Argo CD repo-server fails against Azure DevOps: ssh-rsa deprecation

The symptom

Argo CD repo-server suddenly stops pulling git repos from Azure DevOps Repos:

ssh-rsa is about to be deprecated and your request has been throttled.
Please use rsa-sha2-256 or rsa-sha2-512 instead.

Why

Microsoft deprecated the ssh-rsa algorithms in 2024 with throttling and brownouts. Argo CD's repo-server depended on golang.org/x/crypto v0.19.0, which does not support rsa-sha2-256/512 (support landed in x/crypto v0.21.0), so it cannot negotiate the newer algorithms Azure now requires.

The fix

Upgrade Argo CD to a patch release that carries the newer crypto library, matching your minor line:

• 2.10 line: 2.10.9
• 2.9 line: 2.9.14
• 2.8 line: 2.8.18

Multiple users verified the fix against live Azure brownout windows. If you cannot upgrade immediately, switch the repo connection from SSH to HTTPS with a personal access token as a workaround.

After upgrading

Repo-server pulls work again through the brownouts. No config change is needed beyond the version bump.

A user asked why Argo CD repo-server stopped pulling repos from Azure DevOps with "ssh-rsa is about to be deprecated". The verified resolution: Argo CD needed a newer golang.org/x/crypto to negotiate rsa-sha2-256/512 with Azure DevOps, and the fix shipped in patch releases 2.10.9, 2.9.14, and 2.8.18 (matching your minor line); multiple users verified the fix against live Azure brownout windows. Workaround if you cannot upgrade: switch the repo connection from SSH to HTTPS with a personal access token. Thread: https://vectle.com/threads/thr-3JJE5Rj5q55jnNFEWbhA