{
  "slug": "argo-cd-redis-credentials-can-be-read-from-mounted-files-b7b36ffe5d63",
  "title": "Argo CD Redis credentials can be read from mounted files",
  "tools": [
    "argocd"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-02-02T08:13:58.000Z",
  "announced_at": "2026-02-02T08:13:58.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When configuring Redis-connected Argo CD components to use mounted file credentials, create a Secret with `auth` and mount it into each component. Set `REDIS_CREDS_DIR_PATH` to the mount directory; file credentials take precedence over credential environment variables.",
    "examples": [
      "apiVersion: v1\nkind: Secret\nmetadata:\n  name: <secret-name>\n  namespace: argocd\ntype: Opaque\nstringData:\n  auth: \"<redis-password>\"\n  auth_username: \"<redis-username>\"\n  sentinel_auth: \"<sentinel-password>\"\n  sentinel_username: \"<sentinel-username>\"",
      "spec:\n  containers:\n  - name: <component-container>\n    env:\n    - name: REDIS_CREDS_DIR_PATH\n      value: \"/var/run/secrets/redis\"\n    volumeMounts:\n    - name: redis-creds\n      mountPath: \"/var/run/secrets/redis\"\n      readOnly: true\n  volumes:\n  - name: redis-creds\n    secret:\n      secretName: <secret-name>"
    ],
    "gotchas": [
      "Version: v3.3.0",
      "REDIS_CREDS_DIR_PATH (required): Environment variable containing the mounted credential directory path; when specified, file credentials take precedence and environment-variable values are ignored.",
      "auth (required): Redis password file.",
      "auth_username: Redis username file.",
      "sentinel_auth: Redis Sentinel password file.",
      "sentinel_username: Redis Sentinel username file.",
      "Prerequisite: Mount the credential Secret into each Redis-connected Argo CD component that needs access. Components named by the docs: application-controller, repo-server, and server.",
      "The FAQ uses `REDIS_CREDS_DIR_PATH`; the PR description also names `REDIS_CREDS_FILE_PATH`.",
      "`auth` is mandatory; the other listed credential files are optional.",
      "When `REDIS_CREDS_DIR_PATH` is specified, file credentials take precedence and environment-variable values are ignored.",
      "The supplied example manifest excerpt does not include a complete component volume mount configuration.",
      "Docs conflict: The release-note PR description names REDIS_CREDS_FILE_PATH, while the v3.3 FAQ specifies REDIS_CREDS_DIR_PATH; use the documented v3.3 name."
    ]
  },
  "why_it_matters": "Configure Argo CD components to read Redis credentials from a mounted Kubernetes Secret.",
  "before": "Configure Redis credentials through environment variables such as `REDIS_PASSWORD`.",
  "sources": [
    "https://github.com/argoproj/argo-cd/releases/tag/v3.3.0",
    "https://github.com/argoproj/argo-cd/pull/24597",
    "https://argo-cd.readthedocs.io/en/release-3.3/faq/"
  ],
  "rank": 0.93027,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1b-20261016",
    "verdict_id": "wave1b-20261016:wave1b-20261016-bf9094f35e522faa-17:gate",
    "evidence_hash": "ef816128e607c5aa9302fae9b909454ea8f407319bcb9e2f7cabb87a48bfb40c"
  },
  "review": {
    "draft_hash": "8ee98de3afd68d7d99162b47d5e2fdc2d9ee87b62a813fa2e590d5dfca8f55a3",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1b-20261016:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.93 >= 0.9; 2 needed) and Jev gave 0.66 (>= 0.6 needed)."
  }
}