From 17dbe32a106a836c235b7042c29482ae00c90e6e Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 22 Jul 2026 09:42:24 -0700
Subject: [PATCH] fix(argocd): add insecureSkipVerify for Authentik OIDC

ArgoCD was failing to query Authentik OIDC discovery endpoint with:
  tls: failed to verify certificate: x509: certificate signed by unknown authority

Root cause: ArgoCD's HTTP client doesn't properly trust the rootCA cert
even when specified in oidc.config.

Fixed by adding insecureSkipVerify: true to OIDC config. This is acceptable
for internal homelab with self-signed certificates.

Tested: ArgoCD SSO login via Authentik now works
---
 k8s/security/ci-cd/argocd-values.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/k8s/security/ci-cd/argocd-values.yaml b/k8s/security/ci-cd/argocd-values.yaml
index 5a8ffac..3251ea8 100644
--- a/k8s/security/ci-cd/argocd-values.yaml
+++ b/k8s/security/ci-cd/argocd-values.yaml
@@ -30,6 +30,7 @@ configs:
       clientID: $oidc-secret:client-id
       clientSecret: $oidc-secret:client-secret
       requestedScopes: [openid, profile, email, groups]
+      insecureSkipVerify: true
       rootCA: |
         -----BEGIN CERTIFICATE-----
         MIIBbTCCARSgAwIBAgIUNa409I6cGHye4YqeiphmWDaCEXUwCgYIKoZIzj0EAwIw