Argo-cd: Server ignores initial TLS cert

[mgoodness]

When I deploy Argo CD for the first time I create argocd-secret with the following manifest (sensitive data redacted):

apiVersion: v1
kind: Secret
metadata:
  annotations:
    certmanager.k8s.io/alt-names: argocd.sandbox113.us-east-1.tktm.io
    certmanager.k8s.io/common-name: argocd.sandbox113.us-east-1.tktm.io
    certmanager.k8s.io/issuer-kind: ClusterIssuer
    certmanager.k8s.io/issuer-name: tktm.io
  labels:
    app: argo-cd
    certmanager.k8s.io/certificate-name: argocd-server
    component: server
  name: argocd-secret
data:
  dex.ldap.bindPW: <base64>
  repo.password: <base64>
  repo.username: <base64>
  tls.crt: <base64>
  tls.key:  <base64>
type: Opaque

All pods start correctly and I'm able to authenticate with LDAP. Argo CD also connects to my repos using the provided credentials. But when I open the dashboard I get a self-signed TLS cert instead of the one I just provided. Running kubectl get secrets argocd-secret -o json|jq -r '.data."tls.crt"'|base64 -D|openssl x509 -noout -textshows that my cert has in fact been overwritten with a self-signed one.

I then have to re-apply my manifest, after which Argo CD will use my cert. (Note: before rc5 I had to delete the argocd-server pod for the cert to be used.)

I know the self-signed cert isn't supposed to be generated unless tls.cert and tls.key are empty, but it seems like it's being created regardless. Happy to provide logs & help troubleshoot.

[jessesuen]

I took a closer look. It seems we consider the settings as “incomplete” when other fields like admin password are missing, and blindly clobber the tls.key/tls.crt. I am working on the fix.

[wreed4]

This is still happening for me. Even if the cert exists before argo server is started, I need to kill the pod at least once for it not to initialize its own tls.

[jd0x]

+1

Same issue mentioned above. The self-signed cert embedded below will overwrite my existing certificate requiring me to recreate my Ingress or patch the argocd-secret with my TLS crt and key.

Subject Alternative Names: localhost, argocd-server, argocd-server.argocd, argocd-server.argocd.svc, argocd-server.argocd.svc.cluster.local
Organization: Argo CD
Valid From: June 9, 2019
Valid To: June 8, 2020
Issuer: Argo CD
Serial Number: 

[alexec]

It would be really useful to have repro steps.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[alexmt]

I believe that was fixed in v0.11 which was published on Jan 10, 2019 .

It does not seem to reproducible anymore. Please let us know if you are still seeing it @jd0x , @wreed4