+	require.NoError(t, err)
+
+	hcCert := srv.GetHealthCheckClientCert()
+	require.NotNil(t, hcCert)
+
+	tlsCfg := srv.GetTLSConfig()
+	require.NotNil(t, tlsCfg)
+	require.NotNil(t, tlsCfg.ClientCAs)
+
+	parsedHCCert, err := x509.ParseCertificate(hcCert.Certificate[0])
+	require.NoError(t, err)
+
+	_, err = parsedHCCert.Verify(x509.VerifyOptions{
+		Roots:     tlsCfg.ClientCAs,
+		KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+	})
+	require.NoError(t, err, "the health-check cert must be verifiable against the server's ClientCAs pool: "+
+		"if this fails, the liveness probe will be rejected by its own server")
+}
+
+func TestNewServer_MTLS_HealthCheckCertProperties(t *testing.T) {
+	caPath := writeTempCACert(t)
+
+	srv, err := newTestServer(t, caPath, false)
+	require.NoError(t, err)
+
+	hcCert := srv.GetHealthCheckClientCert()
+	require.NotNil(t, hcCert)
+
+	parsed, err := x509.ParseCertificate(hcCert.Certificate[0])
+	require.NoError(t, err)
+
+	assert.True(t, parsed.IsCA, "health-check cert must be a CA cert so it can be added to the ClientCAs pool")
+	assert.Equal(t, parsed.Subject.String(), parsed.Issuer.String(), "health-check cert must be self-signed")
+	require.Len(t, parsed.ExtKeyUsage, 1, "health-check cert must carry exactly one extended key usage")
+	assert.Equal(t, x509.ExtKeyUsageClientAuth, parsed.ExtKeyUsage[0], "health-check cert must carry ExtKeyUsageClientAuth, not ExtKeyUsageServerAuth")
+}
+
+func TestNewServer_MTLS_EachStartupGeneratesDistinctCert(t *testing.T) {
+	caPath1 := writeTempCACert(t)
+	caPath2 := writeTempCACert(t)
+
+	srv1, err := newTestServer(t, caPath1, false)
+	require.NoError(t, err)
+
+	srv2, err := newTestServer(t, caPath2, false)
+	require.NoError(t, err)
+
+	cert1 := srv1.GetHealthCheckClientCert()
+	cert2 := srv2.GetHealthCheckClientCert()
+
+	require.NotNil(t, cert1)
+	require.NotNil(t, cert2)
+
+	assert.NotEqual(t, cert1.Certificate[0], cert2.Certificate[0], "each server instance must generate its own unique ephemeral health-check cert")
+}
+
+func TestNewServer_MTLS_InvalidCAPath(t *testing.T) {
+	srv, err := newTestServer(t, "/nonexistent/path/ca.crt", false)
+	require.NoError(t, err)
+	require.NotNil(t, srv)
+
+	tlsCfg := srv.GetTLSConfig()
+	require.NotNil(t, tlsCfg, "TLS config must still be non-nil (server TLS is active, just no mTLS)")
+	assert.Nil(t, tlsCfg.ClientCAs, "ClientCAs must be nil when the CA file does not exist")
+	assert.NotEqual(t, tls.RequireAndVerifyClientCert, tlsCfg.ClientAuth, "ClientAuth must not require client certs when CA file is absent")
+	assert.Nil(t, srv.GetHealthCheckClientCert(), "no health-check cert should be generated when mTLS is skipped")
+}
+
+func TestNewServer_MTLS_InvalidCACertContent(t *testing.T) {
+	invalidCAPath := filepath.Join(t.TempDir(), "bad-ca.crt")
+	require.NoError(t, os.WriteFile(invalidCAPath, []byte("not a valid certificate"), 0o600))
+
+	_, err := newTestServer(t, invalidCAPath, false)
+	assert.ErrorContains(t, err, "invalid cert data")
+}
+
+func newTestServer(t *testing.T, clientCAPath string, disableTLS bool) (*reposerver.ArgoCDRepoServer, error) {
+	t.Helper()
+
+	metricsServer := metrics.NewMetricsServer()
+
+	cache := reposervercache.NewCache(
+		cacheutil.NewCache(cacheutil.NewInMemoryCache(1*time.Hour)),
+		1*time.Minute,
+		1*time.Minute,
+		10*time.Second,
+	)
+
+	askPassServer := askpass.NewServer(filepath.Join(t.TempDir(), "argocd-askpass.sock"))
+
+	return reposerver.NewServer(
+		metricsServer,
+		cache,
+		nil,
+		repository.RepoServerInitConstants{},
+		askPassServer,
+		clientCAPath,
+		disableTLS,
+	)
+}
+
+func writeTempCACert(t *testing.T) string {
+	t.Helper()
+
+	cert, err := utilstls.GenerateX509KeyPair(utilstls.CertOptions{
+		Hosts:        []string{"localhost"},
+		Organization: "Argo CD Test CA",
+		IsCA:         true,
+		ECDSACurve:   "P256",
+	})
+	require.NoError(t, err)
+
+	certPEM, _ := utilstls.EncodeX509KeyPair(*cert)
+
+	path := filepath.Join(t.TempDir(), "ca.crt")
+	require.NoError(t, os.WriteFile(path, certPEM, 0o600))
+
+	return path
+}

