docs: correct the toolbox attribution and record the deploy-order constraint - #64
Merged
venkatamutyala merged 1 commit intoSep 5, 2026
Conversation
…straint Two comment corrections, no behaviour change. The audience comment credited the "toolbox" Dex client to GlueOps/toolbox. The client is created by platform-helm-chart-platform; GlueOps/toolbox is the CLI that mints and presents the token. Also record that the token has to travel in BOTH headers - ARGOCD_AUTH_TOKEN becomes "Token:" for ArgoCD, and oauth2-proxy reads only a separate "Authorization: Bearer". Sending just the env var, as this PR's own description did, gets a login redirect that the CLI reports as "rpc error: unexpected EOF", which names nothing. The Ingress now references middlewares this repo does not create. The documented upgrade order in the tenant README deploys ArgoCD (step 2) before the platform chart (step 4), so on an existing cluster that is the wrong way round: Traefik drops a router whose middleware is missing, and argocd.<domain> answers 404 for the browser UI as well as the CLI until the platform chart lands. It is fail-closed rather than an auth bypass, and self-heals, but nothing said so. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TrpnuCduw2KivngVRQmnG7
venkatamutyala
merged commit Sep 5, 2026
594038a
into
feat/cli-sso-through-oauth2-proxy
1 check passed
venkatamutyala
added a commit
that referenced
this pull request
Sep 5, 2026
…preserving middlewares (#63) * feat: accept the toolbox edge token and route the CLI through bearer-preserving middlewares Ports the argocd.yaml changes that let the argocd CLI work through oauth2-proxy: - allowedAudiences [argocd, toolbox]: a developer's edge token (minted from the public "toolbox" Dex client) authenticates to ArgoCD directly via ARGOCD_AUTH_TOKEN, with no loopback callback. The setting REPLACES the default audience check rather than extending it, so "argocd" must stay listed or browser UI login breaks. - oauth2-with-redirect-bearer on "/": ArgoCD serves gRPC-web at root paths, so this route needs a login redirect for browsers AND the caller's Authorization header left intact for CLIs. The old chain unconditionally stripped it. - oauth2-api on "/api": authenticated the same, but answers 401 instead of an HTML redirect, which is what a CLI can act on. Requires the middlewares and Dex client from GlueOps/platform-helm-chart-platform#1485. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NiwgsqcQ4JikhFYj4NHEjM * docs: correct the toolbox attribution and record the deploy-order constraint (#64) Two comment corrections, no behaviour change. The audience comment credited the "toolbox" Dex client to GlueOps/toolbox. The client is created by platform-helm-chart-platform; GlueOps/toolbox is the CLI that mints and presents the token. Also record that the token has to travel in BOTH headers - ARGOCD_AUTH_TOKEN becomes "Token:" for ArgoCD, and oauth2-proxy reads only a separate "Authorization: Bearer". Sending just the env var, as this PR's own description did, gets a login redirect that the CLI reports as "rpc error: unexpected EOF", which names nothing. The Ingress now references middlewares this repo does not create. The documented upgrade order in the tenant README deploys ArgoCD (step 2) before the platform chart (step 4), so on an existing cluster that is the wrong way round: Traefik drops a router whose middleware is missing, and argocd.<domain> answers 404 for the browser UI as well as the CLI until the platform chart lands. It is fail-closed rather than an auth bypass, and self-heals, but nothing said so. Claude-Session: https://claude.ai/code/session_01TrpnuCduw2KivngVRQmnG7 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Into #63, not
main. Comments only — no rendered behaviour change.1. The audience comment credits the wrong repo
It reads "the public toolbox Dex client (GlueOps/toolbox)". The client is created by platform-helm-chart-platform (#1485);
GlueOps/toolboxis the CLI that mints and presents the token. As written it sends a reader to the wrong repo to find the definition.2. The CLI needs the token in two headers, and #63's own snippet shows one
#63's description says:
That cannot work.
ARGOCD_AUTH_TOKENis sent as gRPC metadata keytoken(apiclient.go:60,516), which--grpc-webcopies to aToken:header — but oauth2-proxy reads onlyAuthorization(jwt_session.go:69-72). So the edge sees no credential, redirects to a login page, and the CLI parses HTML as a gRPC frame:GlueOps/toolboxsends both, fresh per invocation, and its README documents this same failure. The comment now records it next to the setting that depends on it.(
glueops-tokenalso does not exist anywhere in the org — the command istoolbox-token.)3. The Ingress now depends on middlewares this repo does not create
oauth2-with-redirect-bearerandoauth2-apicome from the platform chart. The tenant README's upgrade order deploys ArgoCD at step 2 and the platform chart at step 4 — the wrong way round for this change.Traefik v3.6.7 drops a router whose middleware is missing (
middlewares.go:74→router.go:166-171continue) and falls through tohttp.NotFoundHandler(), soargocd.<domain>answers 404 for the browser UI as well as the CLI until step 4 completes.Worth being precise: this is fail-closed, not an auth bypass — the router is removed, so no unauthenticated request reaches argocd-server — and it self-heals the moment the platform chart lands. On a fresh cluster the documented order is fine, since nothing is serving yet and ArgoCD must exist before the platform chart's Applications can sync. It is only an upgrade hazard, and nothing said so.
A matching note for
tenant-readme.md.tplis in GlueOps/terraform-module-cloud-multy-prerequisites.🤖 Generated with Claude Code
https://claude.ai/code/session_01TrpnuCduw2KivngVRQmnG7