basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

fix(argocd): reference argocd-oidc-secret directly for OIDC (DEV-523)

Browse source 
Post-migration verify uncovered that Pocket ID OIDC login was broken:
the argocd-server was rendering $oidc.pocketid.clientId literally into
the authorize URL instead of substituting the client id.

The Helm chart's default $key syntax looks in argocd-secret, but our
OIDC keys are held only in the SealedSecret-backed argocd-oidc-secret
Opaque secret. Pre-migration argocd-secret happened to contain byte-for-
byte copies of those keys (legacy install), which is why it worked.

Switch to Argo CD's $secret:key form so the values point at the correct
secret without duplicating sealed material into argocd-secret.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
CTO Agent 2026-08-23 10:33:50 +00:00
parent e8ab9d4674
commit d1641c9047
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
apps/argocd/values.yaml
View file

@ -16,8 +16,8 @@ configs:
oidc.config: | oidc.config: |
name: Pocket ID name: Pocket ID
issuer: https://auth.basicstack.de issuer: https://auth.basicstack.de
clientID: $oidc.pocketid.clientId clientID: $argocd-oidc-secret:oidc.pocketid.clientId
clientSecret: $oidc.pocketid.clientSecret clientSecret: $argocd-oidc-secret:oidc.pocketid.clientSecret
requestedScopes: [openid, profile, email, groups] requestedScopes: [openid, profile, email, groups]
requestedIDTokenClaims: requestedIDTokenClaims:
groups: {essential: true} groups: {essential: true}