unkin-agent
aedb721b3e
## Why `identity.unkin.net` moved from an internal `unkin.net` CA-issued cert to the LetsEncrypt `*.unkin.net` wildcard. The `oidc.config` block pinned the internal root as the *only* trust anchor, so argocd-server now rejects OIDC discovery with `x509: certificate signed by unknown authority` and SSO login is broken. The stock image trust store already carries the public roots. ## Changes - Remove the `rootCA:` block from `argocd-cm`'s `oidc.config` for the `https://identity.unkin.net/application/o/argocd/` issuer. - Replace the now-false internal-CA rationale comment with a one-liner noting the LE-issued cert needs no pin. - Leave issuer, clientID, clientSecret ref, `requestedScopes` (incl. `ak_groups`) and `requestedIDTokenClaims` untouched. Reviewed-on: #439 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
41 lines
1.6 KiB
YAML
41 lines
1.6 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: argocd-cm
|
|
namespace: argocd
|
|
data:
|
|
kustomize.buildOptions: "--enable-helm"
|
|
# Kubernetes defaults apiVersion/kind onto every StatefulSet
|
|
# volumeClaimTemplates entry, but neither the raw manifests nor the helm
|
|
# charts emit them, so live StatefulSets carry TypeMeta that git lacks.
|
|
# volumeClaimTemplates are immutable on an existing StatefulSet, so ArgoCD
|
|
# can never reconcile the removal and the resource stays perpetually
|
|
# OutOfSync. Ignore the defaulted TypeMeta fleet-wide.
|
|
resource.customizations.ignoreDifferences.apps_StatefulSet: |
|
|
jqPathExpressions:
|
|
- '.spec.volumeClaimTemplates[]?.apiVersion'
|
|
- '.spec.volumeClaimTemplates[]?.kind'
|
|
# External URL ArgoCD serves on (TLS terminated at the traefik-internal gateway).
|
|
url: https://argocd.k8s.syd1.au.unkin.net
|
|
# OIDC login via Authentik. The client secret is seeded in Vault out of band
|
|
# and surfaced as the `argocd-oidc` Secret (labelled part-of=argocd) by VSO;
|
|
# `$argocd-oidc:client_secret` resolves the key from that Secret.
|
|
oidc.config: |
|
|
name: Authentik
|
|
issuer: https://identity.unkin.net/application/o/argocd/
|
|
clientID: argocd
|
|
clientSecret: $argocd-oidc:client_secret
|
|
# identity.unkin.net now serves the LetsEncrypt *.unkin.net wildcard, so the
|
|
# stock image trust store validates it; no rootCA pin.
|
|
requestedScopes:
|
|
- openid
|
|
- profile
|
|
- email
|
|
# Hierarchical group claim from terraform-authentik (includes permission
|
|
# groups inherited via role groups). Read for RBAC below.
|
|
- ak_groups
|
|
requestedIDTokenClaims:
|
|
ak_groups:
|
|
essential: true
|