修改Argo CD UI重定向URL以解决外部访问失败问题

• 集群架构：Azure Kubernetes服务（AKS）+ Azure应用网关
• 外部访问域名：aks-tst.myurl.com
• 应用网关转发规则：将外部请求的主机头替换为内部域名aks-tst.intern.com，通过自签名证书转发至AKS集群
• 常规应用Ingress配置（Helm模板）：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ .Chart.Name }}
  namespace: {{ .Release.Namespace }}
spec:
  rules:
    - host: aks-tst.intern.com
      http:
        paths:
          - path: {{ .Values.ingress.path }}
            pathType: Prefix
            backend:
              service:
                name: {{ .Values.service.name }}
                port:
                  number: {{ .Values.service.port }}
  tls:
    - hosts:
        - aks-tst.intern.com

• Argo CD初始Helm values.yaml配置：

server:
  insecure: true
  ingress:
    enabled: true
    hosts:
      - aks-tst.intern.com
    paths:
      - /argocd
    tls:
      - hosts:
          - aks-tst.intern.com

• 生成的Argo CD实际Ingress配置：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  labels:
    app.kubernetes.io/component: server
    app.kubernetes.io/instance: argo-cd
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: argocd-server
    app.kubernetes.io/part-of: argocd
    app.kubernetes.io/version: v2.8.4
    argocd.argoproj.io/instance: argo-cd
    helm.sh/chart: argo-cd-5.46.7
  name: argo-cd-argocd-server
  namespace: argocd
spec:
  ingressClassName: traefik
  rules:
  - host: aks-tst.intern.com
    http:
      paths:
      - backend:
          service:
            name: argo-cd-argocd-server
            port:
              number: 80
        path: /argocd
        pathType: Prefix
  tls:
  - hosts:
    - aks-tst.intern.com
status:
  loadBalancer:
    ingress:
    - ip: <ip-of-traefik-loadbalancer>

其他应用的Ingress均可正常外部访问，但Argo CD UI无法正常使用。访问aks-tst.myurl.com/argocd时，浏览器收到307重定向响应，被导向无法从Azure外部访问的内部域名aks-tst.intern.com/argocd，需要配置Argo CD使其使用外部URL生成重定向。

配置ConfigMap argocd-cm #

修改Argo CD的Helm values.yaml添加外部URL配置（尝试过带/不带协议、带/不带路径的多种组合）：

configs:
  cm:
    url: https://aks-tst.myurl.com

生成的argocd-cm ConfigMap内容：

apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/component: server
    app.kubernetes.io/instance: argo-cd
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
    app.kubernetes.io/version: v2.8.4
    argocd.argoproj.io/instance: argo-cd
    helm.sh/chart: argo-cd-5.46.7
  name: argocd-cm
  namespace: argocd
data:
  admin.enabled: "true"
  application.instanceLabelKey: argocd.argoproj.io/instance
  exec.enabled: "false"
  server.rbac.log.enforce.enable: "false"
  timeout.hard.reconciliation: 0s
  timeout.reconciliation: 180s
  url: https://aks-tst.myurl.com

该配置未生效，随后手动修改argocd-server的Deployment，添加ConfigMap挂载并重启所有Pod：

...
spec:
  template:
    spec:
      containers:
      ...
      - args:
        ...
        volumeMounts:
        ...
        - mountPath: /etc/argo-cd/config/cm
          name: argocd-cm
      volumes:
      ...
      - configMap:
          defaultMode: 420
          name: argocd-cm
        name: argocd-cm

Pod日志显示配置已加载：

url modified. restarting
shutting down settings watch
Shut down requested
0xc000f810e0 unsubscribed from settings updates
rbac configmap informer cancelled
argocd v2.8.4+c279299 serving on port 8080 (url: https://aks-tst.myurl.com/argocd, tls: true, namespace: argocd, sso: false)"
Enabled application namespace patterns: argocd
0xc000bd9500 subscribed to settings updates
Starting rbac config informer
RBAC ConfigMap 'argocd-rbac-cm' added

完善argocd-cm配置 #

argocd-cm中的url必须包含完整的外部访问路径，同时指定rootpath匹配Ingress的路径：

configs:
  cm:
    url: https://aks-tst.myurl.com/argocd
    rootpath: /argocd

配置Argo CD Server信任代理头 #

由于请求经过应用网关和Traefik两层转发，需让Argo CD识别代理传递的真实请求头，避免使用内部主机头生成重定向。在Helm values.yaml的server段添加：

server:
  # 保留原有ingress配置
  ingress:
    enabled: true
    hosts:
      - aks-tst.intern.com
    paths:
      - /argocd
    tls:
      - hosts:
          - aks-tst.intern.com
  # 添加以下参数
  extraArgs:
    - --insecure
    - --rootpath=/argocd
    - --proxy-header=X-Forwarded-For,X-Forwarded-Proto,X-Forwarded-Host
  config:
    url: https://aks-tst.myurl.com/argocd

检查应用网关的头传递 #

确保Azure应用网关在转发请求时，将原始外部域名aks-tst.myurl.com通过X-Forwarded-Host头传递给AKS内部的Traefik。如果网关必须替换主机头为内部域名，需额外配置添加X-Forwarded-Host头。

重启服务 #

应用配置后重启Argo CD Server：

kubectl rollout restart deployment argocd-argocd-server -n argocd

验证 #

访问https://aks-tst.myurl.com/argocd，确认不再重定向到内部域名，可正常加载Argo CD UI。

内容的提问来源于stack exchange，提问作者giklo