util/tls/tls.go

@@ -42,6 +42,21 @@ var tlsVersionByString = map[string]uint16{
 	"1.3": tls.VersionTLS13,
 }
 
+// Configuration describes parameters for TLS configuration to be used by a repo server API client
+type Configuration struct {
+	// Whether to disable TLS for connections
+	DisableTLS bool
+	// Whether to enforce strict validation of TLS certificates
+	StrictValidation bool
+	// List of certificates to validate the peer against (if StrictCerts is true)
+	Certificates *x509.CertPool
+	// ClientCertFile is the path to the client certificate file
+	ClientCertFile string
+	// ClientCertKeyFile is the path to the client certificate key file
+	ClientCertKeyFile string
+	// ClientCertificates are the client certificates to be used for TLS
+	ClientCertificates []tls.Certificate
+}
 type CertOptions struct {
 	// Hostnames and IPs to generate a certificate for
 	Hosts []string
@@ -57,6 +72,9 @@ type CertOptions struct {
 	RSABits int
 	// ECDSA curve to use to generate a key. Valid values are P224, P256 (recommended), P384, P521
 	ECDSACurve string
+	// ExtKeyUsage overrides the default ExtKeyUsage list on the generated certificate.
+	// If nil, defaults to []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}.
+	ExtKeyUsage []x509.ExtKeyUsage
 }
 
 type ConfigCustomizer = func(*tls.Config)
@@ -163,15 +181,24 @@ func getTLSConfigCustomizer(minVersionStr, maxVersionStr, tlsCiphersStr string)
 	}, nil
 }
 
-// Adds TLS server related command line options to a command and returns a TLS
+// AddTLSFlagsToCmd adds TLS server-related command line options to a command and returns a TLS
 // config customizer object, set up to the options specified
 func AddTLSFlagsToCmd(cmd *cobra.Command) func() (ConfigCustomizer, error) {
+	return AddTLSFlagsToCmdWithPrefix(cmd, "")
+}
+
+func AddTLSFlagsToCmdWithPrefix(cmd *cobra.Command, prefix string) func() (ConfigCustomizer, error) {
 	minVersionStr := ""
 	maxVersionStr := ""
 	tlsCiphersStr := ""
-	cmd.Flags().StringVar(&minVersionStr, "tlsminversion", env.StringFromEnv("ARGOCD_TLS_MIN_VERSION", DefaultTLSMinVersion), "The minimum SSL/TLS version that is acceptable (one of: 1.0|1.1|1.2|1.3)")
-	cmd.Flags().StringVar(&maxVersionStr, "tlsmaxversion", env.StringFromEnv("ARGOCD_TLS_MAX_VERSION", DefaultTLSMaxVersion), "The maximum SSL/TLS version that is acceptable (one of: 1.0|1.1|1.2|1.3)")
-	cmd.Flags().StringVar(&tlsCiphersStr, "tlsciphers", env.StringFromEnv("ARGOCD_TLS_CIPHERS", DefaultTLSCipherSuite), "The list of acceptable ciphers to be used when establishing TLS connections. Use 'list' to list available ciphers.")
+	envPrefix := ""
+	if prefix != "" {
+		envPrefix = strings.ReplaceAll(strings.ToUpper(prefix), "-", "_") + "_"
+		prefix = prefix + "-"
+	}
+	cmd.Flags().StringVar(&minVersionStr, prefix+"tlsminversion", env.StringFromEnv("ARGOCD_"+envPrefix+"TLS_MIN_VERSION", DefaultTLSMinVersion), "The minimum SSL/TLS version that is acceptable (one of: 1.0|1.1|1.2|1.3)")
+	cmd.Flags().StringVar(&maxVersionStr, prefix+"tlsmaxversion", env.StringFromEnv("ARGOCD_"+envPrefix+"TLS_MAX_VERSION", DefaultTLSMaxVersion), "The maximum SSL/TLS version that is acceptable (one of: 1.0|1.1|1.2|1.3)")
+	cmd.Flags().StringVar(&tlsCiphersStr, prefix+"tlsciphers", env.StringFromEnv("ARGOCD_"+envPrefix+"TLS_CIPHERS", DefaultTLSCipherSuite), "The list of acceptable ciphers to be used when establishing TLS connections. Use 'list' to list available ciphers.")
 
