Do repo-creds support depth attribute

[camaeel]

I have shared repo-creds for all my repositories defined in secrets. I added depth="1" to those secrets but it seems that repo-server is not using this parameter at all.
Does it work only if I configure a "repository" secret for each of my repositories? This is probably almost impossible with mutitenant setup and hundreds of repositories.

[adilburaksen]

The depth parameter is a per-repository attribute, not supported in repo-creds credential templates. Credential templates (repo-creds) are designed to carry authentication material only — SSH keys, TLS certs, username/password — so that you can share auth config across many repos without duplicating secrets.

The depth setting (for shallow clones) is only respected on individual repository secrets, not on templates. This is a real limitation for multi-tenant setups with hundreds of repos.

Workarounds:

1. Use a Kubernetes mutating webhook to inject depth into repository secrets when they're created — this keeps your per-repo secrets lightweight while still applying shallow clone behavior consistently.

2. Adjust at the app level: The --git-shallow-clones flag on argocd-repo-server sets a global shallow clone depth for all repositories, independent of secret configuration:

   # argocd-repo-server deployment
   args:
     - --git-shallow-clones

   This is a binary on/off (depth=1 for new clones), not configurable per-repo, but might be sufficient if you just want to avoid full history fetches everywhere.

3. File a feature request: ArgoCD doesn't currently support inheriting depth from credential templates. If this is a blocker, it's worth opening an issue to track it as a feature request.

The --git-shallow-clones flag is probably the most practical fix for a multi-tenant setup since it applies globally without per-repo configuration.

[camaeel]

Ad 1. I don't want to have for every repo a seaprate secret with credentials. I don't need then a muatting webhook.
Ad 2. there is no such flag. Where did you found any trace of documentation for it?
Ad 3. This is the question to miantainers.

[adilburaksen]

Fair points.

Ad 1 — agreed, that was a non-answer. The whole point of repo-creds is to avoid per-repo config, so saying "use per-repo secrets" does not solve anything.

Ad 2 — I was looking at the Repository CRD spec where depth appears as a field on the Repository object, not RepoCreds. So you are right that it is not exposed on credential templates — I conflated the two. My mistake.

Ad 3 — this is a real limitation that needs maintainer input. If there is no open issue for it, worth filing one — shallow clone support on credential templates would genuinely help large multi-tenant setups.