-
Bug
-
Resolution: Done
-
Critical
-
1.6.0, 1.4.11, 1.5.5
-
5
-
False
-
None
-
False
-
-
GITOPS Sprint 223, GITOPS Sprint 224
Problem description:
Single Sign On with GitOps Operator can fail with the error message "x509: certificate signed by unknown authority" under the following circumstances:
- You are using RHSSO (KeyCloak) as SSO provider and
- You are using a self-signed certificate for your route endpoints, or you are using a private CA to issue certificates
This behavior is a result of a security fix in Argo CD, which enforces a strict validation of TLS certificates on the configued OIDC endpoints.
Workaround & Mitigation
There are multiple workarounds available:
- For OpenShift GitOps 1.6 and above, you can disable TLS validation for the OIDC (Keycloak/RHSSO) endpoint in the ArgoCD spec:
spec: extraConfig: oidc.tls.insecure.skip.verify: "true"
- For OpenShift GitOps 1.5 and below, you need to patch the argocd-cm ConfigMap in your instance's namespace as follows
oc patch configmap argocd-cm --patch='{"data": {"oidc.tls.insecure.skip.verify": "true"}}'
- relates to
-
GITOPS-2212 Support setting root CA certificate for OIDC providers
- Closed
- links to
- mentioned on
(8 mentioned on)