-
Bug
-
Resolution: Done
-
Critical
-
1.8.0
-
None
Description of problem:
After upgrading to 1.8.0, 'Log In Via Openshift' does not work for users coming from older version of GitOps
This is happening because of the incorrect configuration for dex in ArgoCD CR (.spec.dex instead of .spec.sso). Customers coming from lower version of operator who have not switched to new configuration for dex seem to have faced this issue
With v1.8, we added a fix for https://issues.redhat.com/browse/GITOPS-2570 which is looking for new dex configuration. As we are supporting the old configuration until 1.9 is out, we need to fix this in upcoming releases.
Workaround:
Customers who are facing this issue can update their dex configuration from .spec.dex to .spec.sso
spec: sso: provider: dex dex: ...
Prerequisites (if any, like setup, operators/versions):
The operator installed should be upgraded from operator version < 1.6.0
Steps to Reproduce
- Get the URL for ArgoCD Ui by either navigating to Networking > Routes in the namespace of your ArgoCD instance or using the console application launcher
- Try to Log in Via Openshift
Actual results:
openshift-gitops-server pod logs:
time="2023-03-17T17:27:11Z" level=info msg="Initializing OIDC provider (issuer: https://openshift-gitops-server-openshift-gitops.apps.testpsi411c.ocp-gitops-qe.com/api/dex)"123time="2023-03-17T17:27:11Z" level=info msg="OIDC supported scopes: [openid email groups profile offline_access]"124time="2023-03-17T17:27:11Z" level=warning msg="Failed to verify token: failed to verify token: oidc: expected audience \"argo-cd-cli\" got [\"argo-cd\"]"125time="2023-03-17T17:27:11Z" level=info msg="received unary call /version.VersionService/Version" grpc.method=Version grpc.request.content= grpc.service=version.VersionService grpc.start_time="2023-03-17T17:27:11Z" span.kind=server system=grpc126time="2023-03-17T17:27:11Z" level=info msg="finished unary call with code OK" grpc.code=OK grpc.method=Version grpc.service=version.VersionService grpc.start_time="2023-03-17T17:27:11Z" grpc.time_ms=14.654 span.kind=server system=grpc
openshift-gitops-dex-server pod logs:
time="2023-03-17T17:28:10Z" level=error msg="Failed to authenticate: oidc: failed to get token: oauth2: cannot fetch token: 400 Bad Request\nResponse: {\"error\":\"unauthorized_client\",\"error_description\":\"The client is not authorized to request a token using this method.\"}\n
Screenshot attached
Expected results:
Log In Via Openshift should let you log into the ArgoCD UI
Reproducibility (Always/Intermittent/Only Once):
With old dex configuration, Always
Acceptance Criteria
- Bring the PR from upstream to Midstream.
- Validate this is working fine, so the customer below 1.6 should be able to login without issues.{}
- Manual testing is required to verify this.
- Check if we already plan for automating a test for this or if it's even possible to automate such as test, and create a new Jira story for that in the future.
- Send to release notes as they are required.
DoD
- Make sure the final build that reaches the customer includes the fix
- Verify the documentation for the customer is in place.
- Release Notes required.
Build Details:
Additional info (Such as Logs, Screenshots, etc):
- causes
-
OCPBUGS-10547 [enterprise-4.12] Issue in file cicd/gitops/configuring-sso-on-argo-cd-using-dex.adoc
- Closed
- is documented by
-
RHDEVDOCS-5089 GitOps 1.8.2 release notes
- Closed
- links to