#refarch (2025-01)
Cloud Posse Reference Architecture
2025-01-02
hey folks,
im trying to install a helm chart there is a way to upgrade the argocd because it comes v2.5.9+e5f1194
out of the box, i tried to upgrade it but the dex connection was not working so login fails after upgrading to latest
@Yonatan Koren did you encounter this recently?
@Dan Miller (Cloud Posse) Hey man. It seems both the argo and the dex versions are pinned, I suppose do to this: <https://github.com/argoproj/argo-cd/issues/11392>
Do you have documented a pinned DEX version that works to a pinned Argo 7.x version?
or do you all stay on the older argo versions?
Because of https://github.com/argoproj/argo-cd/issues/11392, we usually do:
chart_values:
# Work around for issue with `invalid session token: failed to verify signature: failed to verify id token signature`
# <https://github.com/argoproj/argo-cd/issues/11392>
dex:
image:
tag: v2.31.2
This hasn’t made it into cloudposse/terraform-aws-components
as we don’t include the stack YAML in that repo, other than snippets in the README. Possibly, we should update the README for eks/argocd
.
However
- We shouldn’t limit ourselves to a version from 2+ years ago. It’s not that we don’t support the 7.x helm chart, it’s simply that, AFAIK, we haven’t had a chance to try the latest version and debug any of the possible dex issues. Speaking for myself, I wanted to try the latest helm chart version, but the customer was using AWS Identity Center (AWS SSO), which needed dex. Because the customer wanted their hands on Argo CD as soon as possible, and being aware of potential issues with dex, I decided to stick with the default version and deferred upgrading and debugging to later. This was very recent, so it hasn’t happened yet.
- You don’t always need dex. Disable it with
dex.enabled: false
if you can use an OIDC provider listed in the second bullet point here. As for that Victoria Metrics CRD error screenshot, the message regarding needing Helm 3.14 or higher makes it sound like the provider is not satisfying that requirement, henceinclude-crds
not being able to render some manifests (presumably CRDs?). However we don’t pin or limithashicorp/helm
(link))). So, not sure about that.