 	return func() (ConfigCustomizer, error) {
 		return getTLSConfigCustomizer(minVersionStr, maxVersionStr, tlsCiphersStr)
@@ -262,6 +289,11 @@ func generate(opts CertOptions) ([]byte, crypto.PrivateKey, error) {
 	if opts.Organization == "" {
 		return nil, nil, errors.New("organization not supplied")
 	}
+
+	extKeyUsage := opts.ExtKeyUsage
+	if extKeyUsage == nil {
+		extKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}
+	}
 	template := x509.Certificate{
 		SerialNumber: serialNumber,
 		Subject: pkix.Name{
@@ -271,7 +303,7 @@ func generate(opts CertOptions) ([]byte, crypto.PrivateKey, error) {
 		NotAfter:  notAfter,
 
 		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
-		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		ExtKeyUsage:           extKeyUsage,
 		BasicConstraintsValid: true,
 	}
 
@@ -320,6 +352,13 @@ func GenerateX509KeyPair(opts CertOptions) (*tls.Certificate, error) {
 	if err != nil {
 		return nil, err
 	}
+	if len(cert.Certificate) > 0 {
+		leaf, err := x509.ParseCertificate(cert.Certificate[0])
+		if err != nil {
+			return nil, fmt.Errorf("error parsing generated certificate: %w", err)
+		}
+		cert.Leaf = leaf
+	}
 	return &cert, nil
 }
 
@@ -391,7 +430,7 @@ func LoadX509Cert(path string) (*x509.Certificate, error) {
 // if these are not given, will generate a self-signed certificate valid for
 // the specified list of hosts. If hosts is nil or empty, self-signed cert
 // creation will be disabled.
-func CreateServerTLSConfig(tlsCertPath, tlsKeyPath string, hosts []string) (*tls.Config, error) {
+func CreateServerTLSConfig(tlsCertPath, tlsKeyPath string, hosts []string, clientCAPath string) (*tls.Config, error) {
 	var cert *tls.Certificate
 	var err error
 
@@ -436,8 +475,91 @@ func CreateServerTLSConfig(tlsCertPath, tlsKeyPath string, hosts []string) (*tls
 		if err != nil {
 			return nil, fmt.Errorf("unable to initialize TLS configuration with cert=%s and key=%s: %w", tlsCertPath, tlsKeyPath, err)
 		}
+		if len(c.Certificate) > 0 {
+			leaf, err := x509.ParseCertificate(c.Certificate[0])
+			if err != nil {
+				return nil, fmt.Errorf("error parsing loaded certificate: %w", err)
+			}
+			c.Leaf = leaf
+		}
 		cert = &c
 	}
 
