Should repository secrets be automatically synced from autonomous agent cluster to control plane cluster?

[Maximchpdev]

Hi!,
In autonomous mode, when we create a repository secret on the agent/workload cluster, it doesn't automatically sync to the principal/control plane cluster..
Without the secret on principal, apps don't sync and we cannot access resources in the Argo CD UI, thats why we manually created the repository secret in the control plane cluster too.

Is this expected behavior, or should repository secrets sync automatically?

https://argocd-agent.readthedocs.io/latest/user-guide/appprojects/#repository-skip-sync-support

[jannfis]

I think the initial idea was, that for autonomous agents the repository secrets stay with the cluster and are not propagated back to the control plane, because the assumption is (or was) that the control plane does not need that secret.

If the argocd-server on the control plane does indeed require the repository secret, I think we will need a proxy (similar to resource proxy, redis proxy) to access the argocd-repository-server on autonomous agents instead of syncing the credentials from the agent to the control plane.