Azure AKS中fluxconfig-agent报401错误导致状态异常

我基于AKS-Construction模板搭建了AKS环境，近期fluxconfig-agent开始报告状态异常。查看日志发现，该代理在从https://eastus.dp.kubernetesconfiguration.azure.com获取配置时返回401未授权错误，日志详情如下：

{"Message":"2022/10/03 17:09:01 URL:\u003e https://eastus.dp.kubernetesconfiguration.azure.com/subscriptions/xxx/resourceGroups/my-aks/provider/Microsoft.ContainerService-managedclusters/clusters/my-aks/configurations/getPendingConfigs?api-version=2021-11-01","LogType":"ConfigAgentTrace","LogLevel":"Information","Environment":"prod","Role":"ClusterConfigAgent","Location":"eastus","ArmId":"/subscriptions/xxx/resourceGroups/my-aks/providers/Microsoft.ContainerService/managedclusters/my-aks","CorrelationId":"","AgentName":"FluxConfigAgent","AgentVersion":"1.6.0","AgentTimestamp":"2022/10/03 17:09:01"}
{"Message":"2022/10/03 17:09:01 GET configurations returned response code {401}","LogType":"ConfigAgentTrace","LogLevel":"Information","Environment":"prod","Role":"ClusterConfigAgent","Location":"eastus","ArmId":"/subscriptions/xxx/resourceGroups/my-aks/providers/Microsoft.ContainerService/managedclusters/my-aks","CorrelationId":"","AgentName":"FluxConfigAgent","AgentVersion":"1.6.0","AgentTimestamp":"2022/10/03 17:09:01"}  
{"Message":"2022/10/03 17:09:01 Failed to GET configurations with ResponseCode : {401}","LogType":"ConfigAgentTrace","LogLevel":"Information","Environment":"prod","Role":"ClusterConfigAgent","Location":"eastus","ArmId":"/subscriptions/xxx/resourceGroups/my-aks/providers/Microsoft.ContainerService/managedclusters/my-aks","CorrelationId":"","AgentName":"FluxConfigAgent","AgentVersion":"1.6.0","AgentTimestamp":"2022/10/03 17:09:01"}
{"Message":"Error in the getting the Configurations: error {%!s(\u003cnil\u003e)}","LogType":"ConfigAgentTrace","LogLevel":"Error","Environment":"prod","Role":"ClusterConfigAgent","Location":"eastus","ArmId":"/subscriptions/xxx/resourceGroups/my-aks/providers/Microsoft.ContainerService/managedclusters/my-aks","CorrelationId":"","AgentName":"FluxConfigAgent","AgentVersion":"1.6.0","AgentTimestamp":"2022/10/03 17:09:01"}
{"Message":"2022/10/03 17:09:01 \"Errorcode: 401, Message Unauthorized client credentials., Target /subscriptions/xxx/resourceGroups/my-aks/provider/Microsoft.ContainerService-managedclusters/clusters/my-aks/configurations/getPendingConfigs\"","LogType":"ConfigAgentTrace","LogLevel":"Information","Environment":"prod","Role":"ClusterConfigAgent","Location":"eastus","ArmId":"/subscriptions/xxx/resourceGroups/my-aks/providers/Microsoft.ContainerService/managedclusters/my-aks","CorrelationId":"","AgentName":"FluxConfigAgent","AgentVersion":"1.6.0","AgentTimestamp":"2022/10/03 17:09:01"}

请问FluxConfigAgent的认证机制是什么？以及可能导致该401错误的原因有哪些？

FluxConfigAgent的认证机制 #

FluxConfigAgent是Azure Kubernetes Configuration服务的核心组件，在AKS集群内运行时，通过**托管标识（Managed Identity）**完成对Azure Kubernetes Configuration API的认证：

• 默认使用AKS集群的系统分配托管标识，若部署时指定了自定义标识则使用用户分配托管标识
• Agent会自动向Azure AD请求访问令牌，令牌的作用域为https://kubernetesconfiguration.azure.com/.default，用于授权调用Azure Kubernetes Configuration的REST API
• 令牌由Agent自动轮换，无需手动维护凭证

可能导致401未授权错误的原因 #

• 托管标识权限缺失：
  集群的托管标识未被授予访问Azure Kubernetes Configuration资源的必要权限（如Microsoft.KubernetesConfiguration/configurationAssignments/read），或权限被意外撤销。需检查标识在目标AKS集群及配置资源上的RBAC权限。
• 托管标识状态异常：
  系统分配托管标识被禁用/删除，或用户分配托管标识与集群的关联关系被破坏（如标识重建后未重新关联集群）。
• 网络访问限制：
  AKS集群节点无法访问Azure AD端点（login.microsoftonline.com）或Azure Kubernetes Configuration API端点，导致Agent无法获取有效令牌。需检查集群的网络策略、NSG规则或防火墙配置。
• Agent版本问题：
  当前使用的Agent版本为1.6.0，较旧版本可能存在认证相关的已知bug，升级到最新稳定版可解决部分问题。
• API资源配置错误：
  Azure Kubernetes Configuration的配置资源（如Flux配置）与集群的关联关系失效，或资源的访问策略限制了托管标识的访问。

内容的提问来源于stack exchange，提问作者Josh