unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

argocd: drop internal-CA rootCA pin from Authentik oidc.config #439

Merged
benvin merged 1 commits from benvin/argocd-oidc-le-trust into main 2026-08-29 21:52:12 +10:00
Conversation 0 Commits 1 Files Changed 1
+2 -27
unkin-agent commented 2026-08-29 21:27:28 +10:00
Member
Copy Link
Copy Source

Why

identity.unkin.net moved from an internal unkin.net CA-issued cert to the LetsEncrypt *.unkin.net wildcard. The oidc.config block pinned the internal root as the only trust anchor, so argocd-server now rejects OIDC discovery with x509: certificate signed by unknown authority and SSO login is broken. The stock image trust store already carries the public roots.

Changes

  • Remove the rootCA: block from argocd-cm's oidc.config for the https://identity.unkin.net/application/o/argocd/ issuer.
  • Replace the now-false internal-CA rationale comment with a one-liner noting the LE-issued cert needs no pin.
  • Leave issuer, clientID, clientSecret ref, requestedScopes (incl. ak_groups) and requestedIDTokenClaims untouched.
## Why `identity.unkin.net` moved from an internal `unkin.net` CA-issued cert to the LetsEncrypt `*.unkin.net` wildcard. The `oidc.config` block pinned the internal root as the *only* trust anchor, so argocd-server now rejects OIDC discovery with `x509: certificate signed by unknown authority` and SSO login is broken. The stock image trust store already carries the public roots. ## Changes - Remove the `rootCA:` block from `argocd-cm`'s `oidc.config` for the `https://identity.unkin.net/application/o/argocd/` issuer. - Replace the now-false internal-CA rationale comment with a one-liner noting the LE-issued cert needs no pin. - Leave issuer, clientID, clientSecret ref, `requestedScopes` (incl. `ak_groups`) and `requestedIDTokenClaims` untouched.
unkin-agent added 1 commit 2026-08-29 21:27:29 +10:00
argocd: drop internal-CA rootCA pin from Authentik oidc.config
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
8e508c231e 
identity.unkin.net moved from the internal unkin.net CA to the LetsEncrypt
*.unkin.net wildcard, so pinning the internal root made argocd-server reject
the OIDC discovery handshake (x509: certificate signed by unknown authority).
The stock image trust store already carries the public roots.
benvin merged commit aedb721b3e into main 2026-08-29 21:52:12 +10:00
benvin deleted branch benvin/argocd-oidc-le-trust 2026-08-29 21:52:13 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#439
Delete Branch "benvin/argocd-oidc-le-trust"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?