Error when creating JWT token for ArgoCD projects

[JimFran]

Hello team,

I am getting this error when creating a JWT token for ArgoCD projects roles:

It seems that I cannot create the token using the CLI.

Also, I have few questions reagarding projects as it's quite new concept to me. Not sure If I am using the concept of projects correctly in my deployment. Basically I am testing with clusterResourceBlackList and roles.

I am trying to use projects in my deployment file using argocd helm.

This is my override_values.yml file for ArgoCD Helm deployment. This file create the project and use an applicationset to deploy othr applications in different namespaces (the only solution I found to deploy apps in different namespaces). I want those applications belongs to the same project "argocd"

override_values.yml

## ArgoCD configuration
## Ref: https://github.com/argoproj/argo-cd
##
## Server
server:

##  extraArgs:
##    - --rootpath=/argocd

  ## ArgoCD config
  ## reference https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/argocd-cm.yaml
  configEnabled: true

  config:
    url: https://xxx
    application.instanceLabelKey: argocd.argoproj.io/instance

    repositories: |
      - type: git
        url: https://xxx
      - name: argo-helm
        type: helm
        url: https://argoproj.github.io/argo-helm
    
    oidc.config: |
      name: Azure
      issuer: https://xxx
      clientID: xxx
      clientSecret: $oidc.azuread.clientSecret
      requestedIDTokenClaims:
        groups:
          essential: true
      requestedScopes:
        - openid
        - profile
        - email

  additionalApplications: 

    - name: argocd
      namespace: argocd
      destination:
        namespace: argocd
        server: https://kubernetes.default.svc
      project: argocd
      source:
        helm:
          version: v3
          valueFiles:
          - values.yaml
          - ../override_values.yml
        path: argocd/argocd/argocd-helm
        repoURL: https://xxx
        targetRevision: HEAD
      syncPolicy:
        syncOptions:
        - CreateNamespace=true

    - name: ld-apps
      namespace: argocd
      destination:
        namespace: argocd
        server: https://kubernetes.default.svc
      project: argocd
      source:
        path: argocd/applicationfiles/applicationset
        repoURL: https://xxxs
        targetRevision: HEAD
        directory:
          recurse: true
          jsonnet: {}
      syncPolicy:
        automated:
          selfHeal: true
          prune: true
    
    - name: argocd-appprojects
      namespace: argocd
      destination:
        namespace: argocd
        server: https://kubernetes.default.svc
      project: argocd
      source:
        path: argocd/applicationfiles/projects
        repoURL: https:/xxx
        targetRevision: HEAD
        directory:
          recurse: true
          jsonnet: {}
      syncPolicy:
        automated:
          selfHeal: true
          prune: true

  additionalProjects: 
  - name: argocd
    namespace: argocd
    additionalLabels: {}
    additionalAnnotations: {}
    description: Argocd Project
    sourceRepos:
    - '*'
    destinations:
    - namespace: argocd
      server: https://kubernetes.default.svc
    clusterResourceWhitelist:
    - group: '*'
      kind: '*'
    orphanedResources:
      warn: false      

  rbacConfig:
    policy.csv: |
      g, "xxx", role:admin
      g, "xxx", role:admin
      g, "xxx", role:admin
      g, "xxx", role:admin
    policy.default: role:readonly
    
configs:
  credentialTemplates:
    https-creds:
      url: https://xxx/xxx/xxx/xxx
      username: xx
      password: xxx

This is the applicationset.yml file:

  name: aks-ld-apps
spec:
  generators:
  - git:
      repoURL: https://xxx
      revision: HEAD
      directories:
      - path: argocd/applications/*
  template:
    metadata:
      name: '{{path.basename}}'
    spec:
      project: argocd
      source:
        repoURL: https://xxx
        targetRevision: HEAD
        path: '{{path}}'
      destination:
        server: https://kubernetes.default.svc
        namespace: '{{path.basename}}'

This application set calls other applications inside the path "argocd/applications/". One of them is sonarqube:

sonarqube.yml

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: sonarqube
  namespace: argocd
spec:
  destination:
    namespace: sonarqube
    server: https://kubernetes.default.svc
  project: argocd
  source:
    path: argocd/applications/sonarqube
    repoURL: https://xxx
    targetRevision: HEAD
  syncPolicy:
    syncOptions:
    - CreateNamespace=true
    automated:
      selfHeal: true
      prune: true

Also this is the projects.yml file to create the project itself:

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: ld-projects
  namespace: argocd
spec:
  clusterResourceBlacklist:
  - group: '*0xxx-zzz'
    kind: 'allow-namespace-resource'
  destinations:
  - namespace: sonarqube
    server: https://kubernetes.default.svc
  orphanedResources:
    warn: false
  sourceRepos:
  - '*'

1- Am I using correctly the clusterResourceBlacklist to deny access to the resources via argocd to the group 0xxx-zzz

2- How I should use roles for more fine grant access to the resources in argocd?

3- what is exactly the difference between metadata.namespace and destination.namespace when defining a project?

My deployment file looks fine?

[alexmt]

hello @JimFran ,

The argocd CLI needs to know the Argo CD address. You can either login using argocd login <hostname> or argocd login --core if you have direct k8s access

[JimFran]

hello @JimFran ,

The argocd CLI needs to know the Argo CD address. You can either login using argocd login <hostname> or argocd login --core if you have direct k8s access

Thanks for your answer @alexmt

I am still having issues

argocd login --core 
Context 'kubernetes' updated

argocd proj role create-token argocd read-only
time="2021-12-17T11:13:40+01:00" level=fatal msg="configmap \"argocd-cm\" not found"

Any idea about that?

[pasha-codefresh]

hi @JimFran , i think you have similar issue with #7986

Please double check that your context use argocd namespace as default

[pasha-codefresh]

i think it is also related
https://github.com/argoproj/argo-cd/pull/8030/files