Argo CLI login should not hang when HTTP/2 is disabled

[josemaia]

Checklist:

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug
When HTTP/2 is disabled, the argo CLI throws a warning message to use "--grpc-web" and returns the correct results, presumably via HTTP/1.1.

However, the -skip-test-tls command is also necessary for this to happen, as otherwise the TLS test times out.

To Reproduce

• Host Argo behind an Ingress without HTTP/2 enabled (e.g. f5 nginx IC with default settings)
• Do an argocd login command, verify it times out
• Do another argocd login command with --skip-test-tls, verify it prompts you for username & password and throws the warning to use grpc-web.

For more context, you can see this old issue discussion:

@sklarsa Does it work if you use --skip-test-tls --grpc-web ?

Originally posted by @alindeman in #9679

Relevant code section:

argo-cd/cmd/argocd/commands/login.go

Line 80 in 48f18e2

if !skipTestTLS {

Expected behavior
argocd login should "auto-recover" and throw a warning, like other commands do. if not possible, it should look the grpc-web flag and use that when doing this TLS test.

Version

argocd: v3.3.2
  BuildDate: 2026-02-22T14:08:34Z
  GitCommit: 8a3940d8db27928931f0a85ba7c636e54786bddc
  GitTreeState: clean
  GitTag: v3.3.2
  GoVersion: go1.26.0
  Compiler: gc
  Platform: darwin/arm64
{"level":"warning","msg":"Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web.","time":"2026-04-07T14:17:52+01:00"}
argocd-server: v3.3.5
  BuildDate: 2026-03-25T14:10:08Z
  GitCommit: b8b5ea61172f10e8701659aaa82ed383eef8578f
  GitTreeState: clean
  GitTag: v3.3.5
  GoVersion: go1.25.5
  Compiler: gc
  Platform: linux/amd64
  Kustomize Version: v5.8.1 2026-02-09T16:15:27Z
  Helm Version: v3.19.4+g7cfb6e4
  Kubectl Version: v0.34.0
  Jsonnet Version: v0.21.0

Logs

N/A

[Fixer38]

Hello! I'd love to take up this issue and work on a draft PR. Would it be possible to assign it to me?

[nitishfy]

@Fixer38 go ahead!

[Fixer38]

Hello, I've been able to properly reproduce the issue

Nginx Ingress config (using local cluster)

helm chart values.yaml with HTTP2 explicitely disabled

controller:
  service:
    externalTrafficPolicy: Local
    type: NodePort
  metrics:
    enabled: true
  serviceMonitor:
    enabled: true

  config:
    use-http2: "false"

Ingress config (TLS termination at the argocd-server although in my local cluster it doesn't matter)

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-server
  namespace: argocd
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: nginx
  rules:
    - host: argocd.local
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: argocd-server
                port:
                  name: https

ArgoCD login tests

With HTTP2 explicitely disabled on the nginx ingress config

argocd login argocd.local:8080                
{"level":"fatal","msg":"gRPC connection not ready: context deadline exceeded","time":"2026-04-09T21:45:51+02:00"}

Which verifies the behaviour reported with the timeout.

With only --skip-test-tls

argocd login argocd.local:8080 --skip-test-tls
{"level":"fatal","msg":"Failed to establish connection to argocd.local:8080: error creating connection: tls: first record does not look like a TLS handshake","time":"2026-04-09T21:46:12+02:00"}

I suppose that's due to my TLS config as I don't have a certificate currently but there is no timeout per say otherwise I wouldn't have this error message.

With only --grpc-web

argocd login argocd.local:8080 --grpc-web     
{"level":"fatal","msg":"gRPC connection not ready: context deadline exceeded","time":"2026-04-09T21:47:45+02:00"}

Which verifies the behaviour reported with the timeout.

With --skip-test-tls and --grpc-web

argocd login argocd.local:8080 --grpc-web --skip-test-tls
Username:

Properly prompts for the username with no timeout.

With HTTP2 explicitely enabled on the nginx ingress config

The HTTP2 is explicitely enabled by changing the use-http2 flag to "true" inside the values.yaml above.

argocd login argocd.local:8080
WARNING: server certificate had error: error creating connection: tls: failed to verify certificate: x509: certificate signed by unknown authority. Proceed insecurely (y/n)? yes
{"level":"warning","msg":"Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web.","time":"2026-04-09T21:49:48+02:00"}
Username:

Properly prompts for the username with no timeout.

I'll start working on a fix this week and hopefully have a draft PR ready soon.

[Fixer38]

I've now raised this PR.

Changes

• When --grpc-web is passed to the login command, no TLS test is performed as it'd fail anyway
• In the case no --grpc-web or --skip-tls-verify is passed to the login command, a TLS test is performed, in the case of failure linked to HTTP2 being disabled, we fall-back to using --grpc-web like other commands already do and continue the logging process and produce a warning.

Tests

With an HTTP2 disabled ingress

argocd login argocd.local:8080
# Waits a bit as we get the timeout from the TLS check failing
# fallsback properly with error message
{"level":"warning","msg":"Failed to test TLS for server argocd.local:8080: gRPC connection not ready: context deadline exceeded. Falling back to gRPC-web.","time":"2026-04-10T09:28:28+02:00"}
Username:

This is my first ever PR to Argo so please if there is any improvements or you have another idea for the implementation, I'm very open to the feedback.

Thanks in advance for reviewing it!