-	return &tls.Config{Certificates: []tls.Certificate{*cert}}, nil
+	tlsConfig := &tls.Config{Certificates: []tls.Certificate{*cert}}
+
+	if clientCAPath != "" {
+		if _, statErr := os.Stat(clientCAPath); os.IsNotExist(statErr) {
+			// client CA file is not present = mTLS not enabled, continue without ClientAuth
+			return tlsConfig, nil
+		} else if statErr != nil {
+			return nil, fmt.Errorf("could not stat client CA file %s: %w", clientCAPath, statErr)
+		}
+		pool, err := LoadX509CertPool(clientCAPath)
+		if err != nil {
+			return nil, fmt.Errorf("error loading client CA: %w", err)
+		}
+		tlsConfig.ClientCAs = pool
+		tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
+		log.Infof("mTLS enabled for repo-server: requiring client certificates from CA=%s", clientCAPath)
+	}
+
+	return tlsConfig, nil
+}
+
+func AddClientTLSFlagsToCmd(cmd *cobra.Command) func() (Configuration, error) {
+	return AddClientTLSFlagsToCmdWithPrefix(cmd, "")
+}
+
+func AddClientTLSFlagsToCmdWithPrefix(cmd *cobra.Command, prefix string) func() (Configuration, error) {
+	var tlsConfig Configuration
+	var repoServerCACert string
+	envPrefix := ""
+
+	if prefix != "" {
+		envPrefix = strings.ReplaceAll(strings.ToUpper(prefix), "-", "_") + "_"
+	}
+
+	cmd.Flags().StringVar(&repoServerCACert, "repo-server-ca-cert-path", env.StringFromEnv("ARGOCD_"+envPrefix+"REPO_SERVER_CA_CERT_PATH", ""), "Path to the repo-server CA certificate file")
+	cmd.Flags().StringVar(&tlsConfig.ClientCertFile, "repo-server-client-cert-path", env.StringFromEnv("ARGOCD_"+envPrefix+"REPO_SERVER_CLIENT_CERT_PATH", "/app/config/reposerver/mtls/client.crt"), "Path to the client certificate file for mTLS. Defaults to the auto-mounted Secret path; mTLS client cert is skipped if the file does not exist.")
+	cmd.Flags().StringVar(&tlsConfig.ClientCertKeyFile, "repo-server-client-cert-key-path", env.StringFromEnv("ARGOCD_"+envPrefix+"REPO_SERVER_CLIENT_CERT_KEY_PATH", "/app/config/reposerver/mtls/client.key"), "Path to the client certificate key file for mTLS. Defaults to the auto-mounted Secret path; mTLS client cert is skipped if the file does not exist.")
+
+	return func() (Configuration, error) {
+		config := tlsConfig
+
+		if config.ClientCertFile != "" && config.ClientCertKeyFile == "" {
+			return config, errors.New("--repo-server-client-cert-key-path is required when --repo-server-client-cert-path is specified")
+		}
+		if config.ClientCertKeyFile != "" && config.ClientCertFile == "" {
+			return config, errors.New("--repo-server-client-cert-path is required when --repo-server-client-cert-key-path is specified")
+		}
+
+		config.StrictValidation = repoServerCACert != ""
+
+		if repoServerCACert != "" {
+			pool, err := LoadX509CertPool(repoServerCACert)
+			if err != nil {
+				return config, fmt.Errorf("error loading repo-server CA: %w", err)
+			}
+			config.Certificates = pool
+		} else {
+			config.Certificates = nil
+		}
+
+		return config, nil
+	}
+}
+
+// GenerateHealthCheckClientCert generates an ephemeral self-signed CA and a leaf certificate pair for use by the
+// repo-server liveness probe self-connection.
+func GenerateHealthCheckClientCert() (*tls.Certificate, error) {
+	return GenerateX509KeyPair(CertOptions{
+		Hosts:        []string{"argocd-repo-server-healthcheck"},
+		Organization: "Argo CD Health Check",
+		IsCA:         true, // self-signed CA so it can be added to ClientCAs pool directly
+		ECDSACurve:   "P256",
+		ValidFor:     10 * 365 * 24 * time.Hour,
+		ExtKeyUsage: []x509.ExtKeyUsage{
+			x509.ExtKeyUsageClientAuth,
+		},
+	})
 }

util/tls/tls_test.go

@@ -9,10 +9,13 @@ import (
 	"fmt"
 	"math/big"
 	"os"
+	"path"
 	"strings"
 	"testing"
 	"time"
 
+	logtest "github.com/sirupsen/logrus/hooks/test"
+	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -396,7 +399,7 @@ func TestCreateServerTLSConfig(t *testing.T) {
 	t.Parallel()
 	t.Run("Configuration from a valid key/cert pair", func(t *testing.T) {
 		t.Parallel()
-		tlsc, err := CreateServerTLSConfig("testdata/valid_tls.crt", "testdata/valid_tls.key", []string{"localhost", "argocd-repo-server"})
+		tlsc, err := CreateServerTLSConfig("testdata/valid_tls.crt", "testdata/valid_tls.key", []string{"localhost", "argocd-repo-server"}, "")
 		require.NoError(t, err)
 		assert.Len(t, tlsc.Certificates, 1)
 		c, err := x509.ParseCertificate(tlsc.Certificates[0].Certificate[0])
@@ -406,27 +409,67 @@ func TestCreateServerTLSConfig(t *testing.T) {
 
 	t.Run("Self-signed creation due to non-existing cert", func(t *testing.T) {
 		t.Parallel()
-		tlsc, err := CreateServerTLSConfig("testdata/invvalid_tls.crt", "testdata/invalid_tls.key", []string{"localhost", "argocd-repo-server"})
+		tlsc, err := CreateServerTLSConfig("testdata/invvalid_tls.crt", "testdata/invalid_tls.key", []string{"localhost", "argocd-repo-server"}, "")
 		require.NoError(t, err)
 		assert.Len(t, tlsc.Certificates, 1)
 		c, err := x509.ParseCertificate(tlsc.Certificates[0].Certificate[0])
 		require.NoError(t, err)
 		assert.Equal(t, []string{"Argo CD"}, c.Subject.Organization)
+		assert.Equal(t, tls.NoClientCert, tlsc.ClientAuth)
 	})
 
 	t.Run("Self-signed creation fails due to hosts being nil", func(t *testing.T) {
 		t.Parallel()
-		tlsc, err := CreateServerTLSConfig("testdata/invvalid_tls.crt", "testdata/invalid_tls.key", nil)
+		tlsc, err := CreateServerTLSConfig("testdata/invvalid_tls.crt", "testdata/invalid_tls.key", nil, "")
 		require.Error(t, err)
 		assert.Nil(t, tlsc)
 	})
 
 	t.Run("Self-signed creation fails due to invalid certificates", func(t *testing.T) {
 		t.Parallel()
-		tlsc, err := CreateServerTLSConfig("testdata/empty_tls.crt", "testdata/empty_tls.key", nil)
+		tlsc, err := CreateServerTLSConfig("testdata/empty_tls.crt", "testdata/empty_tls.key", nil, "")
 		require.Error(t, err)
 		assert.Nil(t, tlsc)
 	})
+
+	t.Run("Configuration with client CA", func(t *testing.T) {
+		hook := logtest.NewGlobal()
+		defer hook.Reset()
+
+		tlsc, err := CreateServerTLSConfig("testdata/valid_tls.crt", "testdata/valid_tls.key", []string{"localhost"}, "testdata/valid_tls.crt")
+		require.NoError(t, err)
+		assert.NotNil(t, tlsc.ClientCAs)
+		assert.Equal(t, tls.RequireAndVerifyClientCert, tlsc.ClientAuth)
+		require.NotNil(t, hook.LastEntry())
+		assert.Contains(t, hook.LastEntry().Message, "mTLS enabled for repo-server: requiring client certificates from CA=testdata/valid_tls.crt")
+	})
+
+	t.Run("Self-signed creation with NoClientCert when no ClientCA", func(t *testing.T) {
+		tlsc, err := CreateServerTLSConfig("testdata/nonexistent.crt", "testdata/nonexistent.key", []string{"localhost"}, "")
+		require.NoError(t, err)
+		assert.Equal(t, tls.NoClientCert, tlsc.ClientAuth)
+		assert.Nil(t, tlsc.ClientCAs)
+	})
+
+	t.Run("ClientCA path specified but file does not exist — mTLS skipped", func(t *testing.T) {
+		tlsc, err := CreateServerTLSConfig("testdata/valid_tls.crt", "testdata/valid_tls.key", []string{"localhost"}, "testdata/nonexistent_ca.crt")
+		require.NoError(t, err)
+		assert.NotNil(t, tlsc)
+		assert.Equal(t, tls.NoClientCert, tlsc.ClientAuth)
+		assert.Nil(t, tlsc.ClientCAs)
+	})
+
+	t.Run("ClientCA path specified but stat returns non-ErrNotExist error", func(t *testing.T) {
+		dir := t.TempDir()
+		require.NoError(t, os.Chmod(dir, 0o000))
+		t.Cleanup(func() { _ = os.Chmod(dir, 0o700) })
+		caPath := path.Join(dir, "ca.crt")
+
+		tlsc, err := CreateServerTLSConfig("testdata/valid_tls.crt", "testdata/valid_tls.key", []string{"localhost"}, caPath)
+		require.Error(t, err)
+		assert.Nil(t, tlsc)
+		assert.Contains(t, err.Error(), "could not stat client CA file")
+	})
 }
 
 // getCert does the same thing as tls.AppendCertsFromPEM, but throws an error if something goes wrong.
@@ -501,6 +544,120 @@ func TestLoadX509CertPool(t *testing.T) {
 	})
 }
 
