<h1>Traefik &amp; ArgoCD</h1>
<h2>Setup</h2>
<p>Hello everybody!
I've setup a barebones Kubernetes on my Ubuntu Server and installed Traefik. So far so good. TLS works and I can connect to my dashboard and an demo-application over my domain.
My Traefik dashboard is secured over a simple basic-auth middleware that is created and added to the IngressRoute. As I expected only my dashboard under <em>traefik.example.com</em> is now secured but my demo-application under <em>example.com</em> is not affected.</p>
<h2>Problem</h2>
<p>Now to the weird part:
I installed ArgoCD with helm and an values chart that adds the --insecure flag to the server. Afterwards I created an IngressRoute for <em>argocd.example.com</em> without any middleware (!) and tried it.
To my surprise I saw the not the ArgoCD Login Screen, but my middleware popup. After I entered my middlwware credentials, i got forwarded to the argocd UI but nothing works.</p>
<p><a href="https://i.stack.imgur.com/ggm9o.png" rel="nofollow noreferrer">error_screenshot</a></p>
<p>My first try was to create argoCD User with the same auth like my middleware in hope, that this could be a workaround.
After that I deleted temporarely my middleware and ArgoCD works like a charm!
I really can't explain to myself why this happens. The middleware should not be there in the first place, but even when it's there, why does the service works without but not after successfull authentication.</p>
<p>You find my resources below. I would be happy about any suggestion and workaround! I simply want to secure my traefik-dashboard with a middleware but use the standard login page from argocd.</p>
<h2>My Resources:</h2>
<p>IngressRoute</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  annotations:
  name: argocd-server
spec:
  entryPoints:
  - websecure
  routes:
  - kind: Rule
    match: Host(`argocd.example.de`)
    priority: 10
    services:
    - name: argo-cd-argocd-server
      port: 80
  - kind: Rule
    match: Host(`argocd.example.de`) &amp;&amp; Headers(`Content-Type`, `application/grpc`)
    priority: 11
    services:
    - name: argo-cd-argocd-server
      port: 80
      scheme: h2c
  tls:
    secretName: argo-cert
</code></pre>
<p>Middleware</p>
<pre><code>API Version:  traefik.containo.us/v1alpha1
Kind:         Middleware
Metadata:
  Creation Timestamp:  2022-04-26T12:47:50Z
  Generation:          1
  Managed Fields:
    API Version:  traefik.containo.us/v1alpha1
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .:
          f:kubectl.kubernetes.io/last-applied-configuration:
      f:spec:
        .:
        f:basicAuth:
          .:
          f:secret:
    Manager:         kubectl-client-side-apply
    Operation:       Update
    Time:            2022-04-26T12:47:50Z
  Resource Version:  24871428
  UID:               8ba3ef4d-0514-44b5-a98d-a1a0790b989a
Spec:
  Basic Auth:
    Secret:  traefik-basic-auth
Events:      &lt;none&gt;
</code></pre>
<p>ArgoCD Server Pod snippet</p>
<pre><code>Command:
      argocd-server
      --staticassets
      /shared/app
      --repo-server
      argo-cd-argocd-repo-server:8081
      --logformat
      text
      --loglevel
      info
      --redis
      argo-cd-argocd-redis:6379
      --insecure
    State:  Running
</code></pre>

J-Gallus
<p>The problem was in the standard config yaml of traefik.</p>
<pre><code>kind: IngressRoute
metadata:
  annotations:
    helm.sh/hook: post-install,post-upgrade
  creationTimestamp: &quot;2022-03-21T12:36:11Z&quot;
  generation: 3
  labels:
    app.kubernetes.io/instance: traefik
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: traefik
    helm.sh/chart: traefik-10.15.0
  name: traefik-dashboard
  namespace: default
  resourceVersion: &quot;15061579&quot;
  uid: 53077805-d6cd-4d84-a159-388ca16f5cec
spec:
  entryPoints:
  - websecure
  routes:
  - kind: Rule
    middlewares:
    - name: test-auth
    match: Host(`traefik.example.de`) &amp;&amp; PathPrefix(`/dashboard`) || PathPrefix(`/api`)
    services:
    - kind: TraefikService
      name: api@internal
  tls:
    secretName: traefik-cert
    namespace: default
</code></pre>
<p>If you take a look at the matching route, that you'll see that the route will match anything that ends with &quot;/api/&quot;. This is very unfortunate as argocd depends on the call &quot;argocd.example.com/api/v1/&quot;.</p>
<p>So the first call to the gui works, but as soon argcd try to load any settings or data, the &quot;api&quot; route from traefik got hit.</p>
<p>It was simply fixed with adding the full hostname/subdomain name to the traefik &quot;or&quot; rule.</p>
<pre><code>Host(`traefik.example.de`) &amp;&amp; PathPrefix(`/dashboard`) || Host(`traefik.example.de`) &amp;&amp; PathPrefix(`/api`)
</code></pre>
