Is there any reason that the official dex chart can't be used?

[cdobbyn]

Right now it's just a template folder instead of a sub-chart like redis-ha.

I'd like to have more than 1 replica on dex for at least some redundancy.

[pdrastil]

Hi, I had same question. After looking into the manifest you will find there is argo-dex CLI utility that reconfigures internals of Dex server and forces restarts when user does change in argocd-cm with Dex configuration. This utility hardcodes in-memory database for sessions so it's not possible to run multiple replicas that require some kind of external storage. Enabling multiple replicas means you either add yet another chart for running single instance database or using extranl database or using K8s cluster admin resources that would break namespaced installations for some users. Personally I would recommend to disable dex and use oauth if possible with external OAuth2 provider such as GitHub instead. Dex is necessary only for LDAP server integrations and it will be always weak link for whole setup for the reasons mentioned above.

[cdobbyn]

Ahh gotcha, that makes more sense.

That's my plan in the future, right now ArgoCD doesn't support thin tokens (where the token is separate from group claims). Once that's available I won't need this any longer.

[pdrastil]

One more thing you try to do (I haven't tested that so not 100% positive it will work). Deploy Dex from official chart. Then configure Argo CD to use oidc config with your custom client id & secret in HA Dex instead of dex.config. In theory this could also work if you require HA setup.

[cdobbyn]

Yeah, that was the next step to try. Not this sprint though 😄.

[mkilchhofer]

I also disabled dex in our (@swisspost) enterprise env and my homelab.
At work we use OIDC directly with an enterprise product. In my homelab I use a central dex server for all my apps with persistence into Kubernetes so it'd be possible to run dex HA, bit as its only me using it, I still set replicas to 1😅🙈