Configure private endpoint access for Argo CD

By default, you can access the Argo CD endpoint over the public internet. You can configure private endpoint access so that traffic between your VPC and the Argo CD endpoint stays within the AWS network, without going through the public internet.

When you enable private access, AWS updates the Domain Name System (DNS) so that the Argo CD endpoint hostname resolves to private IP addresses associated with your VPC endpoint. You must have network connectivity to these private IPs (through your VPC, a virtual private network (VPN) connection, or AWS Direct Connect) to access the Argo CD endpoint.

How private access works

When you configure private access for your Argo CD capability:

1. You create a VPC endpoint for the com.amazonaws.region-code.eks-capabilities service in your VPC.

2. You provide the VPC endpoint ID when creating or updating the Argo CD capability.

3. AWS configures DNS records so that the Argo CD endpoint hostname resolves to private IP addresses associated with your VPC endpoint.

4. All traffic to the Argo CD endpoint flows privately through the VPC endpoint.

Prerequisites

• An Amazon Elastic Kubernetes Service (Amazon EKS) cluster with an active Argo CD capability (see Create an Argo CD capability)

• Familiarity with Amazon VPC concepts, including subnets, security groups, and interface VPC endpoints

• A VPC with subnets in the Availability Zones where you want private access

• AWS Command Line Interface (AWS CLI) version 2.12.3 or later

Step 1: Create a VPC endpoint for eks-capabilities

Create an interface VPC endpoint for the com.amazonaws.region-code.eks-capabilities service.

Console

1. Open the Amazon VPC console.

2. In the left navigation pane, choose Endpoints.

3. Choose Create endpoint.

4. For Service category, choose AWS services.

5. In the search field, enter eks-capabilities and select com.amazonaws.region-code.eks-capabilities.

6. For VPC, select the VPC from which you want to access the Argo CD endpoint.

7. For Subnets, select a subnet in each Availability Zone where you want private access.

8. For Security groups, select a security group that allows HTTPS (port 443) inbound traffic from your client networks.

9. Choose Create endpoint.

10. Note the VPC endpoint ID (for example, vpce-0123456789abcdef0).

CLI

Replace region-code with your AWS Region, vpc-id with your VPC ID, subnet-id-1 subnet-id-2 with subnet IDs in different Availability Zones, and sg-id with a security group that allows HTTPS inbound traffic.

aws ec2 create-vpc-endpoint \
  --region region-code \
  --vpc-endpoint-type Interface \
  --service-name com.amazonaws.region-code.eks-capabilities \
  --vpc-id vpc-id \
  --subnet-ids subnet-id-1 subnet-id-2 \
  --security-group-ids sg-id
               

Note the VpcEndpointId in the response.

Important

Make sure the security group attached to the VPC endpoint allows inbound HTTPS (port 443) traffic. The traffic source must include all networks where your users or applications access the Argo CD endpoint.

Step 2: Configure private access on the Argo CD capability

After the VPC endpoint is available, configure the Argo CD capability to use it. You can configure private access when creating a new capability or by updating an existing one.

Create a new capability with private access

Include the networkAccess in the create-capability command. Replace region-code, my-cluster, and other placeholders with your values:

aws eks create-capability \
  --region region-code \
  --cluster-name my-cluster \
  --capability-name my-argocd \
  --type ARGOCD \
  --role-arn arn:aws:iam::111122223333:role/ArgoCDCapabilityRole \
  --configuration '{
    "argoCd": {
      "awsIdc": {
        "idcInstanceArn": "arn:aws:sso:::instance/ssoins-1234567890abcdef",
        "idcRegion": "idc-region-code"
      },
      "rbacRoleMappings": [{
        "role": "ADMIN",
        "identities": [{
          "id": "user-id",
          "type": "SSO_USER"
        }]
      }],
      "networkAccess": {
        "vpceIds": ["vpce-0123456789abcdef0"]
      }
    }
  }'

Update an existing capability to enable private access

Replace region-code, my-cluster, my-argocd, and the VPC endpoint ID with your values:

aws eks update-capability \
  --region region-code \
  --cluster-name my-cluster \
  --capability-name my-argocd \
  --configuration '{
    "argoCd": {
      "networkAccess": {
        "vpceIds": ["vpce-0123456789abcdef0"]
      }
    }
  }'

Wait for the capability update to complete:

aws eks describe-capability \
  --region region-code \
  --cluster-name my-cluster \
  --capability-name my-argocd \
  --query 'capability.status' \
  --output text

The status returns to ACTIVE when the update is complete.

Step 3: Verify DNS resolution and connectivity

After the capability becomes active with private access configured, verify that the Argo CD endpoint hostname resolves to private IP addresses.

Run the following nslookup command from any network:

nslookup your-argocd-endpoint.eks-capabilities.region-code.amazonaws.com
      

The response should show private IP addresses (for example, addresses in RFC 1918 ranges such as 10.x.x.x or 172.16.x.x).

If the endpoint does not resolve to private IPs, verify that:

• The capability status is ACTIVE (AWS creates DNS records after the capability becomes active)

• The VPC endpoint is in the available state

• The VPC endpoint ID in the capability configuration matches the endpoint you created

Note

After you configure private access, the Argo CD endpoint hostname resolves to private IP addresses. To connect, you must have network connectivity to those private IPs through your VPC, a VPN connection, or AWS Direct Connect.

Disable private access

To disable private access and restore public endpoint access, update the capability to remove the VPC endpoint IDs:

aws eks update-capability \
  --region region-code \
  --cluster-name my-cluster \
  --capability-name my-argocd \
  --configuration '{
    "argoCd": {
      "networkAccess": {
        "vpceIds": []
      }
    }
  }'

Considerations

• After you enable private access, the Argo CD endpoint is only reachable from within your VPC or networks connected to it (for example, through VPN or AWS Direct Connect).

• The VPC endpoint must remain in the available state for private access to function. If you delete the VPC endpoint, you lose access to the Argo CD endpoint until you create a new endpoint and update the capability.

• AWS doesn’t currently support VPC endpoint policies for the eks-capabilities service endpoint.