CODEWITHSUNDEEP
azure-devopsazure-aks
bitsofinfo
bitsofinfo

Reputation: 1054

Azure Devops kubernetes service connection for "kubeconfig" option does not appear to work against an AAD openidconnect integrated AKS cluster

When using the "kubeconfig" option I get the error when I click on "verify connection"

Error: TFS.WebApi.Exception: No user credentials found for cluster in KubeConfig content. Make sure that the credentials exist and try again.

The kubeconfig I pasted in, and selected the correct context from, is a direct copy paste of what is in my ~/.kube./config file and this works fine w/ kubectl

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: xxxxx
    server: https://aks-my-stage-cluster-xxxxx.hcp.eastus.azmk8s.io:443
  name: aks-my-stage-cluster-xxxxx
contexts:
- context:
    cluster: aks-my-stage-cluster-xxxxx
    user: clusterUser_aks-my-stage-cluster-xxxxx_aks-my-stage-cluster-xxxxx
  name: aks-my-stage-cluster-xxxxx
current-context: aks-my-stage-cluster-xxxxx
kind: Config
preferences: {}
users:
- name: clusterUser_aks-my-stage-cluster-xxxxx_aks-my-stage-cluster-xxxxx
  user:
    auth-provider:
      config:
        access-token: xxxxx.xxx.xx-xx-xx-xx-xx
        apiserver-id: xxxx
        client-id: xxxxx
        environment: AzurePublicCloud
        expires-in: "3599"
        expires-on: "1572377338"
        refresh-token: xxxx
        tenant-id: xxxxx
      name: azure

Upvotes: 3

Views: 12744

Answers (3)

Vadym Mykolaichuk
Vadym Mykolaichuk

Reputation: 1

It seems like it's not enough just to use converted with kubelogin kubeconfig. This plugin is required for kubectl to make a test connection and probably it's not used in the Azure DevOps service connection configuration.

As a workaround that can work for self-hosted build agent, you can install kubectl, kubelogin and whatever software you need to work with your AKS cluster and use shell scripts like:

export KUBECONFIG=~/.kube/config
kubectl apply -f deployment.yaml

Upvotes: 0

gebi
gebi

Reputation: 763

Azure DevOps has an option to save the service connection without verification:

enter image description here

Even though the verification fails when editing the service connection, pipelines that use the service connection do work in my case.

Depending on the pasted KubeConfig you might encounter a 2nd problem where the Azure DevOps GUI for the service connection doesn't save or close, but also doesn't give you any error message. By inspecting the network traffic in e.g. Firefox' developer tools, I found out that the problem was the KubeConfig value being too long. Only ~ 20.000 characters are allowed. After removing irrelevant entries from the config, it worked.

PS: Another workaround is to run kubelogin in a script step in your pipeline.

Upvotes: 0

Levi Lu-MSFT
Levi Lu-MSFT

Reputation: 30353

You can try run below command to get the KubeConfig. And then copy the content of ~/.kube/config file the service connection to try again. 

az aks get-credentials --resource-group myResourceGroup --name myAKSCluster

After run above command and copy the config from the ~/.kube/config on my local machine. i successfully add my kubernetes connection using kubeconfig option

You can also refer to the steps here.

Upvotes: -1

Related Questions