ArgoCD Behind Traefik: Fixing the HTTPS Redirect Loop

While setting up a hobby k3s cluster with Traefik as the ingress controller and cert-manager for automatic TLS certificates, I hit an HTTPS redirect loop with ArgoCD. The browser would spin forever and eventually show a “too many redirects” error. Here is what caused it and how to fix it.

What Is Happening

When you expose ArgoCD through a Traefik ingress with TLS termination, the traffic flow looks like this:

Browser --[HTTPS]--> Traefik --[HTTP]--> ArgoCD

Traefik handles the TLS certificate (issued by cert-manager), decrypts the connection, and forwards the request to ArgoCD over plain HTTP on port 8080. This is called TLS termination at the ingress layer.

The problem is ArgoCD’s default behavior. By default, ArgoCD redirects any incoming HTTP request to HTTPS. It sees the plain HTTP request from Traefik and responds with a 302 redirect to https://argocd.example.com. Traefik receives that redirect, the browser follows it back through Traefik, and the loop starts over.

The Fix

The fix is to tell ArgoCD to stop enforcing HTTPS itself. Since the ingress is already handling TLS, ArgoCD does not need to worry about it.

Add the --insecure flag to the argocd-server deployment:

# In your argocd-server deployment spec
containers:
- name: argocd-server
  command:
  - argocd-server
  - --insecure

Or if you are using the ArgoCD configmap:

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cmd-params-cm
  namespace: argocd
data:
  server.insecure: "true"

After applying this change, ArgoCD serves requests over HTTP without redirecting to HTTPS. Traefik handles the secure connection from the browser, and internally everything communicates over HTTP. The traffic between Traefik and ArgoCD is within the cluster, so this is fine.

Traefik Ingress Configuration

For completeness, here is the Traefik ingress configuration that works with this setup:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-ingress
  namespace: argocd
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
spec:
  rules:
  - host: argocd.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: argocd-server
            port:
              number: 80
  tls:
  - hosts:
    - argocd.example.com
    secretName: argocd-tls

The key parts: router.entrypoints: websecure routes HTTPS traffic through Traefik, and router.tls: "true" enables TLS termination at the ingress. The backend port is 80 (HTTP) because Traefik is forwarding plain HTTP to ArgoCD.

Why the Loop Is Easy to Miss

The redirect loop is not obvious because ArgoCD’s behavior is correct in isolation. If you are running ArgoCD without an ingress, you want it to enforce HTTPS. The issue only appears when you add TLS termination at the ingress layer and forget to adjust ArgoCD accordingly.

The general principle applies beyond ArgoCD: any application that enforces its own HTTPS redirect will cause this loop when placed behind a TLS-terminating proxy. The fix is always the same: disable HTTPS enforcement at the application level and let the proxy handle it.