basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

fix(argocd): reference argocd-oidc-secret directly for OIDC (DEV-523) #5

Merged
forgejoadmin merged 1 commit from fix/DEV-523-argocd-oidc-secret-ref into main 2026-08-23 10:34:17 +00:00
Conversation 0 Commits 1 Files changed 1 +2 -2
forgejoadmin commented 2026-08-23 10:34:08 +00:00
Owner
Copy link

Post-migration verify for DEV-523 uncovered OIDC login was broken: the argocd-server was rendering $oidc.pocketid.clientId literally into the authorize URL instead of substituting the client id.

The Helm chart's default $key syntax looks in argocd-secret, but our OIDC keys are held only in the SealedSecret-backed argocd-oidc-secret Opaque secret. Pre-migration argocd-secret happened to contain byte-for-byte copies of those keys (legacy install), which is why it worked.

Switch to Argo CD's $secret:key form so the values point at the correct secret without duplicating sealed material into argocd-secret.

Post-migration verify for DEV-523 uncovered OIDC login was broken: the argocd-server was rendering `$oidc.pocketid.clientId` literally into the authorize URL instead of substituting the client id. The Helm chart's default `$key` syntax looks in `argocd-secret`, but our OIDC keys are held only in the SealedSecret-backed `argocd-oidc-secret` Opaque secret. Pre-migration `argocd-secret` happened to contain byte-for-byte copies of those keys (legacy install), which is why it worked. Switch to Argo CD's `$secret:key` form so the values point at the correct secret without duplicating sealed material into `argocd-secret`.
forgejoadmin added 1 commit 2026-08-23 10:34:08 +00:00 
Post-migration verify uncovered that Pocket ID OIDC login was broken:
the argocd-server was rendering $oidc.pocketid.clientId literally into
the authorize URL instead of substituting the client id.

The Helm chart's default $key syntax looks in argocd-secret, but our
OIDC keys are held only in the SealedSecret-backed argocd-oidc-secret
Opaque secret. Pre-migration argocd-secret happened to contain byte-for-
byte copies of those keys (legacy install), which is why it worked.

Switch to Argo CD's $secret:key form so the values point at the correct
secret without duplicating sealed material into argocd-secret.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
forgejoadmin merged commit 2cf6c65d23 into main 2026-08-23 10:34:17 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: basicstack/stack.basicstack.de#5
No description provided.
Delete branch "fix/DEV-523-argocd-oidc-secret-ref"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?