<p>I want to use user assigned or managed identity for AKS and ArgoCD to create an application.</p>
<p>I assigned AcrPull on my ACR for AKS identity, and then tried to create a ArgoCD repo with</p>
<pre><code>argocd repo add myACR.azurecr.io --type helm --name helm --enable-oci
</code></pre>
<p><code>helm</code> is the root of my repos there. It worked correctly and I can see a green &quot;successful&quot; tick in a connection status in ArgoCD UI.</p>
<p>But when I try to create an app for one of the actual images, it fails with</p>
<blockquote>
<p><code>helm pull oci://myACR.azurecr.io/helm/mychart --version 0.0.1 --destination /tmp/helm706383544</code></p>
<p>failed exit status 1: Error: failed to authorize: failed to fetch
anonymous token: unexpected status: 401 Unauthorized</p>
</blockquote>
<p>(on a side note, if I enable admin user and create argocd repo with <code>--username XXX --password XXX</code> options, everything works as expected)</p>
<p>What am I missing? Is it possible to achieve this? Or do I need to enable admin user on ACR (or use tokens?)</p>

JoeBloggs
<p>When you say AKS identity and mean the user managed identity then its wrong in this case.</p>
<p>For accessing the ACR you need to assign the kubelet identity of your AKS the <code>AcrPull</code> Role as the <a href="https://kubernetes.io/docs/concepts/overview/components/#kubelet" rel="nofollow noreferrer">kubelet</a> is responsible for pulling images:</p>
<pre><code>export KUBE_ID=$(az aks show -g &lt;resource group&gt; -n &lt;aks cluster name&gt; --query identityProfile.kubeletidentity.objectId -o tsv)
export ACR_ID=$(az acr show -g &lt;resource group&gt; -n &lt;acr name&gt; --query id -o tsv)
az role assignment create --assignee $KUBE_ID --role &quot;AcrPull&quot; --scope $ACR_ID
</code></pre>
<p>But this is only the part where Kubernetes is pulling the images. I dont think that ArgoCD out-of-the-box leverages the Azure Identites to connect to your repo.</p>
<p>So maybe you need to specify username and password in order that ArgoCD can connect to the helm repo:</p>
<pre><code>argocd repo add myACR.azurecr.io --type helm --name helm --enable-oci --username &lt;username&gt; --password &lt;password&gt;
</code></pre>
