ArgoCD Dex for GitHub SSO Dex failed to list secrets in namespace

[aturcott]

We have deployed ArgoCD on several AKS clusters using Helm and are currently migrating from Azure SSO to GitHub SSO. We have it working for one instance but after replicating the config for another argo instance we get an error when logging in Failed to query provider "https://argocd.argo.<domain>.com/api/dex": Get "https://argocd-dex-server:5556/api/dex/.well-known/openid-configuration": EOF. After checking the logs for the dex-server pod I saw that it was throwing some errors about failing to list some secrets in the same argo namespace because the connection was refused 1 reflector.go:424] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:169: failed to list *v1.Secret: Get "https://172.25.0.1:443/api/v1/namespaces/argocd/secrets?limit=500&resourceVersion=0": dial tcp 172.25.0.1:443: connect: connection refused

We're stuck trying to figure out where the disconnect could possibly be since our clusters are built through terraform and should be configured exactly the same except for some naming conventions. Just wondering if anyone else has seen anything similar.

[Akvanvig]

Sounds like you're having trouble reaching the kubernetes api, doesn't sound very dex related 🤔
Would check for network policies or api issues maybe?

[aturcott]

yeah we realized after the fact that the argo instance that was working wasn't running any istio sidecar proxies because it didn't have istio injection enabled. the one that wasn't working DID have sidecar proxies because the namespace had the istio-injection=enabled label so we found that it's a TLS issue. thanks so much for your response though!