Unable to add AKS cluster to ArgoCD (in another cloud): 'The server has asked the client to provide credentials

[func25]

Hello everyone, I'm trying to connect an AKS cluster to the Argocd on GKE cluster, but I keep getting the error: "The server has asked for the client to provide credentials." I checked the sign-in logs on Azure and can see a successful login for the service principal.

Here’s what I’ve set up on the AKS side:

• Created a service principal for the application with Contributor access to the AKS cluster.
• Configured a federated identity credential, which appears to be working since ArgoCD is able to retrieve the token from Azure.
• Created a k8s service account with admin privileges for argocd/application-controller.

On the ArgoCD cluster, I did the following:

• Added the required annotations and labels to both argocd-server and argocd-application-controller (pod/deployment/SA)
• Mounted the cluster secret with the following configuration:

{
  "execProviderConfig": {
    "command": "argocd-k8s-auth",
    "env": {
      "AAD_ENVIRONMENT_NAME": "AzurePublicCloud",
      "AZURE_CLIENT_ID": "d67a95b6-3f09-***",
      "AZURE_TENANT_ID": "e4d9a307-f0b6-***",
      "AZURE_FEDERATED_TOKEN_FILE": "/var/run/secrets/azure/tokens/azure-identity-token",
      "AZURE_AUTHORITY_HOST": "https://login.microsoftonline.com/",
      "AAD_LOGIN_METHOD": "workloadidentity"
    },
    "args": ["azure"],
    "apiVersion": "client.authentication.k8s.io/v1beta1"
  },
  "tlsClientConfig": {
    "insecure": false,
    "caData": "***"
  }
}

Any help would be greatly appreciated :)