arogcd cluster add command reports error about argo-cd

[cringdahl]

When I auth to argocd with username/password, I don't get NOAUTH errors. When I auth to argocd with --core, I do get NOAUTH errors.

Something about the new redis auth is tied to argocd auth, which, when bypassed, causes redis to also not authenticate.

[par97]

What was your kube context at the moment you added the cluster? See

I was using the rdr-hub context and in the argocd namespace, that is why I still could run login --core and add another cluster.

Thanks for the slack info, I could also ask in the slack channel.

[agaudreault]

NOAUTH Authentication required seems to be a redis error. There was changes in the latest version of argocd to add basic authentication. A password should have been generated automatically in the argocd-redis secret by the argocd-redis-ha deployment init container. You can check if REDIS_PASSWORD is defined in your argocd-server deployment as a variable. Make sure you use at least version 7.1.1 of https://github.com/argoproj/argo-helm/tree/main/charts/argo-cd, or deployment manifests that will configure redis authentication.

[agaudreault]

What was your kube context at the moment you added the cluster? See

argo-cd/cmd/argocd/commands/cluster.go

Lines 53 to 54 in 2639c59

	# Add a target cluster configuration to ArgoCD. The context must exist in your kubectl config:
	argocd cluster add example-cluster

You might want to join the CNCF slack to ask usage questions in https://cloud-native.slack.com/archives/C01TSERG0KZ instead of bug reports. https://github.com/argoproj/argo-cd/discussions is also a good place if you don't have access to Slack.

[par97]

In the argocd-server pod definition, I see it has following:

  containers:
  - args:
    - /usr/local/bin/argocd-server
    env:
    - name: REDIS_PASSWORD
      valueFrom:
        secretKeyRef:
          key: auth
          name: argocd-redis

Secret argocd-redis exists in the argocd namespace, contains data/auth key and value.

Argocd cluster add command should atuo read this secret to access redis server, right?

[par97]

btw, argocd is deployed using:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

I followed document of https://argo-cd.readthedocs.io/en/stable/getting_started/

[agaudreault]

In the steps above, you login to Argo CD in core mode, but it seems like you installed the full manifest. I think if you remove the --core, it should work normally. But you might have found a problem with the CLI usage in core mode.

$ argocd login --core
Context 'kubernetes' updated

[leoluz]

btw, argocd is deployed using: kubectl create namespace argocd kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

I followed document of https://argo-cd.readthedocs.io/en/stable/getting_started/

@agaudreault is correct. If you installed all vended manifests (install.yaml), there is no reason for you to run the Argo CD CLI in core mode (--core). That is only required if you are just deploying the Argo CD controller without the API server.

[par97]

Today I created two new minikube clusters, and installed argocd core in the rdr-hub cluster, by using file of https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/core-install.yaml

I checked, this time in the argocd ns, I only have below pods:

$ kubectl get pod
NAME                                                READY   STATUS    RESTARTS   AGE
argocd-application-controller-0                     1/1     Running   0          19m
argocd-applicationset-controller-7dc76d94b4-8thzw   1/1     Running   0          19m
argocd-redis-545f8544bb-5sxrf                       1/1     Running   0          19m
argocd-repo-server-7c55f55c7-7vwk7                  1/1     Running   0          19m

After login --core and add the other cluster in, it reports the same issue.

$ argocd login --core
Context 'kubernetes' updated

$ argocd cluster add rdr-dr1
WARNING: This will create a service account `argocd-manager` on the cluster referenced by context `rdr-dr1` with full cluster level privileges. Do you want to continue [y/N]? y
INFO[0003] ServiceAccount "argocd-manager" created in namespace "kube-system"
INFO[0003] ClusterRole "argocd-manager-role" created
INFO[0003] ClusterRoleBinding "argocd-manager-role-binding" created
INFO[0008] Created bearer token secret for ServiceAccount "argocd-manager"
ERRO[0009] finished unary call with code Unknown         error="NOAUTH Authentication required." grpc.code=Unknown grpc.method=Create grpc.service=cluster.ClusterService grpc.start_time="2024-06-06T12:20:35+05:30" grpc.time_ms=206.557 span.kind=server system=grpc
FATA[0009] rpc error: code = Unknown desc = NOAUTH Authentication required.

$ argocd cluster list
SERVER                          NAME        VERSION  STATUS  MESSAGE  PROJECT
https://192.168.22.71:8443      rdr-dr1
https://kubernetes.default.svc  in-cluster

So this does look like a bug, even I only installed with core mode.

[NetanelK]

relates to #19035, and should be fixed by #19599.

When using --core flag, a local argocd server is being created without the Redis password, thus resulting in NOAUTH error