GitHub SSO with dex returns Failed to query provider "https://argocd.<domain>.com/api/dex": Get "https://argocd-dex-server:5556/api/dex/.well-known/openid-configuration": EOF

[aturcott]

We are running our Argo instances on AKS clusters and are currently using Azure SSO to login. I wanted to switch to GitHub SSO with dex so we could manage the applications and RBAC ourselves. I got it working on one cluster and replicated the setup on another cluster (the domain will be different because of different environments) but for the most part they are exactly the same. I get the above error whenever I try logging in with GitHub.

Here is the dex config for the one that is currently broken.

dex.config: |
      connectors:
      - type: github
        id: github
        name: GitHub
        config:
          clientID: $argocd-keyvault:argocd-client-id
          clientSecret: $argocd-keyvault:argocd-client-secret
          orgs:
          - name: <our org name>

and here is the dex config for the one that is working

dex.config: |
      connectors:
      - type: github
        id: github
        name: GitHub
        config:
          clientID: $argocd-keyvault:argocd-azuread-oauth2-client-id-github
          clientSecret: $argocd-keyvault:argocd-azuread-oauth2-client-secret-github
          redirectURI: https://argocd.<domain>.com/api/dex/callback
          orgs:
          - name: <a different org name>

the only major difference is the redirectURI is not present in the first one because the docs say it is not needed. I did have it included but removed it to see if it fix the issue. Our environments are built using terraform so configs should be mostly the same aside from some naming conventions due to differences in environments. Just wondering if anyone else has run into this issue, I'm almost positive I have everything spelled correctly so I'm curious why it's having trouble reaching the provider.

[luispabon]

Did you get to the bottom of this? Seeing the same thing myself, on an ldap integration

[luispabon]

Ah, it's this: #12934 (comment) at least in our case

[aturcott]

ah cool glad you could find it! but yeah we did, we have istio running on our AKS clusters with injection enabled so everything is deployed with the sidecar proxies. turns out that for the one cluster where dex WAS working, injection was disabled on the argo namespace so dex wasn't deployed with sidecars. so it turned out to be a TLS issue

[luispabon]

In our case, we do SSL termination elsewhere and thus we have configs.params."server.insecure"=true on argo's params.