ArgoCD uses RHSSO via OIDC flow and dex provider. It's configured via the CR at https://gitlab.cee.redhat.com/service/managed-tenants-bundles/-/blob/main/addons/acs-fleetshard/package/gitops-operator/51-argocd.yaml.gotmpl

If we keep ArgoCD private and rely on backplane port forwarding the URL will be "localhost" and we need to set the ArgoCD URL to be localhost so the redirect for OIDC works.

If we make ArgoCD public we need to add the ArgoCD OIDC redirect URL to the RHSSO Client's accepted redirect_uri list via SNOW ticket.