+func TestAddTLSFlagsToCmdWithPrefix(t *testing.T) {
+	t.Run("Empty prefix uses standard environment variables", func(t *testing.T) {
+		cmd := &cobra.Command{}
+		t.Setenv("ARGOCD_TLS_MIN_VERSION", "1.1")
+		AddTLSFlagsToCmdWithPrefix(cmd, "")
+
+		minVersion, err := cmd.Flags().GetString("tlsminversion")
+		require.NoError(t, err)
+		assert.Equal(t, "1.1", minVersion)
+	})
+
+	t.Run("Prefix is used for flag names and environment variables", func(t *testing.T) {
+		cmd := &cobra.Command{}
+		t.Setenv("ARGOCD_SERVER_TLS_MIN_VERSION", "1.1")
+		AddTLSFlagsToCmdWithPrefix(cmd, "server")
+
+		minVersion, err := cmd.Flags().GetString("server-tlsminversion")
+		require.NoError(t, err)
+		assert.Equal(t, "1.1", minVersion)
+	})
+}
+
+func TestAddClientTLSFlagsToCmdWithPrefix(t *testing.T) {
+	t.Run("Empty prefix uses standard environment variables", func(t *testing.T) {
+		cmd := &cobra.Command{}
+		t.Setenv("ARGOCD_REPO_SERVER_CA_CERT_PATH", "test-ca-cert")
+		AddClientTLSFlagsToCmdWithPrefix(cmd, "")
+
+		caCert, err := cmd.Flags().GetString("repo-server-ca-cert-path")
+		require.NoError(t, err)
+		assert.Equal(t, "test-ca-cert", caCert)
+	})
+
+	t.Run("Prefix is used for flag names and environment variables", func(t *testing.T) {
+		cmd := &cobra.Command{}
+		t.Setenv("ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_CA_CERT_PATH", "test-ca-cert-prefixed")
+		AddClientTLSFlagsToCmdWithPrefix(cmd, "APPLICATION_CONTROLLER")
+
+		caCert, err := cmd.Flags().GetString("repo-server-ca-cert-path")
+		require.NoError(t, err)
+		assert.Equal(t, "test-ca-cert-prefixed", caCert)
+	})
+
+	t.Run("mTLS client certificate is configured only by explicit flags", func(t *testing.T) {
+		cmd := &cobra.Command{}
+		configSrc := AddClientTLSFlagsToCmdWithPrefix(cmd, "")
+		err := cmd.Flags().Set("repo-server-client-cert-path", "test-client-cert")
+		require.NoError(t, err)
+		err = cmd.Flags().Set("repo-server-client-cert-key-path", "test-client-cert-key")
+		require.NoError(t, err)
+
+		config, err := configSrc()
+		require.NoError(t, err)
+		assert.Empty(t, config.ClientCertificates)
+		assert.Equal(t, "test-client-cert", config.ClientCertFile)
+		assert.Equal(t, "test-client-cert-key", config.ClientCertKeyFile)
+	})
+
+	t.Run("Error when client cert is explicitly cleared but key is still set", func(t *testing.T) {
+		cmd := &cobra.Command{}
+		configSrc := AddClientTLSFlagsToCmdWithPrefix(cmd, "")
+		// Explicitly override cert to empty while key retains its default
+		err := cmd.Flags().Set("repo-server-client-cert-path", "")
+		require.NoError(t, err)
+
+		_, err = configSrc()
+		require.ErrorContains(t, err, "--repo-server-client-cert-path is required when --repo-server-client-cert-key-path is specified")
+	})
+
+	t.Run("Error when client cert key is explicitly cleared but cert is still set", func(t *testing.T) {
+		cmd := &cobra.Command{}
+		configSrc := AddClientTLSFlagsToCmdWithPrefix(cmd, "")
+		// Explicitly override key to empty while cert retains its default
+		err := cmd.Flags().Set("repo-server-client-cert-key-path", "")
+		require.NoError(t, err)
+
+		_, err = configSrc()
+		require.ErrorContains(t, err, "--repo-server-client-cert-key-path is required when --repo-server-client-cert-path is specified")
+	})
+
+	t.Run("Default mTLS client cert paths point to auto-mounted Secret", func(t *testing.T) {
+		cmd := &cobra.Command{}
+		configSrc := AddClientTLSFlagsToCmdWithPrefix(cmd, "")
+
+		config, err := configSrc()
+		require.NoError(t, err)
+		assert.Empty(t, config.ClientCertificates)
