feat: accept the toolbox edge token and route the CLI through bearer-preserving middlewares - #63
Merged
Merged
Conversation
…preserving middlewares Ports the argocd.yaml changes that let the argocd CLI work through oauth2-proxy: - allowedAudiences [argocd, toolbox]: a developer's edge token (minted from the public "toolbox" Dex client) authenticates to ArgoCD directly via ARGOCD_AUTH_TOKEN, with no loopback callback. The setting REPLACES the default audience check rather than extending it, so "argocd" must stay listed or browser UI login breaks. - oauth2-with-redirect-bearer on "/": ArgoCD serves gRPC-web at root paths, so this route needs a login redirect for browsers AND the caller's Authorization header left intact for CLIs. The old chain unconditionally stripped it. - oauth2-api on "/api": authenticated the same, but answers 401 instead of an HTML redirect, which is what a CLI can act on. Requires the middlewares and Dex client from GlueOps/platform-helm-chart-platform#1485. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NiwgsqcQ4JikhFYj4NHEjM
github-actions
Bot
added
include-in-release-notes
enhancement
venkatamutyala
force-pushed
the
feat/cli-sso-through-oauth2-proxy
branch
from
August 31, 2026 12:46
5ddbcd9 to
c9ec483
Compare
This was referenced Sep 5, 2026
…straint (#64) Two comment corrections, no behaviour change. The audience comment credited the "toolbox" Dex client to GlueOps/toolbox. The client is created by platform-helm-chart-platform; GlueOps/toolbox is the CLI that mints and presents the token. Also record that the token has to travel in BOTH headers - ARGOCD_AUTH_TOKEN becomes "Token:" for ArgoCD, and oauth2-proxy reads only a separate "Authorization: Bearer". Sending just the env var, as this PR's own description did, gets a login redirect that the CLI reports as "rpc error: unexpected EOF", which names nothing. The Ingress now references middlewares this repo does not create. The documented upgrade order in the tenant README deploys ArgoCD (step 2) before the platform chart (step 4), so on an existing cluster that is the wrong way round: Traefik drops a router whose middleware is missing, and argocd.<domain> answers 404 for the browser UI as well as the CLI until the platform chart lands. It is fail-closed rather than an auth bypass, and self-heals, but nothing said so. Claude-Session: https://claude.ai/code/session_01TrpnuCduw2KivngVRQmnG7 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
venkatamutyala
added a commit
to GlueOps/terraform-module-cloud-multy-prerequisites
that referenced
this pull request
Sep 5, 2026
…ox (#720) * docs: warn about the argocd/platform upgrade order and point at toolbox Two additions to the tenant README template. Step 2 now says to run step 4 first when upgrading. argocd.yaml is moving to Traefik middlewares that the platform chart creates (GlueOps/docs-argocd#63, GlueOps/platform-helm-chart-platform#1485), and the order prescribed here installs ArgoCD before the platform chart. On an existing cluster that means the Ingress references middlewares that do not exist yet; Traefik drops the router rather than serving it unprotected, so argocd.<domain> answers 404 for the browser UI as well as the CLI until step 4 lands. Fail-closed and self-healing, but an avoidable outage that nothing warned about. Fresh clusters keep the existing order - nothing is serving yet, and ArgoCD has to exist before the platform chart's Applications can sync. Step 5 listed four browser URLs and no way to use the platform from a terminal. GlueOps/toolbox has shipped since v0.0.5 and is referenced nowhere a tenant would look: a search of the org finds no mention outside the repo itself. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TrpnuCduw2KivngVRQmnG7 * docs: the argocd 404 outlasts the helm upgrade, say so "until step 4 completes" was optimistic. Step 4 runs helm upgrade on the platform chart, which only creates the glueops-core-traefik-crds-and-middleware Application; the middlewares themselves arrive when Argo CD syncs that Application through its sync-waves. So the 404 window extends past the helm command returning, and an operator watching for the upgrade to finish would conclude the outage should already be over. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TrpnuCduw2KivngVRQmnG7 * docs: pin the version constraints to the released tags The ordering warning and the toolbox bullet were written before the dependencies were tagged, so they described the constraint without saying which versions it starts from - leaving an operator to work out whether it applied to them. Now released, so name them: docs-argocd v0.21.0 - argocd.yaml starts referencing the bearer-preserving middlewares glueops-platform v0.79.0 - first release that ships them vault configuration module v0.15.0 - creates the OpenBao jwt roles `bao` logs in through The toolbox bullet gains the same floors, including the vault module, since `./toolbox bao ...` fails against a cluster whose OpenBao has no jwt mount and nothing else would explain why. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TrpnuCduw2KivngVRQmnG7 --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Warning
Deploy the GlueOps platform chart before this on an upgrade. This template now references
oauth2-with-redirect-bearerandoauth2-api, which GlueOps/platform-helm-chart-platform#1485 creates. The tenant README's order installs ArgoCD at step 2 and the platform chart at step 4 — the wrong way round here. Traefik drops a router whose middleware is missing, soargocd.<domain>answers 404 for the browser UI as well as the CLI until the platform chart lands. Fail-closed, not an auth bypass, and it self-heals — but it is an avoidable outage. See GlueOps/terraform-module-cloud-multy-prerequisites#720.Ports the
argocd.yamlchanges that make theargocdCLI usable through oauth2-proxy, tested live onnonprod.jupiter.onglueops.rocks(the captain repo carries the rendered equivalent of exactly this diff, applied at argocd helm revision 6).What changes
allowedAudiences: [argocd, toolbox]— ArgoCD verifies every token against Dex and, by default, accepts onlyaud: argocd. Addingtoolboxlets the edge token developers mint from the publictoolboxDex client authenticate to ArgoCD directly.argocdmust stay in the list or browser UI login breaks for everyone.Middleware swaps on the two Ingresses — the old chains list
authorizationin forwardauth'sauthResponseHeaders, which Traefik applies as an unconditionalreq.Header.Del(oauth2-proxy never returns that header, so it only ever strips the caller's token):/(UI + root gRPC-web paths)oauth2-with-redirectoauth2-with-redirect-bearer— still redirects browsers to login, leaves the CLI's bearer intact/apioauth2-no-redirectoauth2-api— same auth, 401 instead of an HTML redirectNothing is exempted from forwardauth; browser behaviour is unchanged (browsers never send
Authorization).Using it
GlueOps/toolbox is the supported path.
Correcting an earlier version of this description, which said to run
export ARGOCD_AUTH_TOKEN=$(glueops-token); argocd app list --grpc-web. That does not work, andglueops-tokendoes not exist anywhere in the org (the command istoolbox-token).The token has to travel in two headers, because each side reads only its own:
ARGOCD_AUTH_TOKENToken: <jwt>--header "Authorization: Bearer <jwt>"Authorization:ARGOCD_AUTH_TOKENis carried as gRPC metadata under the keytoken(apiclient.go:60,:516), and--grpc-webcopies metadata to headers verbatim — so the edge sees noAuthorization, returns 401, the errors plugin turns that into a 302, and the CLI follows it to Dex and parses HTML as a gRPC frame:Send only the header and you clear the edge with
Token:empty, so ArgoCD answersUnauthenticated: no session information.toolboxsets both, fresh per invocation.Known rough edge
On the
/route,oauth2-with-redirect-bearerstill chains theerrors-redirectplugin, which rewrites 401–403 into a 302. When the Dex token itself has expired, the CLI therefore gets HTML instead of a clean 401 — the same class of problem #1485 fixes for OpenBao's/v1./apiis unaffected (oauth2-apihas no errors plugin).Backend responses are not affected: ArgoCD serves gRPC-web through
grpcweb.WrapServer, and grpc-go reports RPC errors as HTTP 200 with aGrpc-Statustrailer, which is outside the plugin's401-403range. So an expired ArgoCD token or an RBAC denial reaches the CLI as a proper gRPC status. Only the edge's own 401 is rewritten.A tighter fix, if this proves annoying in practice, is an IngressRoute matching
Content-Type: application/grpc-web+protoat priority > 10 and routing it throughoauth2-api.Dependency
The middlewares and the
toolboxDex client come from GlueOps/platform-helm-chart-platform#1485 — see the warning at the top.Follow-up
GlueOps/toolbox) and records the ordering constraint in the template itself.🤖 Generated with Claude Code
https://claude.ai/code/session_01TrpnuCduw2KivngVRQmnG7