From dac7f16f04a3c3b7695bd475eb5c7b325d1a1eaf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Moritz=20J=C3=B6rg?= <moritz.jorg@oceanbox.io>
Date: Mon, 13 Jul 2026 09:29:28 +0200
Subject: [PATCH] argocd: Pass dex env correctly

---
 values/argo/env.yaml.gotmpl           |  1 +
 values/argo/values/argocd.yaml.gotmpl | 29 ++++++++-------------------
 2 files changed, 9 insertions(+), 21 deletions(-)

diff --git a/values/argo/env.yaml.gotmpl b/values/argo/env.yaml.gotmpl
index a57991be..e482afaa 100644
--- a/values/argo/env.yaml.gotmpl
+++ b/values/argo/env.yaml.gotmpl
@@ -27,5 +27,6 @@ argocd:
     image: "git.oceanbox.io/platform/manifests/helmfile-cmp:latest"
     imagePullSecrets:
       - gitlab-pull-secret
+  webhookSecret: ""
   additional_rbac_settings:
   - g, "eb17a659-4ce6-41bc-9153-d9b117c44479", role:org-admin
diff --git a/values/argo/values/argocd.yaml.gotmpl b/values/argo/values/argocd.yaml.gotmpl
index cc7d316e..353d97ea 100644
--- a/values/argo/values/argocd.yaml.gotmpl
+++ b/values/argo/values/argocd.yaml.gotmpl
@@ -49,8 +49,8 @@ configs:
         name: {{ .name }}
         config:
           issuer: https://login.microsoftonline.com/{{ .tenant }}/v2.0
-          clientID: ${{ .name | replace "-" "_" }}_client_id
-          clientSecret: ${{ .name | replace "-" "_" }}_client_secret
+          clientID: ${{ .secret_ref.name }}:client_id
+          clientSecret: ${{ .secret_ref.name }}:client_secret
           insecureSkipEmailVerified: true
           requestedIDTokenClaims:
             groups:
@@ -62,7 +62,7 @@ configs:
             - email
             - groups
       staticClients:
-      - id: ${{ .name | replace "-" "_" }}_client_id
+      - id: ${{ .secret_ref.name }}:client_id
         name: Kubernetes
         # These are kubectl oidc plugin internal URLs
         redirectURIs:
@@ -99,6 +99,11 @@ configs:
     argo-helm:
       type: helm
       url: https://argoproj.github.io/argo-helm
+  {{- if .Values.argocd.webhookSecret }}
+  secret:
+    extra:
+      webhook.gitea.secret: {{ .Values.argocd.webhookSecret }}
+  {{- end }}
   # UI changes based on env
   styles: |
     /* blue, orange, red depending on env */
@@ -129,29 +134,11 @@ controller:
       cpu: {{ .Values.argocd.resources.controller.cpu  | default "250m" }}
       memory: {{ .Values.argocd.resources.controller.memory  | default "1000Mi" }}
 
-# Mount azure ca as file for SAML auth
 dex:
   metrics:
     enabled: true
     serviceMonitor:
       enabled: true
-  {{- with .Values.clusterConfig.oidc }}
-  env:
-  {{- range . }}
-  {{- if eq .group "devel" }}
-  - name: {{ .name | replace "-" "_" }}_client_secret
-    valueFrom:
-      secretKeyRef:
-        name: {{ .secret_ref.name }}
-        key: client_secret
-  - name: {{ .name | replace "-" "_" }}_client_id
-    valueFrom:
-      secretKeyRef:
-        name: {{ .secret_ref.name }}
-        key: client_id
-  {{- end }}
-  {{- end }}
-  {{- end }}
 
 redis:
   metrics: