ArgoCD API Server TLS Certificate Secret Configuration

Custom TLS Secret Integration

ArgoCD allows the API server to use certificates provided via Kubernetes secrets to secure the web UI and API endpoints. When moving from self-signed certificates to a trusted internal CA, the argocd-server deployment must be configured to reference the correct secret containing the certificate and private key.

There is uncertainty regarding the specific behavior of the server when multiple certificates are present in the mounted volume or when the secret is updated dynamically without a pod restart. Specifically, it is unclear if the server automatically reloads the certificate from the mounted secret or if a manual rollout is required to apply the new chain.

• Does the argocd-server support hot-reloading of TLS certificates from a Kubernetes secret?
• What is the expected behavior if the secret contains a full chain versus only the leaf certificate?