From d1641c9047d4f18b54c5a755289d8c62c93cbef0 Mon Sep 17 00:00:00 2001 From: CTO Agent Date: Sun, 23 Aug 2026 10:33:50 +0000 Subject: [PATCH] fix(argocd): reference argocd-oidc-secret directly for OIDC (DEV-523) Post-migration verify uncovered that Pocket ID OIDC login was broken: the argocd-server was rendering $oidc.pocketid.clientId literally into the authorize URL instead of substituting the client id. The Helm chart's default $key syntax looks in argocd-secret, but our OIDC keys are held only in the SealedSecret-backed argocd-oidc-secret Opaque secret. Pre-migration argocd-secret happened to contain byte-for- byte copies of those keys (legacy install), which is why it worked. Switch to Argo CD's $secret:key form so the values point at the correct secret without duplicating sealed material into argocd-secret. Co-Authored-By: Paperclip --- apps/argocd/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/argocd/values.yaml b/apps/argocd/values.yaml index 7b8e92e..0e8aa05 100644 --- a/apps/argocd/values.yaml +++ b/apps/argocd/values.yaml @@ -16,8 +16,8 @@ configs: oidc.config: | name: Pocket ID issuer: https://auth.basicstack.de - clientID: $oidc.pocketid.clientId - clientSecret: $oidc.pocketid.clientSecret + clientID: $argocd-oidc-secret:oidc.pocketid.clientId + clientSecret: $argocd-oidc-secret:oidc.pocketid.clientSecret requestedScopes: [openid, profile, email, groups] requestedIDTokenClaims: groups: {essential: true} -- 2.45.3