Skip to content

Dex v2.45+ incompatible with hardcoded runAsNonRoot #2117

Description

@clementnero

Describe the bug

Dex v2.45.0+ fails to start when managed by argocd-operator due to runAsNonRoot verification failure. The operator hardcodes runAsNonRoot: true without setting runAsUser, but dex v2.45.0 (dexidp/dex#4517) changed from a numeric UID (USER 1001) to a named user (USER dex:dex). Kubernetes cannot verify runAsNonRoot for non-numeric users.

To Reproduce

  1. Deploy ArgoCD using argocd-operator v0.16.0
  2. Configure SSO with dex using version v2.45.0 or later:
    spec:
      sso:
        provider: dex
        dex:
          version: v2.45.0
  3. Observe the dex pod fails with CrashLoopBackOff

Error message:

Error: container has runAsNonRoot and image has non-numeric user (dex), cannot verify user is non-root

Expected behavior
The dex container should start successfully.

One potential fix is to add a SecurityContext field to ArgoCDDexSpec (similar to #2050), allowing users to configure runAsUser via the ArgoCD CR.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions