From ce76e0fdb965634ce83bf259c940c149bd12a56d Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Tue, 28 Jul 2026 22:12:50 +1000
Subject: [PATCH] Trust internal unkin.net CA for ArgoCD OIDC egress
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Why

ArgoCD SSO fails: `failed to query provider
".../application/o/argocd/": tls: failed to verify certificate: x509:
certificate signed by unknown authority`. argocd-server performs OIDC
discovery to identity.unkin.net over TLS served by the internal `unkin.net`
CA. Unlike argocd-repo-server (which mounts vault-ca-cert), argocd-server has
no internal CA in its trust store and no rootCA in oidc.config, so it has
never trusted the issuer — this is the first working DNS/cert for
identity.unkin.net, so OIDC egress was failing from the start.

## Change

- argocd-cm `oidc.config`: add `rootCA` (inline PEM) = the internal `unkin.net`
  root. argocd-server hot-reloads argocd-cm, so no rollout is needed.

Anchoring on the long-lived root (not the intermediate) is deliberate: the
`unkin.net Intermediate Authority` was recently re-keyed (identity presents the
current intermediate in its handshake; the cluster `vault-ca-cert` bundle still
carries the stale one and does NOT validate the served cert). The root is
stable (valid to 2034) and matches the host trust anchor. Verified with
`openssl verify -CAfile <root> -untrusted <served-intermediate> <served-leaf>`.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
---
 .../au-syd1/bootstrap/argocd-cm-patch.yaml    | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml b/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml
index 57247fc..e13e14b 100644
--- a/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml
+++ b/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml
@@ -16,6 +16,33 @@ data:
     issuer: https://identity.unkin.net/application/o/argocd/
     clientID: argocd
     clientSecret: $argocd-oidc:client_secret
+    # argocd-server does OIDC discovery/egress to identity.unkin.net over TLS,
+    # which is served by the internal `unkin.net` CA (not a public root), so the
+    # stock image trust store rejects it (x509: certificate signed by unknown
+    # authority). Anchor on the stable `unkin.net` root; identity presents its
+    # intermediate in the handshake, and the intermediate is periodically
+    # re-keyed, so pinning the root (not the intermediate) is rotation-proof.
+    rootCA: |
+      -----BEGIN CERTIFICATE-----
+      MIIDLzCCAhegAwIBAgIUIDADwsHIrQ8dfncpechBdIUCQdIwDQYJKoZIhvcNAQEL
+      BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMjcwMloXDTM0MDQy
+      NTExMjczMlowFDESMBAGA1UEAxMJdW5raW4ubmV0MIIBIjANBgkqhkiG9w0BAQEF
+      AAOCAQ8AMIIBCgKCAQEA3ENPv7R7gCUJAg8Q4hB2LEZSdvbK155YbcrguLDDnu6m
+      2fkJn8jYMMW3Z6/+Y04ouGwi6sKup8ggTb217sY+dC4IUZjotDPAhruxfXVQAh0v
+      Yr3RYoxVDrm4nRSFLo1RA4Qt+1KK299mHGQf9iAiwbsFp5mDrJT9uz15FE2uWmbK
+      8/onMyJC4fnkMihVN6NIgTtjpHYNm5aAJwxoWldTopgF0ucb7X3XVPNbKAmd3Avd
+      lsOo6m751zSZ0HvJOxgRSy7lvPzMuUfCQsOcmI4O4+Z2FL4Y7p+T9DvWkciC7L3i
+      tBiK30fPfGKNpWaof1ONCcPQNjMwWcEFXqSiWUOXkwIDAQABo3kwdzAOBgNVHQ8B
+      Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGpy/pj6F8e3gSOAp
+      r+6hAYQdOScwHwYDVR0jBBgwFoAUGpy/pj6F8e3gSOApr+6hAYQdOScwFAYDVR0R
+      BA0wC4IJdW5raW4ubmV0MA0GCSqGSIb3DQEBCwUAA4IBAQA5xocILzuvD+R2Iub1
+      UnTdcVpgNcxJmESz0eX4UrkcBmddtuFINXvDTv5//XTFs78LsVVSf00xZ+2C62Xe
+      xRdCdluHN8VDCAKulP4XJY1BiZ7im0v+iMgPDKhq4OXb86WFYI/8J6uRm7oIAwj1
+      zhhKxMimkzli+yHB8ipL15W7l68CMUgmOjFA+EG6sbfadFpQTX/h6TVj3FQPkU/p
+      UJEm2XjlGNAKGJrNRU47PM4vRDv5Joyowp9zv/pHFXvUJladaJupMKRJQVWQz1US
+      EXE67rawG79s3vm8dDolnbli/IhPHtjDRIprxAwrMs5tt9cY0xsRkFBZVcAOjrpb
+      4gqd
+      -----END CERTIFICATE-----
     requestedScopes:
       - openid
       - profile