Cannot register AKS (Azure K8S Service) cluster using workload-identity

[sani-vv]

I have 2 AKS cluster running in 2 different Azure subscriptions. I have installed ArgoCD on one AKS cluster and use it to deploy an application to another AKS cluster.

But when I try to register AKS cluster using workload identity as mentioned in this documentation, I get the following error -
"Unhandled Error" err="couldn't get current server API group list: the server has asked for the client to provide credentials"

ArgoCD version information that I am currently using -

argocd: v2.10.1+a79e0ea.dirty
argocd-server: v2.14.10+5feb8c2

ArgoCD helm chart version information that I am currently using -
argo-cd: 7.8.26

I have configured the workload identity at Microsoft Entra ID side. I have also created federated credentials for argocd-server and argocd-application-controller ServiceAccount.

I have added RBAC role assignments for this workload identity to the target AKS cluster (which I want to register to ArgoCD).

For the safe side, I have also role assignment to the resource-group which will be created by AKS service. The one that starts with MC_ (if you kept the default settings, while creating the AKS cluster).

I have added a label to the pods and added the annotations to the service-accounts as mentioned in the documentation. For example purpose I have just provided the screenshots of argocd-application-controller pod and service-account but the same exists for argocd-server pod and service-account.

Finally, I have created K8S secret to register AKS cluster with ArgoCD.

I am completely lost on what is missing or what is going wrong with this setup. Therefore, any help would be appreciated 🙏

[yu-croco]

Hi @sani-vv You want to ask in upstream since it's about Argo CD's feature?
argo-helm focuses on providing Helm Chart but we don't handle the detail of Applications.

[sani-vv]

Sure, thanks.

[ibiernacki]

Hi,

I had the same issue;

What worked for me was to set up Microsoft Entra ID authentication with Azure RBAC in Security section (of target AKS cluster)

[sani-vv]

@ibiernacki Thanks for the suggestion. This has worked for me.