Skip to content

Conversation

@kwentine
Copy link
Contributor

@kwentine kwentine commented Jan 3, 2026

The --tls-server-name flag is documented, but no longer used.

Remove all remaining references:

$ find docs/ -name '*.md' -execdir sed -i /--tls-server-name/d {} +
$ git grep tls-server-name || echo No matches
No matches

@kwentine kwentine requested review from a team as code owners January 3, 2026 16:30
@bunnyshell
Copy link

bunnyshell bot commented Jan 3, 2026

❌ Preview Environment deleted from Bunnyshell

Available commands (reply to this comment):

  • 🚀 /bns:deploy to deploy the environment

@kwentine
Copy link
Contributor Author

kwentine commented Jan 3, 2026

I apologize for being a bit candid, I should have suspected that these snippets were generated. However, I cannot understand whence the --tls-server-name comes 🤔

Copy link
Member

@choejwoo choejwoo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As you suspected, those flags are generated. --tls-server-name comes from Kubernetes client-go (clientcmd)’s recommended kubeconfig override flags (not Argo CD itself), which is why it shows up in the generated command docs.

Here are a few references.

By the way, I’m not super familiar with the CLI plumbing here, but since this flag is a persistent/inherited kubeconfig override flag, how did you determine that it’s no longer used?

@kwentine
Copy link
Contributor Author

kwentine commented Jan 4, 2026

Thanks a lot for providing these references, from which I started to derive some basic understanding of the apparatus.

since this flag is a persistent/inherited kubeconfig override flag, how did you determine that it’s no longer used?

I tried to use it in the process of troubleshooting an inadequate SAN on a TLS certificate:

$ argocd app --tls-server-name=example.com list -o name
Error: unknown flag: --tls-server-name

Which got me intrigued so I went and git grep tls-server-name and found only documentation matches. "Surely that must be outdated" I concluded. And here I am on the verge of learning about CLI plumbing in Go 😄

So what's the next step to fix this? I noticed that argocd admin template does honor the flag, so I presume it amounts to understanding what the notification engine CLI does differently...

$ argocd admin notifications --tls-server-name=example.com template get 
failed to get api: Get "https://<URL>": tls: failed to verify certificate: x509: certificate is valid for ingress.local, not example.com

@choejwoo
Copy link
Member

choejwoo commented Jan 6, 2026

Thanks for the detailed analysis.
It looks like the Argo CD repo itself mainly consumes changes from the related/vendor components.
If the intent is to change the behavior of this flag, it probably needs to be investigated across the connected repositories (e.g. the notification engine CLI), rather than only within this repo.

@nitishfy
Copy link
Member

nitishfy commented Jan 6, 2026

Interesting. @choejwoo you're correct, these flags are coming fron client-go and not Argo CD. I think this might be happening based on here. I'll have to dig deeper to understand why it is happening. Meanwhile, i'll create an issue and bring this up in meeting.

@nitishfy
Copy link
Member

nitishfy commented Jan 6, 2026

#25875

@kwentine
Copy link
Contributor Author

kwentine commented Jan 6, 2026

@nitishfy keep me posted I'd be happy to work on a fix (if one is deemed necessary) with some guidance.

Copy link
Contributor

@todaywasawesome todaywasawesome left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Closing in favor of issue #25875 which should be a new PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants