alex/infrastructure
Watch
1
0
Fork
You've already forked infrastructure
 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Log in to Argo CD and Kiali through tsidp #226

Merged
alex merged 1 commit from wiring-guru/argocd-kiali-oidc into main 2026-11-11 11:52:39 -07:00 AGit
Conversation 0 Commits 1 Files changed 2 +38 -1
wiring-guru commented 2026-11-11 11:51:10 -07:00
Contributor
Copy link

Configures both UIs for tsidp OIDC. Prerequisites, already created and not in git: Secret argocd/argocd-tsidp (client-id, client-secret) needs the label app.kubernetes.io/part-of=argocd before this merges, and Secret monitoring/kiali-tsidp (oidc-secret) already exists.

Configures both UIs for tsidp OIDC. Prerequisites, already created and not in git: Secret argocd/argocd-tsidp (client-id, client-secret) needs the label app.kubernetes.io/part-of=argocd before this merges, and Secret monitoring/kiali-tsidp (oidc-secret) already exists.
Log in to argocd and kiali through tsidp
All checks were successful
Apply Argo CD Applications / update-repo-folder (push) Successful in 1s
Details
Apply Argo CD Applications / update-repo (push) Successful in 0s
Details
Apply Argo CD Applications / apply-applications (push) Successful in 2s
Details
2c3243a325 
Both UIs sit behind the tailnet gateway, so a tsidp login is silent: the caller's
tailnet identity is the credential and the backchannel is the same path grafana
already uses.

argocd gets its client pair from the argocd-tsidp Secret rather than argocd-secret,
which the upstream install manifest owns and selfHeal would revert. requestedScopes
drops groups: tsidp publishes openid, email and profile only, and asking for a scope
it does not serve fails the authorization request. RBAC keys the tailnet logins to
role:admin and leaves everyone else at role:readonly, so the second user on the
tailnet can still read without deploying.

kiali's client secret can only come from a Secret, named through deployment.secret_name
since the chart also uses the default name. disable_rbac is what makes the UI
cluster-wide: namespace-scoped Kiali RBAC needs the API server itself to accept tsidp
tokens, which is a separate change.
alex merged commit 2c3243a325 into main 2026-11-11 11:52:39 -07:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
alex/infrastructure!226
No description provided.