Troubleshoot Platform Base

Rendering fails

Errors come from two places. The first is your jsonnet command, or the bootstrap Application when Argo CD renders cluster/main.jsonnet. Argo CD shows the message in the conditions of the Application. The second is the Application of a single component, which fails when it renders its own manifests.

Errors in the bootstrap render

Message contains	Cause and fix
baseDomains not set	Set baseDomains in your configuration.
observability.storage.enabled requires observability.storage.metrics.enabled	The storage role needs Mimir. Enable the option or turn the storage role off.
observability.storage.enabled requires observability.storage.logs.enabled	The storage role needs Loki. Enable the option or turn the storage role off.
argocd.configMaps: unknown ConfigMap(s)	Only argocd-cm, argocd-cmd-params-cm, argocd-rbac-cm and argocd-tls-certs-cm are supported.
observability.storage.backend.s3.endpoint not set	Set s3.endpoint when the backend type is s3.
observability.storage.backend.s3.accessKeyID not set	Set s3.accessKeyID when the backend type is s3.
neither secretRef.name nor value is set	A credential has neither. The message starts with the environment variable, for example LOKI_S3_SECRET_ACCESS_KEY or ALLOY_SMTP_AUTH_PASSWORD. Set one of them.
secretRef.key is not set	A secretRef has a name but no key. Add the key.
url not set	An external target is enabled without url. Set it.
argocd.configManagementPlugins.helmfile.config.image not set	Pin an image when you enable the plugin.
Field does not exist	You replaced an object with a plain field and dropped its defaults. Use +:, for example backend+: { ... }.

Errors in a component Application

Application	Message contains	Cause and fix
tls	solver not supported	With tls.issuer.type: 'acme', set acme.solver to route53, cloudflare, cloudDNS or webhook.
tls	type not supported	tls.issuer.type is selfSigned or acme.
iam	Unexpected type null	An identity provider most likely has no id. Set id and displayName on every provider.
argocd-config, argo-cd-core	must be strings	Values in argocd.configMaps.<name>.data must be strings. Use null to remove a key.
argo-cd-core	invalid plugin name(s)	A plugin name has to be a valid Kubernetes name: lowercase letters, digits and hyphens.
argo-cd-core	spec is required	An enabled Config Management Plugin has no spec.
argo-cd-core	config.image must be a non-empty image reference	An enabled Config Management Plugin has no config.image.

Warnings during rendering

Some configurations render, but print a warning on the standard error of the renderer. The messages contain:

Warning	Meaning
this Git credential (password/PAT or SSH private key)	Repository credentials are base64-encoded into a Secret manifest.
oidc.clientSecret.value is base64-encoded	The client secret of an identity provider is put into a Secret manifest. Prefer secretRef.
tls.issuer.acme.route53.secretAccessKey.value	The credential is put into a Secret manifest. The Cloudflare token and the CloudDNS key warn alike. Prefer secretRef.
argocd sso.clientSecret.value is inlined as PLAINTEXT	Leave argocd.sso.clientSecret unset to use the secret of the Keycloak operator.
configMaps.argocd-cm.data:	dex.config or oidc.config has no $<secret>:<key> reference.
server.insecure is not enabled	The Argo CD UI is unreachable through the ingress.
uses a mutable	The image of a Config Management Plugin has the tag :latest. Pin it.

Only the bootstrap Application appears

Argo CD cannot read your repository. On a private repository, enable argocd.platformRepoCreds when you render the bootstrap, see Install Platform Base. Run kubectl -n argocd describe application bootstrap for the exact error. Also check that revision exists and that pathPrefix is the directory of main.jsonnet.

Ingress is not reachable

• Check that the Traefik Service has an external address: kubectl -n traefik get service. Without a LoadBalancer implementation it stays pending.
• Check that the DNS records point to that address, see Requirements.
• Check that a single default IngressClass exists. The Ingresses of Platform Base do not name a class.
• A certificate warning is expected until you configure TLS.
• If only the Argo CD UI fails, check that server.insecure is TRUE in argocd-cmd-params-cm.

Applications take long to become healthy

There are no sync waves. An Application whose dependencies are not ready can fail a sync and is retried on the next reconciliation, about every three minutes. The end-to-end test allows each Application up to 20 minutes on a fresh cluster. See Architecture for the dependencies.

If Mimir or Loki pods stay Pending or are killed for lack of memory, the nodes are too small for the profile. Choose singleNode or add capacity, and raise the resources of one component through mimir.values or loki.values, for example mimir.values.ingester.resources.

Keycloak client creation fails on a fresh install

The admission webhooks of the EDP Keycloak operator use failurePolicy: Fail and need cert-manager. Creating a KeycloakClient fails until the webhook certificate is issued, and Argo CD retries until the cluster converges. See the EDP section of the upgrade notes.

Keycloak changes disappear

Keycloak does not persist its state. After a restart, the operators apply the configuration from Git again, and anything you changed in the Keycloak UI is lost. Make the change in your configuration instead, see Identity and access.

No pod logs in Grafana

Pod logs are only collected when you set observability.collector.logs.allPods to true, see Configure observability.

A removed ConfigMap key stays in the cluster

Platform Base applies the Argo CD ConfigMaps with server-side apply. Leaving a key out, or setting it to null, does not delete a key that already exists in the live ConfigMap. Set an explicit value to change it, see Customize Argo CD.