+		assert.Equal(t, "/app/config/reposerver/mtls/client.crt", config.ClientCertFile)
+		assert.Equal(t, "/app/config/reposerver/mtls/client.key", config.ClientCertKeyFile)
+	})
+
+	t.Run("Repeated invocations do not leak strict validation state", func(t *testing.T) {
+		cmd := &cobra.Command{}
+		configSrc := AddClientTLSFlagsToCmdWithPrefix(cmd, "")
+
+		certFile := path.Join("testdata", "single.pem")
+		err := cmd.Flags().Set("repo-server-ca-cert-path", certFile)
+		require.NoError(t, err)
+
+		configWithCA, err := configSrc()
+		require.NoError(t, err)
+		assert.True(t, configWithCA.StrictValidation)
+		assert.NotNil(t, configWithCA.Certificates)
+
+		err = cmd.Flags().Set("repo-server-ca-cert-path", "")
+		require.NoError(t, err)
+
+		configWithoutCA, err := configSrc()
+		require.NoError(t, err)
+		assert.False(t, configWithoutCA.StrictValidation)
+		assert.Nil(t, configWithoutCA.Certificates)
+	})
+}
+
 func TestEncodeX509KeyPair_InvalidRSAKey(t *testing.T) {
 	t.Parallel()
 	t.Run("Nil RSA private key", func(t *testing.T) {
@@ -577,3 +734,174 @@ func TestEncodeX509KeyPair_InvalidRSAKey(t *testing.T) {
 		assert.Contains(t, string(keyPEM), "-----END RSA PRIVATE KEY-----")
 	})
 }
+
+func TestGenerateHealthCheckClientCert(t *testing.T) {
+	cert, err := GenerateHealthCheckClientCert()
+	require.NoError(t, err)
+	require.NotNil(t, cert)
+	require.NotEmpty(t, cert.Certificate)
+
+	parsed, err := x509.ParseCertificate(cert.Certificate[0])
+	require.NoError(t, err)
+
+	assert.Equal(t, parsed.Subject.String(), parsed.Issuer.String(), "health-check cert must be self-signed")
+	assert.True(t, parsed.IsCA, "health-check cert must have IsCA=true to be usable in a ClientCAs pool")
+	require.Len(t, parsed.ExtKeyUsage, 1)
+	assert.Equal(t, x509.ExtKeyUsageClientAuth, parsed.ExtKeyUsage[0], "health-check cert must only carry ExtKeyUsageClientAuth, not ExtKeyUsageServerAuth")
+
+	assert.NotNil(t, cert.Leaf)
+}
+
+func TestGenerateHealthCheckClientCert_IsRegistrableAsClientCA(t *testing.T) {
+	cert, err := GenerateHealthCheckClientCert()
+	require.NoError(t, err)
+
+	parsed, err := x509.ParseCertificate(cert.Certificate[0])
+	require.NoError(t, err)
+
+	pool := x509.NewCertPool()
+	assert.NotPanics(t, func() { pool.AddCert(parsed) })
+}
+
+func TestAddClientTLSFlagsToCmdWithPrefix_NoCACert_StrictValidationIsFalse(t *testing.T) {
+	cmd := &cobra.Command{}
+	src := AddClientTLSFlagsToCmdWithPrefix(cmd, "")
+
+	cfg, err := src()
+	require.NoError(t, err)
+	assert.False(t, cfg.StrictValidation)
+	assert.Nil(t, cfg.Certificates)
+}
+
+func TestAddClientTLSFlagsToCmdWithPrefix_CACertSetsStrictValidation(t *testing.T) {
+	cmd := &cobra.Command{}
+	src := AddClientTLSFlagsToCmdWithPrefix(cmd, "")
+
+	require.NoError(t, cmd.Flags().Set("repo-server-ca-cert-path", "testdata/single.pem"))
+
+	cfg, err := src()
+	require.NoError(t, err)
+
+	assert.True(t, cfg.StrictValidation,
+		"providing --repo-server-ca-cert must imply StrictValidation=true")
+	assert.NotNil(t, cfg.Certificates,
+		"CA cert pool must be populated when --repo-server-ca-cert is set")
+}
+
+func TestStrictValidationOverride_ORSemantics(t *testing.T) {
+	cases := []struct {
+		name            string
+		setCACert       bool // simulate --repo-server-ca-cert being provided
+		legacyFlagValue bool // value of --repo-server-strict-tls
+		wantStrict      bool
+		wantPoolNonNil  bool
+	}{
+		{
+			name:            "no CA cert, legacy flag false → insecure",
+			setCACert:       false,
+			legacyFlagValue: false,
+			wantStrict:      false,
+			wantPoolNonNil:  false,
+		},
+		{
