Skip to main content

Private Connectivity (AWS PrivateLink)

Availability: Enterprise plan feature, currently available for AWS only. Contact your account team to enable it for your organization. Not available on self-hosted installations.

Overview​

By default, your Argo CD and Kargo instances (and the Akuity Agents connected to them) communicate with the Akuity Platform over the public internet, protected by TLS and optional IP allow lists.

With private connectivity, this traffic flows over AWS PrivateLink instead: the Akuity Platform exposes a VPC endpoint service, and your VPCs reach it through interface endpoints. Traffic never leaves the AWS network.

Private connectivity can be enabled independently for:

  • The instance (the Argo CD or Kargo dashboard and API)

  • Each cluster or agent (the Akuity Agent's connection to the control plane)

You can mix both modes — for example, keep the dashboard public while agents in your production VPC connect privately.

How it works​

  1. You connect your AWS account to your Akuity organization. The Akuity Platform allow-lists the account on its VPC endpoint service.

  2. You create an interface endpoint in your VPC pointing at the Akuity endpoint service, with private DNS enabled.

  3. You switch instances, clusters, or agents to Private. They receive private hostnames that resolve to your interface endpoint and are unreachable from the public internet.

Connecting an AWS account​

  1. Navigate to Organization Settings → Private Connectivity.

  2. Click Add and enter your 12-digit AWS Account ID.

  3. Click the info icon next to the account to open its connection details, and note the AWS Service Name for each region — you need it to create the interface endpoint in the next step.

note

An AWS account can be connected to only one Akuity organization. If the account is already connected to another organization (including one where it is still pending removal), adding it will fail.

Creating the interface endpoint​

In each VPC that needs private connectivity (for example, the VPCs of clusters running the Akuity Agent):

  1. Make sure the VPC has both DNS resolution and DNS hostnames enabled — private DNS does not work without them.

  2. In the AWS console, go to VPC → Endpoints → Create endpoint.

  3. For Service category, select Other endpoint services, enter the AWS Service Name from the connection details, and click Verify service.

  4. Select the VPC, then choose one subnet per Availability Zone where your clients (for example, the cluster nodes) run.

  5. Keep the IP address type as IPv4.

  6. Attach a security group that allows inbound TCP 443 from your clients (for example, the VPC or cluster CIDR). Clients connect to the endpoint's network interfaces, so an outbound-only rule is not enough.

  7. Under Additional settings, enable DNS name (private DNS). This makes the Akuity private hostnames resolve to your interface endpoint inside the VPC.

Connections are accepted automatically. Once the endpoint is available, its state appears in the connection details in the dashboard.

For a detailed walkthrough of each option, see the AWS documentation on creating an interface endpoint.

note

Create the endpoint in a region the Akuity endpoint service supports (shown in the connection details). Clients in other regions can still use it over VPC peering or Transit Gateway, or you can create a cross-region interface endpoint if your region is listed as supported.

Enabling private connectivity​

Argo CD or Kargo instance​

  1. Navigate to Settings → External Access on the instance.

  2. Under Private Connectivity, select Private.

  3. Click Save.

The instance's hostname changes to a private hostname (shown in the dashboard), which only resolves and routes inside VPCs with an interface endpoint. Switching back to Public restores the public hostname.

note

A private instance cannot use a custom domain (FQDN) — the two settings are mutually exclusive. Remove the custom domain before switching to private.

Clusters and agents​

Each Argo CD cluster and Kargo agent has its own Private Connectivity setting, available when connecting it or editing it later. Agents switched to Private reach the control plane through your interface endpoint instead of the public internet.

To change the default for newly connected agents, use Private Connectivity under the instance's agent default settings. To change many existing agents at once, use the batch update in the agent customization settings.

note

Integration (direct) clusters are agentless and always use public connectivity. Akuity-managed Kargo agents are also always public.

Disconnecting an AWS account​

Disconnect an account from Organization Settings → Private Connectivity using the delete action next to it.

Disconnecting the last account is blocked while any instance, cluster, or agent in the organization still uses private connectivity — the error message lists the affected instances. Switch them to Public first, then disconnect the account.

caution

After the account is removed from the allow list, existing interface endpoints in that account stop working. Delete them on the AWS side to avoid confusion and costs.