<p>We have a setup with Traefik as the Ingress Controller / CRD and ArgoCD. We installed ArgoCD into <a href="https://github.com/jonashackt/tekton-argocd-eks" rel="noreferrer">our EKS setup</a> as described in <a href="https://argo-cd.readthedocs.io/en/stable/getting_started/" rel="noreferrer">the Argo getting stared guide</a>:</p>
<pre><code>kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
</code></pre>
<p>Now <a href="https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#ingressroute-crd" rel="noreferrer">as the docs state</a> the <code>IngressRoute</code> object to configure Traefik correctly looks like this:</p>
<pre><code>apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: argocd-server
  namespace: argocd
spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`argocd.tekton-argocd.de`)
      priority: 10
      services:
        - name: argocd-server
          port: 80
    - kind: Rule
      match: Host(`argocd.tekton-argocd.de`) &amp;&amp; Headers(`Content-Type`, `application/grpc`)
      priority: 11
      services:
        - name: argocd-server
          port: 80
          scheme: h2c
  tls:
    certResolver: default
    
</code></pre>
<p>Right now <a href="https://github.com/argoproj/argo-cd/issues/8950" rel="noreferrer">there's a bug in the docs</a> - so be sure to remove the <code>options: {}</code> in order to let Traefik accept the configuration.</p>
<p>Traefik shows everything is fine in the dashboard:</p>
<p><a href="https://i.stack.imgur.com/SpNcJ.png" rel="noreferrer"><img src="https://i.stack.imgur.com/SpNcJ.png" alt="enter image description here" /></a></p>
<p>But if we try to access the ArgoCD dashboard at <a href="https://argocd.tekton-argocd.de" rel="noreferrer">https://argocd.tekton-argocd.de</a> we get multiple <code>HTTP 307</code> redirects and can't access the dashboard in the end. You can see the redirects inside the developer tools:</p>
<p><a href="https://i.stack.imgur.com/w3me4.png" rel="noreferrer"><img src="https://i.stack.imgur.com/w3me4.png" alt="enter image description here" /></a></p>
<p>Searching for a solution we already found <a href="https://github.com/argoproj/argo-cd/issues/2953" rel="noreferrer">this issue</a> where the problem is described:</p>
<blockquote>
<p>The problem is that by default Argo-CD handles TLS termination itself
and always redirects HTTP requests to HTTPS. Combine that with an
ingress controller that also handles TLS termination and always
communicates with the backend service with HTTP and you get Argo-CD's
server always responding with a redirects to HTTPS.</p>
</blockquote>
<p>Also the solution is sketched:</p>
<blockquote>
<p>So one of the solutions would be to disable HTTPS on Argo-CD, which
you can do by using the --insecure flag on argocd-server.</p>
</blockquote>
<p>But how can we configure the <code>argocd-server</code> Deployment to add the <code>--insecure</code> flag to the argocd-server command - as it is also <a href="https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#traefik-v22" rel="noreferrer">stated inside the ArgoCD docs</a>?</p>

jonashackt
<h2><strong>0. Why a declarative ArgoCD setup with Kustomize is a great way to configure custom parameters</strong></h2>
<p>There are multiple options on how to configure ArgoCD. A great way is to use a declarative approach, which should be the default Kubernetes-style. Skimming the ArgoCD docs there's a <a href="https://argo-cd.readthedocs.io/en/stable/operator-manual/server-commands/additional-configuration-method/#synopsis" rel="noreferrer">additional configuration section</a> where the possible flags of the ConfigMap <code>argocd-cmd-params-cm</code> can be found. The flags are described in <a href="https://argo-cd.readthedocs.io/en/stable/operator-manual/argocd-cmd-params-cm.yaml" rel="noreferrer">argocd-cmd-params-cm.yaml</a>. One of them is the flag <code>server.insecure</code></p>
<pre><code>## Server properties
# Run server without TLS
server.insecure: &quot;false&quot;
</code></pre>
<p>The <code>argocd-server</code> deployment which ships with <a href="https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml" rel="noreferrer">https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml</a> will use this parameter, if it is defined in the <code>argocd-cmd-params-cm</code> ConfigMap.</p>
<p>In order to declaratively configure the ArgoCD configuration, <a href="https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#manage-argo-cd-using-argo-cd" rel="noreferrer">the ArgoCD docs have a great section</a> on how to do that with <a href="https://kustomize.io/" rel="noreferrer">Kustomize</a>. In fact the ArgoCD team itself uses this approach to deploy their own ArgoCD instances - a live deployment is available here <a href="https://cd.apps.argoproj.io/" rel="noreferrer">https://cd.apps.argoproj.io/</a> and the configuration used <a href="https://github.com/argoproj/argoproj-deployments/tree/master/argocd" rel="noreferrer">can be found on GitHub</a>.</p>
<p>Adopting this to our use case, we need to switch our ArgoCD installation from simply using <code>kubectl apply -f</code> to a Kustomize-based installation. The ArgoCD docs also have <a href="https://argo-cd.readthedocs.io/en/stable/operator-manual/installation/#kustomize" rel="noreferrer">a section on how to do this</a>. Here are the brief steps:</p>
<h2><strong>1. Create a <code>argocd/installation</code> directory with a new file <code>kustomization.yaml</code></strong></h2>
<p>We slightly enhance the <code>kustomization.yaml</code> proposed in the docs:</p>
<pre><code>apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - https://raw.githubusercontent.com/argoproj/argo-cd/v2.3.3/manifests/install.yaml

## changes to config maps
patchesStrategicMerge:
  - argocd-cmd-params-cm-patch.yml

namespace: argocd
</code></pre>
<p>Since the docs state</p>
<blockquote>
<p>It is recommended to include the manifest as a remote resource and
apply additional customizations using Kustomize patches.</p>
</blockquote>
<p>we use the <code>patchesStrategicMerge</code> configuration key, which contains another new file we need to create called <code>argocd-cmd-params-cm-patch.yml</code>.</p>
<h2><strong>2. Create a new file <code>argocd-cmd-params-cm-patch.yml</code></strong></h2>
<p>This new file only contains the configuration we want to change inside the ConfigMap <code>argocd-cmd-params-cm</code>:</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cmd-params-cm
data:
  server.insecure: &quot;true&quot;
</code></pre>
<h2><strong>3. Install ArgoCD using the Kustomization files &amp; <code>kubectl apply -k</code></strong></h2>
<p>There's a separate <code>kustomize</code> CLI one can install e.g. via <code>brew install kustomize</code>. But as Kustomize is build into <code>kubectl</code> we only have to use <code>kubectl apply -k</code> and point that to our newly created <code>argocd/installation</code> directory like this. We just also need to make sure that the <code>argocd</code> namespace is created:</p>
<pre><code>kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f -    
kubectl apply -k argocd/installation
</code></pre>
<p>This will install ArgoCD and configure the <code>argocd-server</code> deployment to use the <code>--insecure</code> flag as needed to stop Argo from handling the TLS termination itself and giving that responsibility to Traefik. Now accessing <a href="https://argocd.tekton-argocd.de" rel="noreferrer">https://argocd.tekton-argocd.de</a> should open the ArgoCD dashboard as expected:</p>
<p><a href="https://i.stack.imgur.com/GwotZ.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/GwotZ.jpg" alt="enter image description here" /></a></p>