+			name:            "no CA cert, legacy flag true → strict via legacy path",
+			setCACert:       false,
+			legacyFlagValue: true,
+			wantStrict:      true,
+			wantPoolNonNil:  false, // pool populated by component's legacy block, not here
+		},
+		{
+			name:            "CA cert set, legacy flag false → strict because CA cert implies it",
+			setCACert:       true,
+			legacyFlagValue: false,
+			wantStrict:      true, // THE BUG: was false before the fix
+			wantPoolNonNil:  true,
+		},
+		{
+			name:            "CA cert set, legacy flag true → strict (both agree)",
+			setCACert:       true,
+			legacyFlagValue: true,
+			wantStrict:      true,
+			wantPoolNonNil:  true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			cmd := &cobra.Command{}
+			src := AddClientTLSFlagsToCmdWithPrefix(cmd, "")
+
+			if tc.setCACert {
+				require.NoError(t, cmd.Flags().Set("repo-server-ca-cert-path", "testdata/single.pem"))
+			}
+
+			// Step 1: get config from the new flag helper (Layer 1).
+			cfg, err := src()
+			require.NoError(t, err)
+
+			// Step 2: simulate the component's RunE override using OR semantics (the fix).
+			cfg.StrictValidation = cfg.StrictValidation || tc.legacyFlagValue
+
+			assert.Equal(t, tc.wantStrict, cfg.StrictValidation,
+				"StrictValidation after OR-based override")
+			if tc.wantPoolNonNil {
+				assert.NotNil(t, cfg.Certificates,
+					"Certificates pool must be populated when CA cert was provided")
+			}
+		})
+	}
+}
+
+func TestStrictValidationOverride_OldAssignmentSemantics_DocumentsBug(t *testing.T) {
+	cmd := &cobra.Command{}
+	src := AddClientTLSFlagsToCmdWithPrefix(cmd, "")
+	require.NoError(t, cmd.Flags().Set("repo-server-ca-cert-path", "testdata/single.pem"))
+
+	cfg, err := src()
+	require.NoError(t, err)
+
+	require.True(t, cfg.StrictValidation, "pre-condition: CA cert must set StrictValidation=true")
+
+	legacyFlag := false
+	cfg.StrictValidation = legacyFlag // old code: = not ||
+
+	assert.False(t, cfg.StrictValidation,
+		"BUG REPRODUCED: old = semantics silently discard StrictValidation=true set by CA cert flag")
+	assert.NotNil(t, cfg.Certificates,
+		"pool is non-nil but StrictValidation=false → buildTLSClientConfig's fallback saves us,"+
+			" but the struct state is incoherent")
+}
+
+func TestClientCertFlags_BothRequiredOrNeither(t *testing.T) {
+	t.Run("cert explicitly cleared while key retains default returns error", func(t *testing.T) {
+		cmd := &cobra.Command{}
+		src := AddClientTLSFlagsToCmdWithPrefix(cmd, "")
+		// Clear cert so that key (default) is set but cert is empty
+		require.NoError(t, cmd.Flags().Set("repo-server-client-cert-path", ""))
+
+		_, err := src()
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "--repo-server-client-cert-path is required")
+	})
+
+	t.Run("key explicitly cleared while cert retains default returns error", func(t *testing.T) {
+		cmd := &cobra.Command{}
+		src := AddClientTLSFlagsToCmdWithPrefix(cmd, "")
+		// Clear key so that cert (default) is set but key is empty
+		require.NoError(t, cmd.Flags().Set("repo-server-client-cert-key-path", ""))
+
+		_, err := src()
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "--repo-server-client-cert-key-path is required")
+	})
+
+	t.Run("default cert and key paths point to auto-mounted Secret", func(t *testing.T) {
+		cmd := &cobra.Command{}
+		src := AddClientTLSFlagsToCmdWithPrefix(cmd, "")
+
+		cfg, err := src()
+		require.NoError(t, err)
+		assert.Equal(t, "/app/config/reposerver/mtls/client.crt", cfg.ClientCertFile)
+		assert.Equal(t, "/app/config/reposerver/mtls/client.key", cfg.ClientCertKeyFile)
+	})
+}