Azure Devops kubernetes service connection for "kubeconfig" option does not appear to work against an AAD openidconnect integrated AKS cluster

Question

When using the "kubeconfig" option I get the error when I click on "verify connection"

Error: TFS.WebApi.Exception: No user credentials found for cluster in KubeConfig content. Make sure that the credentials exist and try again.

The kubeconfig I pasted in, and selected the correct context from, is a direct copy paste of what is in my ~/.kube./config file and this works fine w/ kubectl

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: xxxxx
    server: https://aks-my-stage-cluster-xxxxx.hcp.eastus.azmk8s.io:443
  name: aks-my-stage-cluster-xxxxx
contexts:
- context:
    cluster: aks-my-stage-cluster-xxxxx
    user: clusterUser_aks-my-stage-cluster-xxxxx_aks-my-stage-cluster-xxxxx
  name: aks-my-stage-cluster-xxxxx
current-context: aks-my-stage-cluster-xxxxx
kind: Config
preferences: {}
users:
- name: clusterUser_aks-my-stage-cluster-xxxxx_aks-my-stage-cluster-xxxxx
  user:
    auth-provider:
      config:
        access-token: xxxxx.xxx.xx-xx-xx-xx-xx
        apiserver-id: xxxx
        client-id: xxxxx
        environment: AzurePublicCloud
        expires-in: "3599"
        expires-on: "1572377338"
        refresh-token: xxxx
        tenant-id: xxxxx
      name: azure

Answer 1

Azure DevOps has an option to save the service connection without verification:

Even though the verification fails when editing the service connection, pipelines that use the service connection do work in my case.

---

Depending on the pasted KubeConfig you might encounter a 2nd problem where the Azure DevOps GUI for the service connection doesn't save or close, but also doesn't give you any error message. By inspecting the network traffic in e.g. Firefox' developer tools, I found out that the problem was the KubeConfig value being too long. Only ~ 20.000 characters are allowed. After removing irrelevant entries from the config, it worked.

---

PS: Another workaround is to run kubelogin in a script step in your pipeline.

Answer 2

You can try run below command to get the KubeConfig. And then copy the content of ~/.kube/config file the service connection to try again.

az aks get-credentials --resource-group myResourceGroup --name myAKSCluster

After run above command and copy the config from the ~/.kube/config on my local machine. i successfully add my kubernetes connection using kubeconfig option

You can also refer to the steps here.