From 8e508c231e8fdcfa03de7a380e53c951cee977fe Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 29 Aug 2026 21:26:39 +1000
Subject: [PATCH] argocd: drop internal-CA rootCA pin from Authentik
 oidc.config

identity.unkin.net moved from the internal unkin.net CA to the LetsEncrypt
*.unkin.net wildcard, so pinning the internal root made argocd-server reject
the OIDC discovery handshake (x509: certificate signed by unknown authority).
The stock image trust store already carries the public roots.
---
 .../au-syd1/bootstrap/argocd-cm-patch.yaml    | 29 ++-----------------
 1 file changed, 2 insertions(+), 27 deletions(-)

diff --git a/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml b/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml
index 8701640..fe2f258 100644
--- a/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml
+++ b/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml
@@ -26,33 +26,8 @@ data:
     issuer: https://identity.unkin.net/application/o/argocd/
     clientID: argocd
     clientSecret: $argocd-oidc:client_secret
-    # argocd-server does OIDC discovery/egress to identity.unkin.net over TLS,
-    # which is served by the internal `unkin.net` CA (not a public root), so the
-    # stock image trust store rejects it (x509: certificate signed by unknown
-    # authority). Anchor on the stable `unkin.net` root; identity presents its
-    # intermediate in the handshake, and the intermediate is periodically
-    # re-keyed, so pinning the root (not the intermediate) is rotation-proof.
-    rootCA: |
-      -----BEGIN CERTIFICATE-----
-      MIIDLzCCAhegAwIBAgIUIDADwsHIrQ8dfncpechBdIUCQdIwDQYJKoZIhvcNAQEL
-      BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMjcwMloXDTM0MDQy
-      NTExMjczMlowFDESMBAGA1UEAxMJdW5raW4ubmV0MIIBIjANBgkqhkiG9w0BAQEF
-      AAOCAQ8AMIIBCgKCAQEA3ENPv7R7gCUJAg8Q4hB2LEZSdvbK155YbcrguLDDnu6m
-      2fkJn8jYMMW3Z6/+Y04ouGwi6sKup8ggTb217sY+dC4IUZjotDPAhruxfXVQAh0v
-      Yr3RYoxVDrm4nRSFLo1RA4Qt+1KK299mHGQf9iAiwbsFp5mDrJT9uz15FE2uWmbK
-      8/onMyJC4fnkMihVN6NIgTtjpHYNm5aAJwxoWldTopgF0ucb7X3XVPNbKAmd3Avd
-      lsOo6m751zSZ0HvJOxgRSy7lvPzMuUfCQsOcmI4O4+Z2FL4Y7p+T9DvWkciC7L3i
-      tBiK30fPfGKNpWaof1ONCcPQNjMwWcEFXqSiWUOXkwIDAQABo3kwdzAOBgNVHQ8B
-      Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGpy/pj6F8e3gSOAp
-      r+6hAYQdOScwHwYDVR0jBBgwFoAUGpy/pj6F8e3gSOApr+6hAYQdOScwFAYDVR0R
-      BA0wC4IJdW5raW4ubmV0MA0GCSqGSIb3DQEBCwUAA4IBAQA5xocILzuvD+R2Iub1
-      UnTdcVpgNcxJmESz0eX4UrkcBmddtuFINXvDTv5//XTFs78LsVVSf00xZ+2C62Xe
-      xRdCdluHN8VDCAKulP4XJY1BiZ7im0v+iMgPDKhq4OXb86WFYI/8J6uRm7oIAwj1
-      zhhKxMimkzli+yHB8ipL15W7l68CMUgmOjFA+EG6sbfadFpQTX/h6TVj3FQPkU/p
-      UJEm2XjlGNAKGJrNRU47PM4vRDv5Joyowp9zv/pHFXvUJladaJupMKRJQVWQz1US
-      EXE67rawG79s3vm8dDolnbli/IhPHtjDRIprxAwrMs5tt9cY0xsRkFBZVcAOjrpb
-      4gqd
-      -----END CERTIFICATE-----
+    # identity.unkin.net now serves the LetsEncrypt *.unkin.net wildcard, so the
+    # stock image trust store validates it; no rootCA pin.
     requestedScopes:
       - openid
       - profile