From f5a09822221fead8f146996775ed7f5425a87c26 Mon Sep 17 00:00:00 2001 From: CTO Agent Date: Sun, 23 Aug 2026 10:37:01 +0000 Subject: [PATCH] fix(argocd): label argocd-oidc-secret so Argo CD reads its keys (DEV-523) Argo CD only substitutes $secret:key references from Secrets carrying the label app.kubernetes.io/part-of: argocd. Without it, the server logs "secret key does not exist in secret" and renders placeholders verbatim into the OIDC redirect URL. Adding the label to the SealedSecret template ensures sealed-secrets- controller re-produces the Secret with the label on every restore, so OIDC keeps working after DR / re-seal. Co-Authored-By: Paperclip --- apps/argocd/argocd-oidc-secret-sealed.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/argocd/argocd-oidc-secret-sealed.yaml b/apps/argocd/argocd-oidc-secret-sealed.yaml index e46b875..ff54955 100644 --- a/apps/argocd/argocd-oidc-secret-sealed.yaml +++ b/apps/argocd/argocd-oidc-secret-sealed.yaml @@ -16,4 +16,6 @@ spec: creationTimestamp: null name: argocd-oidc-secret namespace: argocd + labels: + app.kubernetes.io/part-of: argocd type: Opaque