Can not put Secrets in config sso param configs.cm.dex.config.connectors.config.clientSecret

[clement94310]

hello
i can not manage to use secret for client Secret on configuration for SSO

configs:
  cm:
    create: true
    exec.enabled: "true"
    accounts.image-updater: apiKey
    accounts.argo-workflows: apiKey
    url: "https://argocd.dev.xyz"
    dex.config: |
      connectors:
      - config:
          issuer: "https://accounts.google.com/o/oauth2/auth"
          clientID: "XXXXXXX"
          clientSecret: "XXXXXXXXX"
          redirectURI: "https://argocd.dev.xyz/api/dex/callback"
          serviceAccountFilePath: /tmp2/oidc/XXXXX.json
          adminEmail: [email protected]
        type: google
        id: google
        name: Google

[mkilchhofer]

i can not manage to use secret for client Secret on configuration for SSO

What is the problem then?

I use this in my homelab:

configs:
  cm:
    # ..
    oidc.config: |
      name: Pocket ID
      issuer: https://auth.example.com
      clientID: argocd
      clientSecret: $oidc.dex.clientSecret
      requestedScopes:
      - openid
      - email
      - groups

Src: https://github.com/mkilchhofer/k8s-gitops-services/blob/9e346594957aa3b3656d60ef52cd7e50d3747837/k3s-bootstrap/helm-values/argocd.yaml#L251-L266

      clientSecret: $oidc.dex.clientSecret

This tells Argo CD to use the "standard" secret argocd-secret for the lookup.

$ kubectl -n argocd get secrets argocd-secret -o yaml
apiVersion: v1
data:
  admin.password: REDACTED
  admin.passwordMtime: REDACTED
  oidc.dex.clientSecret: REDACTED # <-- see here
  server.secretkey: REDACTED
kind: Secret
metadata:
  # ..

---

Argo CD also supports this here:

$<some_K8S_secret>:dex.acme.clientSecret

Argo CD will then search for the secret name some_K8S_secret.

Xref:

• How to use custom secret to use in ConfigMap argocd-cm. argo-cd#11353
• https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/user-management/index.md#2-configure-argo-cd-for-sso