ArgoCD集成JumpCloud SSO出现周期性登录重定向循环问题求助

我在使用ArgoCD与JumpCloud实现SSO单点登录时，系统会周期性出现异常：点击登录按钮后重定向回登录页、抛出404错误或陷入无限重定向循环。该问题为间歇性，有时删除Cookie、清空浏览器缓存、重启或删除argocd-server Pod能临时解决，但并非每次有效。

配置文件详情 #

charts/argocd/values.yaml #

environment: ""
argo-cd:
  redis-ha:
    enabled: true

  controller:
    replicas: 1
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
        namespace: kube-system
        additionalLabels:
          release: kube-prometheus-stack
    nodeSelector:
      eks.amazonaws.com/capacityType: ON_DEMAND
    args:
      appResyncPeriod: 20
    resources:
      requests:
        cpu: 1000m
        memory: 768Mi

  server:
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
        namespace: kube-system
        additionalLabels:
          release: kube-prometheus-stack
    nodeSelector:
      eks.amazonaws.com/capacityType: ON_DEMAND
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
    rbacConfigCreate: false
    config:
      dex.config: |
        connectors:
          - type: ldap
            name: jumpcloud.com
            id: ad
            config:
              # Ldap server address
              host: ldap.jumpcloud.com:636
              insecureNoSSL: false
              insecureSkipVerify: true
              # Variable name stores ldap bindDN in argocd-secret
              bindDN: "uid=dexservice,ou=Users,o=myorganizationid,dc=jumpcloud,dc=com"
              # Variable name stores ldap bind password in argocd-secret
              bindPW: "mysecurepassword"
              usernamePrompt: Jumpcloud Username
              userSearch:
                baseDN: ou=Users,o=myorganizationid,dc=jumpcloud,dc=com
                username: uid
                idAttr: entryDN
                emailAttr: mail
                nameAttr: cn
              groupSearch:
                baseDN: ou=Users,o=myorganizationid,dc=jumpcloud,dc=com
                filter: "(|(cn=K8S-Admin)(cn=K8S-ReadOnly))"
                userMatchers:
                - userAttr: entryDN
                  groupAttr: member
                nameAttr: cn
      repositories: |
        - url: git@github.com:myorgname/myreponame
          sshPrivateKeySecret:
            name: ssh-private-key-secret
            key: id_ed25519
    service:
      type: NodePort

  dex:
    nodeSelector:
      eks.amazonaws.com/capacityType: ON_DEMAND

  redis:
    nodeSelector:
      eks.amazonaws.com/capacityType: ON_DEMAND

  repoServer:
    replicas: 2
    nodeSelector:
      eks.amazonaws.com/capacityType: ON_DEMAND

  applicationSet:
    replicaCount: 2

  configs:
    params:
      server.insecure: true

charts/argocd/templates/argocd-rbac-cm.yaml #

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  labels:
    helm.sh/chart: {{ (index .Chart.Dependencies 0).Version }}
    app.kubernetes.io/component: server
    app.kubernetes.io/instance: argocd
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: argocd-rbac-cm
    app.kubernetes.io/part-of: argocd
    argocd.argoproj.io/instance: argocd
data:
  policy.default: role:none
  scopes: '[groups, email]'
  policy.csv: |
    p, role:none, *, *, */*, deny
    g, K8S-Admin, role:admin
    g, K8S-ReadOnly, "role:admin"

charts/argocd/templates/ingress.yaml #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ .Chart.Name }}
  annotations:
    "kubernetes.io/ingress.class": "alb"
    alb.ingress.kubernetes.io/group.name: {{ .Values.environment }}
    "alb.ingress.kubernetes.io/scheme": "internal"
    "alb.ingress.kubernetes.io/target-type": "instance"
    "alb.ingress.kubernetes.io/listen-ports": '[{ "HTTP":80 },{ "HTTPS":443 }]'
    "alb.ingress.kubernetes.io/backend-protocol": HTTP
    "alb.ingress.kubernetes.io/healthcheck-path": "/"
    "alb.ingress.kubernetes.io/actions.ssl-redirect": '{ "Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301" } }'
    "external-dns.alpha.kubernetes.io/hostname": argocd.{{ .Values.hostName }}
spec:
  rules:
    - host: argocd.{{ .Values.hostName }}
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: ssl-redirect
                port:
                  name: use-annotation
          - path: /
            pathType: Prefix
            backend:
              service:
                name: argocd-server
                port:
                  number: 80

排查与修复建议 #

1. 修复Ingress路由与SSL配置冲突 #

当前Ingress两条路径都匹配/前缀，会导致请求路由混乱，且ArgoCD Server以HTTP模式运行但前端通过HTTPS访问，引发Cookie属性不匹配。

• 将Ingress的alb.ingress.kubernetes.io/backend-protocol改为HTTPS
• 在values.yaml的server.config中添加外部URL配置：

  url: https://argocd.{{ .Values.hostName }}
  

• 调整Ingress路径规则，确保SSL重定向仅作用于HTTP请求，避免重复匹配：

  paths:
    - path: /
      pathType: Prefix
      backend:
        service:
          name: ssl-redirect
          port:
            name: use-annotation
      # 添加条件匹配HTTP请求
    - path: /
      pathType: Prefix
      backend:
        service:
          name: argocd-server
          port:
            number: 443
  

2. 配置Dex使用Redis存储会话 #

启用了redis-ha但Dex默认用内存存储，多实例下会导致会话不一致，引发间歇性登录失败。在values.yaml的dex.config中添加Redis配置：

storage:
  type: redis
  config:
    host: argocd-redis-ha-haproxy:6379

3. 调整ArgoCD Server资源限制 #

当前argocd-server CPU请求仅50m，内存128Mi，资源不足会导致请求超时，触发重定向异常。调高资源配置：

resources:
  requests:
    cpu: 200m
    memory: 256Mi
  limits:
    cpu: 500m
    memory: 512Mi

4. 修正Cookie安全属性 #

前端通过HTTPS访问时，需确保Cookie开启Secure属性，避免浏览器拒绝存储。在values.yaml的configs.params中添加：

server.cookie.secret: <用openssl rand -hex 32生成的密钥>
server.cookie.secure: true

生成的密钥需存储在argocd-secret中。

5. 验证RBAC组匹配逻辑 #

检查JumpCloud中用户组的member属性是否正确包含用户的entryDN，确保Dex返回的组信息能被ArgoCD正确识别，避免因权限不足触发登录重定向。

内容的提问来源于stack exchange，提问作者williamcodes