Connection Issues with argo workflows and keycloak sso

[yorpetro]

Hello all,

I am trying to create an argo-workflow terraform configuration in my cluster. I have followed the documentations and the raw schema and every resource I could find but I am not able to connect the argo-workflow to my Keycloak.

What really happens is that after deploying my terraform files I get this message at start from my argo-wrokflow server:
SSO configuration clientId="{{argo-workflows-sso} client-id <nil>}

I am thinking is it really connecting to my client in Keycloak if says nill?

When go to the argo-workflow page I immediately see this error:
Failed to load version/info Error: {"code":16,"message":"token not valid. see https://argo-workflows.readthedocs.io/en/latest/faq/"}
and after logging in I see this Failed to load version/info Error: {"code":7,"message":"not allowed"}

After logging in I am getting 403 Unauthorized errors. I also get this JWE token in my Dev Tools cookies send as authorization:
"Bearer v2:eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIiwiemlwIjoiREVGIn0.uU_4KyrtQ8PH3UmTrlHCkA2ji4XI5vp0YM10fnr3lCE7NPfow-C4iscEDlAuRxCf_d4-_qA_PwkbZ-eFPfvfS-ydS18Zy9EoEAGuw-rDqKBVAyIzooY_w5-PoFGs8BzRv-WWtAYPOo8e5f80Y_W3jp8aBvWl62KosOnAA3DxSms_o97GnyomLj3ucfnUo0bTzx7Zphq0KYgFKkRCHtlQUXUgx_-YvL4s-Zqaw_ro4Qq9Od2JwGmXxbx4atch2MlcCN5KPml5bA1mhnhU0xUBD63vxtvYclM2dJHm-QPJOIItzqj4QMlXNZRLw8iJQ2w118AOECxeNxiRzyd0gMgFkA.5pAw-gUSVE04pWcS.3hUavju7CvIfy-fUAryqu7CTfw6w6uLwhW-6b-0VJua7FNCwk-Cpc86d3s8HdDmh2eYSWYokHE4U3tFWSRbfK1hE9snQn0lOtBbhB1R7jQpiWGHEAGEeDTi3SYLOu7YIGtSjENHZq7HOy5seLPkisK0_RJCSCVlRmaWw9sk3p54wOARp-mN6hA4HLLJspEDzZwmE6oqnRGJknw5UTmyKkdbxCF9HAAbzAQ_Aw-D-mR5nhfGyIafTuGWzBkuk4Bj-lw0AeuCTs-84Pb3TRqu7NIP4cU3VndA_EubVOf1w-P8l98VC92HzACY.pOFm-56erstUQnrr94kJzw"

When Keycloak is configured to send JWT keys and my argocd there works as expected with the same client settings.

My Keycloak setup is exactly as in the documentation in argo-cd as I read that the in this argo-workflow documentaion that the setup should be almost the same.

I am wondering also if my terraform setup for the rbac is correct *issuer, *redirectUrl and *postgres_host are set as they should I have removed for security reasons.

values = [
    <<EOF
server:
  authModes:
    - sso
  sso:
    enabled: true
    issuer: ....................
    clientId:
      name: argo-workflows-sso
      key: client-id
    clientSecret:
      name: argo-workflows-sso
      key: client-secret
    redirectUrl: ................
    scopes:
      - openid
      - profile
      - email
      - groups
  rbac:
    enabled: true
    policy.csv: |
      p, admin, *, *, *, allow
      g, AEP2, admin
    policy.default: role:readonly
    scopes:
      - groups
  ingress:
    enabled: true
    ingressClassName: "nginx"
    annotations:
      kubernetes.io/ingress.class: "nginx"
    hosts:
      - argo-workflows${var.dns_zone}
    paths:
      - /
    pathType: Prefix

controller:
  persistence:
    archive: true
    postgresql:
      host: ....................
      port: 5432
      database: argo_workflows
      tableName: argo_workflows
      userNameSecret:
        name: argo-workflows-db
        key: username
      passwordSecret:
        name: argo-workflows-db
        key: password
      sslMode: require
EOF
  ]

If you have any ideas how I should resolve this issue I would be very thankful.