unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Trust internal unkin.net CA for ArgoCD OIDC egress #303

Merged
benvin merged 1 commits from benvin/argocd-oidc-ca into main 2026-07-28 22:17:33 +10:00
Conversation 0 Commits 1 Files Changed 1
+27
unkinben commented 2026-07-28 22:13:26 +10:00
Owner
Copy Link
Copy Source

Why

ArgoCD SSO fails with failed to query provider "https://identity.unkin.net/application/o/argocd/": tls: failed to verify certificate: x509: certificate signed by unknown authority. argocd-server does OIDC discovery to identity.unkin.net over TLS served by the internal unkin.net CA. Unlike argocd-repo-server (which mounts vault-ca-cert), argocd-server has no internal CA in its trust store and no rootCA in oidc.config, so it never trusted the issuer.

Change

  • argocd-cm oidc.config: add rootCA (inline PEM) = the internal unkin.net root CA. argocd-server hot-reloads argocd-cm, so no rollout restart is required.

Why the root, not the cluster vault-ca-cert bundle

The unkin.net Intermediate Authority was recently re-keyed (same serial, new key: bundle SHA1 C4:48:78… vs served F1:DD:34…). The cluster vault-ca-cert bundle still carries the stale intermediate and fails openssl verify against the currently-served identity cert. identity.unkin.net presents its current intermediate in the handshake, so anchoring on the long-lived, stable unkin.net root (valid to 2034, matches the host trust anchor) is both correct and rotation-proof. Verified: openssl verify -CAfile <root> -untrusted <served-intermediate> <served-leaf> = OK; the embedded PEM round-trips through the YAML patch and validates the served leaf.

Verify after merge

argocd-server picks up argocd-cm live; retest SSO login. (Separately, the cluster vault-ca-cert reflected secret carries a stale intermediate and should be refreshed, but that is out of scope here.)

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

## Why ArgoCD SSO fails with `failed to query provider "https://identity.unkin.net/application/o/argocd/": tls: failed to verify certificate: x509: certificate signed by unknown authority`. argocd-server does OIDC discovery to identity.unkin.net over TLS served by the internal `unkin.net` CA. Unlike argocd-repo-server (which mounts `vault-ca-cert`), argocd-server has no internal CA in its trust store and no `rootCA` in `oidc.config`, so it never trusted the issuer. ## Change - argocd-cm `oidc.config`: add `rootCA` (inline PEM) = the internal `unkin.net` root CA. argocd-server hot-reloads argocd-cm, so no rollout restart is required. ## Why the root, not the cluster vault-ca-cert bundle The `unkin.net Intermediate Authority` was recently **re-keyed** (same serial, new key: bundle SHA1 `C4:48:78…` vs served `F1:DD:34…`). The cluster `vault-ca-cert` bundle still carries the **stale** intermediate and fails `openssl verify` against the currently-served identity cert. identity.unkin.net presents its current intermediate in the handshake, so anchoring on the long-lived, stable `unkin.net` root (valid to 2034, matches the host trust anchor) is both correct and rotation-proof. Verified: `openssl verify -CAfile <root> -untrusted <served-intermediate> <served-leaf>` = OK; the embedded PEM round-trips through the YAML patch and validates the served leaf. ## Verify after merge argocd-server picks up argocd-cm live; retest SSO login. (Separately, the cluster `vault-ca-cert` reflected secret carries a stale intermediate and should be refreshed, but that is out of scope here.) https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
unkinben added 1 commit 2026-07-28 22:13:26 +10:00
Trust internal unkin.net CA for ArgoCD OIDC egress
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
ce76e0fdb9 
## Why

ArgoCD SSO fails: `failed to query provider
".../application/o/argocd/": tls: failed to verify certificate: x509:
certificate signed by unknown authority`. argocd-server performs OIDC
discovery to identity.unkin.net over TLS served by the internal `unkin.net`
CA. Unlike argocd-repo-server (which mounts vault-ca-cert), argocd-server has
no internal CA in its trust store and no rootCA in oidc.config, so it has
never trusted the issuer — this is the first working DNS/cert for
identity.unkin.net, so OIDC egress was failing from the start.

## Change

- argocd-cm `oidc.config`: add `rootCA` (inline PEM) = the internal `unkin.net`
  root. argocd-server hot-reloads argocd-cm, so no rollout is needed.

Anchoring on the long-lived root (not the intermediate) is deliberate: the
`unkin.net Intermediate Authority` was recently re-keyed (identity presents the
current intermediate in its handshake; the cluster `vault-ca-cert` bundle still
carries the stale one and does NOT validate the served cert). The root is
stable (valid to 2034) and matches the host trust anchor. Verified with
`openssl verify -CAfile <root> -untrusted <served-intermediate> <served-leaf>`.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
benvin merged commit 7c1cbef722 into main 2026-07-28 22:17:33 +10:00
benvin deleted branch benvin/argocd-oidc-ca 2026-07-28 22:17:33 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#303
Delete Branch "benvin/argocd-oidc-ca"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?