unkinben
ce76e0fdb9
## Why ArgoCD SSO fails: `failed to query provider ".../application/o/argocd/": tls: failed to verify certificate: x509: certificate signed by unknown authority`. argocd-server performs OIDC discovery to identity.unkin.net over TLS served by the internal `unkin.net` CA. Unlike argocd-repo-server (which mounts vault-ca-cert), argocd-server has no internal CA in its trust store and no rootCA in oidc.config, so it has never trusted the issuer — this is the first working DNS/cert for identity.unkin.net, so OIDC egress was failing from the start. ## Change - argocd-cm `oidc.config`: add `rootCA` (inline PEM) = the internal `unkin.net` root. argocd-server hot-reloads argocd-cm, so no rollout is needed. Anchoring on the long-lived root (not the intermediate) is deliberate: the `unkin.net Intermediate Authority` was recently re-keyed (identity presents the current intermediate in its handshake; the cluster `vault-ca-cert` bundle still carries the stale one and does NOT validate the served cert). The root is stable (valid to 2034) and matches the host trust anchor. Verified with `openssl verify -CAfile <root> -untrusted <served-intermediate> <served-leaf>`. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
argocd-apps docs
Operational notes for the manifests in this repo.
| Doc | What it covers |
|---|---|
| cnpg-backups.md | How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured. |
| cnpg-restore.md | Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas. |