From c9ec483130eb92460dea5c93d7b2bbe596b4a821 Mon Sep 17 00:00:00 2001 From: Venkat Date: Sun, 30 Aug 2026 19:28:03 +0000 Subject: [PATCH 1/2] feat: accept the toolbox edge token and route the CLI through bearer-preserving middlewares Ports the argocd.yaml changes that let the argocd CLI work through oauth2-proxy: - allowedAudiences [argocd, toolbox]: a developer's edge token (minted from the public "toolbox" Dex client) authenticates to ArgoCD directly via ARGOCD_AUTH_TOKEN, with no loopback callback. The setting REPLACES the default audience check rather than extending it, so "argocd" must stay listed or browser UI login breaks. - oauth2-with-redirect-bearer on "/": ArgoCD serves gRPC-web at root paths, so this route needs a login redirect for browsers AND the caller's Authorization header left intact for CLIs. The old chain unconditionally stripped it. - oauth2-api on "/api": authenticated the same, but answers 401 instead of an HTML redirect, which is what a CLI can act on. Requires the middlewares and Dex client from GlueOps/platform-helm-chart-platform#1485. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01NiwgsqcQ4JikhFYj4NHEjM --- argocd.yaml.tpl | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/argocd.yaml.tpl b/argocd.yaml.tpl index c8f639b..96a805e 100644 --- a/argocd.yaml.tpl +++ b/argocd.yaml.tpl @@ -191,6 +191,15 @@ configs: clientID: argocd clientSecret: placeholder_argocd_oidc_client_secret_from_dex redirectURI: https://argocd.placeholder_cluster_environment.placeholder_tenant_key.placeholder_glueops_root_domain/api/dex/callback + # Accept the edge token minted for the public toolbox Dex client + # (GlueOps/toolbox), so the CLI authenticates with the same token that gets + # it past oauth2-proxy and no loopback callback is needed. + # + # This REPLACES the default audience check rather than extending it, so + # "argocd" must stay listed or browser UI login breaks for everyone. + allowedAudiences: + - argocd + - toolbox rbac: # -- A good reference for this is: https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/ # This default policy is for GlueOps orgs/teams only. Please change it to reflect your own orgs/teams. @@ -222,7 +231,7 @@ server: # standard annotations for pomerium: https://www.pomerium.com/docs/deploying/k8s/ingress # @ignored annotations: - traefik.ingress.kubernetes.io/router.middlewares: glueops-core-oauth2-proxy-oauth2-with-redirect@kubernetescrd + traefik.ingress.kubernetes.io/router.middlewares: glueops-core-oauth2-proxy-oauth2-with-redirect-bearer@kubernetescrd traefik.ingress.kubernetes.io/router.entrypoints: websecure traefik.ingress.kubernetes.io/router.tls: "true" traefik.ingress.kubernetes.io/router.priority: "10" @@ -244,7 +253,7 @@ extraObjects: name: argocd-server-api annotations: traefik.ingress.kubernetes.io/router.entrypoints: websecure - traefik.ingress.kubernetes.io/router.middlewares: glueops-core-oauth2-proxy-oauth2-no-redirect@kubernetescrd + traefik.ingress.kubernetes.io/router.middlewares: glueops-core-oauth2-proxy-oauth2-api@kubernetescrd traefik.ingress.kubernetes.io/router.priority: "20" traefik.ingress.kubernetes.io/router.tls: "true" spec: From 594038a9ba089ca3dbdc9dc16f4d3ab9e9b7f35e Mon Sep 17 00:00:00 2001 From: Venkat Date: Sat, 5 Sep 2026 12:55:05 +0530 Subject: [PATCH 2/2] docs: correct the toolbox attribution and record the deploy-order constraint (#64) Two comment corrections, no behaviour change. The audience comment credited the "toolbox" Dex client to GlueOps/toolbox. The client is created by platform-helm-chart-platform; GlueOps/toolbox is the CLI that mints and presents the token. Also record that the token has to travel in BOTH headers - ARGOCD_AUTH_TOKEN becomes "Token:" for ArgoCD, and oauth2-proxy reads only a separate "Authorization: Bearer". Sending just the env var, as this PR's own description did, gets a login redirect that the CLI reports as "rpc error: unexpected EOF", which names nothing. The Ingress now references middlewares this repo does not create. The documented upgrade order in the tenant README deploys ArgoCD (step 2) before the platform chart (step 4), so on an existing cluster that is the wrong way round: Traefik drops a router whose middleware is missing, and argocd. answers 404 for the browser UI as well as the CLI until the platform chart lands. It is fail-closed rather than an auth bypass, and self-heals, but nothing said so. Claude-Session: https://claude.ai/code/session_01TrpnuCduw2KivngVRQmnG7 Co-authored-by: Claude Opus 5 (1M context) --- argocd.yaml.tpl | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/argocd.yaml.tpl b/argocd.yaml.tpl index 96a805e..61c3edc 100644 --- a/argocd.yaml.tpl +++ b/argocd.yaml.tpl @@ -191,9 +191,17 @@ configs: clientID: argocd clientSecret: placeholder_argocd_oidc_client_secret_from_dex redirectURI: https://argocd.placeholder_cluster_environment.placeholder_tenant_key.placeholder_glueops_root_domain/api/dex/callback - # Accept the edge token minted for the public toolbox Dex client - # (GlueOps/toolbox), so the CLI authenticates with the same token that gets - # it past oauth2-proxy and no loopback callback is needed. + # Accept the edge token minted for the public "toolbox" Dex client, which + # platform-helm-chart-platform creates on every cluster. GlueOps/toolbox is + # the CLI that mints and presents it. One token then satisfies both + # oauth2-proxy at the edge and ArgoCD itself, so no loopback callback is + # needed -- which is what makes the CLI usable from a machine whose browser + # lives somewhere else. + # + # The CLI must send that token in BOTH headers, because each side reads only + # its own: ARGOCD_AUTH_TOKEN becomes "Token:" for ArgoCD, and a separate + # "Authorization: Bearer" is what oauth2-proxy reads. Sending only the env + # var gets a login redirect the CLI reports as "rpc error: unexpected EOF". # # This REPLACES the default audience check rather than extending it, so # "argocd" must stay listed or browser UI login breaks for everyone. @@ -231,6 +239,12 @@ server: # standard annotations for pomerium: https://www.pomerium.com/docs/deploying/k8s/ingress # @ignored annotations: + # oauth2-with-redirect-bearer and oauth2-api are created by the GlueOps + # platform chart, not here. On an UPGRADE, deploy the platform chart before + # this one: Traefik drops a router whose middleware does not exist, so + # argocd. answers 404 -- browser UI included -- until the middleware + # is there. It is fail-closed, not an auth bypass, and self-heals as soon as + # the platform chart lands. traefik.ingress.kubernetes.io/router.middlewares: glueops-core-oauth2-proxy-oauth2-with-redirect-bearer@kubernetescrd traefik.ingress.kubernetes.io/router.entrypoints: websecure traefik.ingress.kubernetes.io/router.tls: "true"