-dex-workaround.yaml

# Workaround for https://github.com/argoproj/argo-workflows/issues/7039
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: dex-proxy
data:
  default.conf: |
    server {
      listen 0.0.0.0:8080;
      location /.well-known/openid-configuration {
        default_type application/json;
        return 200 '{"issuer":"http://dex-proxy","authorization_endpoint":"https://dex.example.com/auth","token_endpoint":"http://dex-proxy/token","jwks_uri":"http://dex-proxy/keys","device_authorization_endpoint":"http://dex-proxy/device/code","grant_types_supported":["authorization_code","refresh_token","urn:ietf:params:oauth:grant-type:device_code"],"response_types_supported":["code"],"subject_types_supported":["public"],"id_token_signing_alg_values_supported":["RS256"],"code_challenge_methods_supported":["S256","plain"],"scopes_supported":["openid","email","groups","profile","offline_access"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post"],"claims_supported":["iss","sub","aud","iat","exp","email","email_verified","locale","name","preferred_username","at_hash"]}';
      }
      location / {
        resolver kube-dns.kube-system.svc.cluster.local valid=10s;
        set $backend "http://dex.dex-namespace.svc.cluster.local.:5556";
        proxy_pass $backend;
      }
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dex-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: dex-proxy
  template:
    metadata:
      labels:
        app: dex-proxy
    spec:
      containers:
      - name: nginx
        image: nginxinc/nginx-unprivileged:1
        ports:
        - containerPort: 8080
        volumeMounts:
        - name: nginx-conf
          mountPath: /etc/nginx/conf.d/
      volumes:
      - name: nginx-conf
        configMap:
          name: dex-proxy
---
apiVersion: v1
kind: Service
metadata:
  name: dex-proxy
spec:
  ports:
  - port: 80
    targetPort: 8080
  selector:
    app: dex-proxy