使用ArgoCD向GKE Fleet集群部署应用时获取K8s版本失败

背景 #

我计划通过一个集中式ArgoCD实例，将应用部署到GCP同一组织下不同项目的私有GKE集群中，已完成一系列配置操作，但在验证集群连接时遇到错误。

已执行的GCP配置命令 #

# 运行中央ArgoCD集群的项目
HOST_PROJECT="argocd-project"

# 运行受管外部集群的项目
FLEET_PROJECT="deploy-project"

# Fleet中集群的唯一名称
MEMBERSHIP_NAME="unique-membership-name"

# 启用connectgateway api
gcloud services enable connectgateway.googleapis.com --project=$FLEET_PROJECT

# 创建argocd fleet admin服务账号
gcloud iam service-accounts create argocd-fleet-admin --project $HOST_PROJECT

# 为两个工作负载添加iam策略绑定
gcloud iam service-accounts add-iam-policy-binding --role roles/iam.workloadIdentityUser --member "serviceAccount:${HOST_PROJECT}.svc.id.goog[argocd/argocd-server]" argocd-fleet-admin@$HOST_PROJECT.iam.gserviceaccount.com
gcloud iam service-accounts add-iam-policy-binding --role roles/iam.workloadIdentityUser --member "serviceAccount:${HOST_PROJECT}.svc.id.goog[argocd/argocd-application-controller]" argocd-fleet-admin@$HOST_PROJECT.iam.gserviceaccount.com

gcloud projects add-iam-policy-binding $HOST_PROJECT --member "serviceAccount:argocd-fleet-admin@${HOST_PROJECT}.iam.gserviceaccount.com" --role roles/gkehub.gatewayEditor

ArgoCD Helm Chart配置 #

configs:
  cm:
    url: "https://myurl-test.example.com"
controller:
  serviceAccount:
    annotations:
      "iam.gke.io/gcp-service-account": "argocd-fleet-admin@argocd-project.iam.gserviceaccount.com"
server:
  serviceAccount:
    annotations:
      "iam.gke.io/gcp-service-account": "argocd-fleet-admin@argocd-project.iam.gserviceaccount.com"
  extraArgs:
    - --insecure

集群连接Secret配置 #

apiVersion: v1
kind: Secret
metadata:
  name: private-gke-cluster
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: cluster
type: Opaque
stringData:
  name: private-gke-cluster
  server: https://connectgateway.googleapis.com/v1/projects/MY_PROJECT_NUMBER/locations/global/gkeMemberships/unique-membership-name
  config: |
    {
      "execProviderConfig": {
        "command": "argocd-k8s-auth",
        "args": ["gcp"],
        "apiVersion": "client.authentication.k8s.io/v1beta1"
      },
      "tlsClientConfig": {
        "insecure": false,
        "caData": ""
      }
    }

遇到的错误 #

登录ArgoCD UI并尝试向目标集群添加项目时，持续出现以下错误：

Unable to create application: error while validating and normalizing app: error validating the repo: error getting k8s server version: unknown

已验证的有效操作 #

• 进入ArgoCD Pod执行argocd-k8s-auth gcp，可正常获取Token
• 在Helm values中直接配置集群的connectgateway URL和手动获取的Token，能够成功创建部署
• 使用个人账号执行gcloud container fleet memberships get-credentials $MEMBERSHIP_NAME --project $FLEET_PROJECT，可正常获取集群凭证
• 通过 impersonate 服务账号执行gcloud container fleet memberships get-credentials $MEMBERSHIP_NAME --project $FLEET_PROJECT，也能正常访问集群

更新#1 #

若在Helm values中配置手动获取的Token和connectgateway URL：

configs:
  clusterCredentials:
    - name: test-cluster
      server: "https://connectgateway.googleapis.com/v1/projects/MY_PROJECT_NUMBER/locations/global/gkeMemberships/unique-membership-name"
      config:
        bearerToken: "ya29.c...."
        tlsClientConfig:
          insecure: true

仍会遇到相同错误。但改用集群IP地址而非connectgateway URL时，可正常创建应用。

已将GKE控制平面的授权IP设为0.0.0.0/0用于调试，怀疑Fleet存在请求来源限制，但不确定具体问题点。

内容的提问来源于stack exchange，提问作者golobitch