argo-cd: ERR_TOO_MANY_REDIRECTS

After searching for a while I found a solution that works in my case. I’m using Traefik instead of Nginx, but I believe this can be used with any ingress controller.

The problem is that by default Argo-CD handles TLS termination itself and always redirects HTTP requests to HTTPS. Combine that with an ingress controller that also handles TLS termination and always communicates with the backend service with HTTP and you get Argo-CD’s server always responding with a redirects to HTTPS.

So one of the solutions would be to disable HTTPS on Argo-CD, which you can do by using the --insecure flag on argocd-server.

This is actually documented here: https://argoproj.github.io/argo-cd/operator-manual/ingress/#option-2-multiple-ingress-objects-and-hosts Its just not exactly obvious.

It would be nice if there was a page with command line flags for the server somewhere in the docs.

Using NGINX ingress, send --insecure arg for container of argocd-server Deployment. It works for me.

spec:
  containers:
  - command:
    - argocd-server
    - --staticassets
    - /shared/app
    - --insecure

Help: https://argoproj.github.io/argo-cd/operator-manual/ingress/

Following configuration works without further modifications

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-server-http-ingress
  namespace: argocd
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  rules:
  - http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: argocd-server
            port: 
              name: https
    host: argocd.example.com
  tls:
  - hosts:
    - argocd.example.com
    secretName: argocd-secret

I encountered the same error and found that when installing ArgoCD, one can either add the --insecure flag (as written above) or you can update the ConfigMap to populate the environment variables used by argo-server (only the data object is new):

# [snip]
---
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/name: argocd-cmd-params-cm
    app.kubernetes.io/part-of: argocd
  name: argocd-cmd-params-cm
data:
  server.insecure: "true"
---
# [snip]

Unfortunately you can’t apply this after running the installer since it will have no effect on the already deployed service, and applying it before the install will have the install overwrite it.

– edit: While the install yaml file will overwrite this definition, you can put this in a separate file and apply it after the install yaml and then force a restart of the argocd-server deployment, like so:

1. Put the contents shown above in a file called e.g. argocd-config.yaml
2. kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
3. kubectl apply -n argocd -f argocd-config.yaml
4. kubectl scale -n argocd deployment/argocd-server --replicas=0 && kubectl scale -n argocd deployment/argocd-server --replicas=1

For my case, i have AWS ELB where the SSL is offloaded, then ingress controller receives on port 80, then forward to argocd-server service on insecure port (80).

I fixed the issue of too-many-redirects by implementing the above solution:

spec:
  containers:
  - command:
    - argocd-server
    - --staticassets
    - /shared/app
    - --insecure # <-- this thing needs to be added

Thank you @kszpakowski

Following configuration works without further modifications

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-server-http-ingress
  namespace: argocd
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  rules:
  - http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: argocd-server
            port: 
              name: https
    host: argocd.example.com
  tls:
  - hosts:
    - argocd.example.com
    secretName: argocd-secret

Beautiful, this worked for me too, the main lines:

nginx.ingress.kubernetes.io/backend-protocol: HTTPS name: https

I encountered the same error and found that when installing ArgoCD, one can either add the --insecure flag (as written above) or you can update the ConfigMap to populate the environment variables used by argo-server (only the data object is new):

# [snip]
---
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/name: argocd-cmd-params-cm
    app.kubernetes.io/part-of: argocd
  name: argocd-cmd-params-cm
data:
  server.insecure: "true"
---
# [snip]

Unfortunately you can’t apply this after running the installer since it will have no effect on the already deployed service, and applying it before the install will have the install overwrite it.

– edit: While the install yaml file will overwrite this definition, you can put this in a separate file and apply it after the install yaml and then force a restart of the argocd-server deployment, like so:

0. Put the contents shown above in a file called e.g. argocd-config.yaml

1. `kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml`

2. `kubectl apply -n argocd -f argocd-config.yaml`

3. `kubectl scale -n argocd deployment/argocd-server --replicas=0 && kubectl scale -n argocd deployment/argocd-server --replicas=1`

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-server-http-ingress
  namespace: argocd
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
spec:
  rules:
  - http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: argocd-server
            port: 
              name: http
    host: argocd.example.com
  tls:
  - hosts:
    - argocd.example.com
    secretName: argocd-secret
`
I have changed the above ingress setting. Now, no looping for me

Fixed via this

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    ingress.kubernetes.io/force-ssl-redirect: "true"
    ingress.kubernetes.io/ssl-redirect: "true"
    kubernetes.io/ingress.class: nginx

    # If you encounter a redirect loop or are getting a 307 response code 
    # then you need to force the nginx ingress to connect to the backend using HTTPS.
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # argocd backend using HTTPS

Nginx and other reverse proxies send the header X-Forwarded-Proto to indicate that TLS is being handled by the proxy. This could be checked in addition to checking the secure setting in the useSecure function. I have yet to venture into writing Go, so I am not sure of how that is done exactly. Maybe I will give it a shot.

Thanks for this, I wrote a little patch here and the IngressRoute CRD I use here. I wrote an article about all of this and more here.

I was struggling with this issue for ours, and finally found this thread.

@georgepaoli suggesiton worked. Adding --insecure fixed the issue. I suggest adding this to Argo’s Traefik docs while the issue persists.

Somehow I ran into the same issue with a 308 redirect. I added the --insecure arg but no change so far. Any ideas?

I believe the original issue was solved by @kszpakowski’s post #issuecomment-93219085. It’s also documented. Therefore I’m closing this issue.

Please open another issue or ping us on Slack if you are still experiencing issues.

I use passthrough mode in my Ingress, but I forget the annotation nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" and it resulted in nginx-ingress-controller generating proxy_pass http://upstream_balancer in the nginx.conf. After I added this annotation, the server stopped responsing 307.

Using Helm, I managed to set the --insecure flag using the following values (values.yaml)

server:
  ingress:
    enabled: "true"
    ingressClassName: "nginx"
configs:
  params:
    server.insecure: "true"

$ helm install argocd -n argocd argo/argo-cd -f values.yaml

Thank you @kszpakowski

Following configuration works without further modifications

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-server-http-ingress
  namespace: argocd
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  rules:
  - http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: argocd-server
            port: 
              name: https
    host: argocd.example.com
  tls:
  - hosts:
    - argocd.example.com
    secretName: argocd-secret

Beautiful, this worked for me too, the main lines:

nginx.ingress.kubernetes.io/backend-protocol: HTTPS name: https

its working thanks