unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Enable PKCE for ArgoCD OIDC login
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details

Browse Source 
The Authentik client is now public (iOS app needs it), so Authentik
no longer enforces client_secret. PKCE replaces that as the
protection against authorization-code interception.
This commit is contained in:
Unkin Agent
2026-09-19 15:45:01 +10:00
parent 4762cf9e03
commit ee201a5c71
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
clusters/au-syd1/bootstrap/argocd-cm-patch.yaml
+4
View File
@@ -26,6 +26,10 @@ data:
issuer: https://identity.unkin.net/application/o/argocd/ issuer: https://identity.unkin.net/application/o/argocd/
clientID: argocd clientID: argocd
clientSecret: $argocd-oidc:client_secret clientSecret: $argocd-oidc:client_secret
# The Authentik client is public (the iOS app can't hold a secret), so
# Authentik no longer enforces clientSecret; PKCE replaces it as the
# protection against authorization-code interception.
enablePKCEAuthentication: true
# identity.unkin.net now serves the LetsEncrypt *.unkin.net wildcard, so the # identity.unkin.net now serves the LetsEncrypt *.unkin.net wildcard, so the
# stock image trust store validates it; no rootCA pin. # stock image trust store validates it; no rootCA pin.
requestedScopes: requestedScopes: