Error: get client from config: seems like you are not logged in; please use kargo login to authenticate

[creeram]

I have disabled admin user and enabled oidc login for kargo, but wheh i use kargo cli with kubeconfig it says Error: get client from config: seems like you are not logged in; please use kargo login to authenticate. But when i use kubeconfig with oidc enabled it works but not for a kubeconfig without oidc which has admin access? how can i make it work?

command uses: kargo login https://kargo.example.com --kubeconfig --insecure-skip-tls-verify i doesnot throw any error.

but when i use kargo get freight --project=kargo-demo it throws the above Error: get client from config: seems like you are not logged in.

[krancour]

The option of logging in with OIDC or with your kubeconfig are two separate things. Which is it that you want to do?

[krancour]

It is possible your kubeconfig doesn't contain a usable token. Some k8s distributions, especially ones that run locally, like kind and k3d, to name a couple, use certificates for authentication instead. Do you happen to be using one of those? Most k8s distributions from public cloud providers, do use a token, however.

i want kubeconfig so that i can use it with ci/cd pipelines.

Unrelated to the issue of authentication, I'd be interested in hearing what exactly you're trying to do. Kargo has been built around an idea that CI tools are terrible at filling in the gaps in existing CD tools and something more firmly rooted in the CD space and gitops principles was needed to fill that gap. Using it with "CI/CD" pipelines was never our intention. Our intention is that CI and CD be treated as two separate areas of concern and that Kargo implements your CD pipelines.

https://www.youtube.com/watch?v=0B_JODxyK0w

[creeram]

It's a ovh cloud managed k8s cluster, the idea is to run kargo cli from GitHub action which promotes a specific version in kargo stages. Which is triggered every night 12 am.

[krancour]

I'm not familiar with OVH's k8s distro. You'll need to look at your kubeconfig yourself to see if it's using a token or a cert.

[creeram]

it's using certificates in kubeconfig file, i will try generating token based kubeconfig and let you know what happens next.

[creeram]

@krancour With the token-based kubeconfig, it's working. Thanks for the details.
Also, I didn't find information about this token-based kubeconfig in your documentation. It would be helpful to add this info to the documentation.

For others who face the same issue, I followed the documentation below.
https://kb.leaseweb.com/kb/users-roles-and-permissions-on-kubernetes-rbac/kubernetes-users-roles-and-permissions-on-kubernetes-rbac-create-a-token-based-kubeconfig/

[anttijman]

Hey @creeram I am trying to accomplish something similar to you. Although we are using AKS & MI. We are trying to promote from github workflow with kargo cli if for example test automation succeeds.

I think our login works fine but we are getting this error:
Error: permission_denied: namespaces "<kargo-project>" is forbidden: get is not permitted on kargo get stage ... command.
That command is to get the freight from current stage and then use it with kargo promote command.

What I dont understand is why does it requires permissions to namespaces. What kind of permissions did you have to permit?

Here are the rules for the role that I am binding to the Managed Identity:

rules:
  - apiGroups:
      - kargo.akuity.io
    resources:
      - stages
    resourceNames:
      - dev
      - test
      - stage
    verbs:
      - promote
      - get

[creeram]

@anttijman I'm using the cluster-admin cluster role for the kubeconfig.

[anttijman]

Thanks for the info, it helps.