Setting up SSO with Dex and Azure's app Gateway

[salimkapadia]

I've got a helm chart that manages my installation of argocd:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: argocd
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "-20"
spec:
  project: bootstrap

  source:
    repoURL: https://argoproj.github.io/argo-helm
    targetRevision: 7.5.2
    chart: argo-cd
    helm:
      # Ref: https://github.com/argoproj/argo-helm/blob/main/charts/argo-cd/values.yaml
      valuesObject:
        controller:
          podLabels:
            azure.workload.identity/use: 'true'
        server:
          podLabels:
            azure.workload.identity/use: 'true'
        configs:
          cm:
            kustomize.buildOptions: --enable-helm
            url: http://argocd.mydomain.io
            dex.config: |
              logger:
                level: debug
                format: json
              connectors:
                - type: saml
                  id: saml
                  name: saml
                  config:
                    entityIssuer: https://argocd.mydomain.io/api/dex/callback
                    ssoURL: https://login.microsoftonline.com/MY-TENANT-ID-HERE/saml2
                    redirectURI: https://argocd.mydomain.io/api/dex/callback
                    usernameAttr: email
                    emailAttr: email
                    groupsAttr: Group
                    # usernameAttr: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
                    # emailAttr: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
                    # groupsAttr: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
  destination:
    server: https://kubernetes.default.svc  # Host cluster
    namespace: argocd

  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=true
    - PrunePropagationPolicy=foreground

and then i have this:

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: bootstrap
  namespace: argocd # This namespace should always match the namespace of the argocd-server
  annotations:
    argocd.argoproj.io/sync-wave: "-15"
  # Finalizer that ensures that project is not deleted until it is not referenced by any application
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  description: The applications used for bootstrapping argocd and the management cluster

  # Allow manifests to deploy from any Git repos
  sourceRepos:
  - '*'

  # Only permit applications to deploy to the guestbook namespace in the same cluster
  # Destination clusters can be identified by 'server', 'name', or both.
  destinations:
  - namespace: '*'
    server: https://kubernetes.default.svc
    name: in-cluster

  clusterResourceWhitelist:
  - group: '*'
    kind: '*'

  namespaceResourceWhitelist:
  - group: '*'
    kind: '*'

  # Custom roles to further restrict access to applications inside the project
  roles: []
  # - name: tc-argocd-admin
  #   description: Admin role tied to an Azure AD group
  #   policies:
  #     # Allow all operations for this role
  #     - action: '*'
  #       scope: '*'
  #       object: '*'
  #   groups:
  #     # Reference the Azure AD group by its display name
  #     - azuread:example-ad-group-id-or-name # Replace with the Azure AD group ID or name
  # - name: tc-argocd-read-only
  #   description: Read-only role tied to an Azure AD group
  #   policies:
  #     # Allow only read access for this role
  #     - action: 'get'
  #       scope: '*'
  #       object: '*'
  #   groups:
  #     # Reference the Azure AD group for read-only access
  #     - azuread:example-read-only-group-id-or-name # Replace with the Azure AD group ID or name
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-server-http
  namespace: argocd
  annotations:
    kubernetes.io/ingress.class: azure-application-gateway
    appgw.ingress.kubernetes.io/ssl-redirect: "true"
    appgw.ingress.kubernetes.io/backend-path-prefix: "/"
    appgw.ingress.kubernetes.io/backend-protocol: "HTTP"
spec:
  ingressClassName: azure-application-gateway
  rules:
  - host: argocd.mydomain.io
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: argocd-server #[your argoCD server service name]
            port:
              name: http
      - path: /api/dex/callback  #[SAML (with Dex) SSO Setup path]
        pathType: Prefix
        backend:
          service:
            name: argocd-server #[your argoCD server service name]
            port:
              name: http

When I go to http://argocd.mydomain.io I just get a 504. I keep making changes, running kubectl apply -f blah.yaml and then this: kubectl rollout restart deployment argocd-server

How can I see what is causing the 504?