Aligns the Argo CD GitOps integration with the Azure-managed Argo CD k8s extension

[Tatsinnit]

Summary

Aligns the Argo CD GitOps integration with the Azure-managed Argo CD k8s extension (Microsoft.ArgoCD, public preview) on AKS and Azure Arc-enabled Kubernetes clusters. Adds runtime detection of the managed install, surfaces Workload Identity Federation as the preferred credential path for Azure source repos with a guided in-VS-Code bootstrap helper, and rewrites the docs to explain both install tracks clearly.

No new commands. No behavior change for upstream Argo CD users. No change to scaffolded application.yaml output. Feature flag aks.argoCDEnabled continues to gate everything.

Refs:

• Announcement blog (Azure Blog)
• Microsoft Learn: Use GitOps with Argo CD

---

Why

The blog above announces public preview of an Azure-managed Argo CD extension with three pillars: Entra ID SSO + Workload Identity Federation (no long-lived PATs/SSH for ACR / Azure DevOps), Azure Linux–hardened images + opt-in patch channel, and upstream parity (HA, hub-and-spoke, ApplicationSet). Our extension already works against the managed install, but:

• The post-apply UX still nudged users toward PAT/SSH secrets even when the source was an Azure host where WIF is the recommended path.
• Users had no way to tell from VS Code whether their cluster was running the managed extension or upstream.
• The "Configure Workload Identity" action just opened a browser tab — users still had to chase subject claims, OIDC issuer URLs, and the right portal blade by hand.
• The docs page didn't mention the managed extension, Entra SSO, WIF, or any of the production topologies that come with it.

---

Changes

Code

argoCDInstall.ts — install-method detection

• New detectManagedArgoCDExtension() — probes the argocd namespace for the app.kubernetes.io/managed-by=Microsoft.ArgoCD pod label. Returns a tri-state (managed / upstream / unknown) so RBAC-forbidden / connection failures don't silently misclassify as upstream.
• showArgoCDStatus() now logs install method in three branches; unknown explicitly mentions the failing kubectl get pods command so RBAC issues are debuggable.

argoCDApplyApp.ts — post-apply menu

• New classifyAzureRepoHost(repoUrl) — matches *.azurecr.io, (ssh.)?dev.azure.com, and legacy (vs-ssh.)?*.visualstudio.com.
• Post-apply menu now fetches installMethod alongside authMode / repoVisibility via Promise.all.
• Workload Identity hint is gated on azureHost !== "other" && (installMethod === "managed" || authMode === "sso") — i.e. only shown when the linked flow actually applies to the user's install path.
• When the WIF hint is selected and the managed extension is detected, the action now routes through the new guided helper (below). For SSO-only upstream installs it falls back to the Microsoft Learn tutorial link.

argoCDWifBootstrap.ts — new guided WIF helper (~280 LOC, no Azure or cluster mutations)

• Auto-detects the Argo CD ServiceAccount in argocd namespace (tries argocd-repo-server, argocd-image-updater, argocd-application-controller; falls back to user input).
• Reads any existing azure.workload.identity/client-id annotation on the SA and fetches the cluster OIDC issuer URL via kubectl get --raw /.well-known/openid-configuration.
• QuickPick step menu, logging each step to the shared "Argo CD" output channel:
  • Step 1 — show federated-credential subject claim (system:serviceaccount:argocd:<sa>), issuer URL, and audience (api://AzureADTokenExchange) with one-click clipboard copy.
  • Step 2 — open Azure Portal directly on Managed Identities (or App registrations) so the user pastes those values into a new federated credential.
  • Step 3 — print role-assignment guidance (AcrPull for ACR, Reader for Azure DevOps), the azure.workload.identity/client-id annotation command, and the kubectl rollout restart to apply it.
  • Fallback — the original Microsoft Learn tutorial link is still one click away.

Docs

docs/book/src/features/argocd-gitops-integration.md

• New Installation options table — managed extension vs upstream Argo CD, with capability comparison.
• New Two orthogonal probes section — explains that install-method (managed-by label) and auth-mode (oidc.config referencing login.microsoftonline.com) are independent signals, so a managed install without SSO and an upstream install wired to Entra ID by hand are both valid configurations.
• Configure Workload Identity for Azure subsection rewritten — describes the branched behavior: guided 3-step bootstrap helper when the managed extension is detected, Learn-link fallback otherwise.
• Connect Private Repository scoped to GitHub (Azure sources should use WIF).
• Added Production topologies (HA, hub-and-spoke), expanded troubleshooting, and a Further reading footer.

---

What this PR does not change

• No new VS Code command IDs. Same five aks.argoCD* commands as before.
• No change to scaffolded application.yaml content from aks.draftArgoCDDeployment.
• No new dependencies. No az CLI shell-outs. All Azure interactions remain via the existing session provider; cluster interactions remain via kubectl.
• No mutations to Azure or the cluster from the WIF helper — it's purely informational + portal deep-links.
• No change for upstream Argo CD users: install-method resolves to upstream, WIF hint is hidden, existing flows (admin-password fetch, Open UI, Connect Private Repository) are unchanged.

---

Testing

• TypeScript: npx tsc --noEmit clean.
• Manual: smoke-tested install-method and auth-mode detection on a kind cluster by patching argocd-cm.data["oidc.config"] and labelling pods with app.kubernetes.io/managed-by=Microsoft.ArgoCD (see docs § "Two orthogonal probes" for the exact probe queries).
• WIF bootstrap helper exercised against the same fake-managed cluster — Step 1 prints subject/issuer with clipboard copy working, Step 2 opens both portal blades, Step 3 prints branched ACR vs Azure DevOps guidance.

---

Out of scope (planned follow-ups)

• Install Azure-managed Argo CD extension from VS Code (would call Microsoft.KubernetesConfiguration ARM directly, no az CLI). Deferred to a separate PR — current PR focuses on post-install + deploy scenarios.
• ApplicationSet scaffold variant for hub-and-spoke topologies.
• Auto-detecting the UAMI client ID once federation is created and offering to apply the SA annotation programmatically.

[Copilot]

Pull request overview

This PR updates the AKS Tools Argo CD GitOps integration to better align with the Azure-managed Argo CD Kubernetes extension (Microsoft.ArgoCD) by detecting managed installs, surfacing Workload Identity Federation guidance for Azure repo sources, and updating the user docs accordingly.

Changes:

• Added runtime detection of the Azure-managed Argo CD extension via a managed-by pod label and surfaced this in AKS: Check Argo CD Status output.
• Added repo-host classification to show a post-apply action that links to Workload Identity Federation guidance for ACR / Azure DevOps sources.
• Rewrote the Argo CD GitOps integration docs to describe both install tracks and updated post-apply/action guidance.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.

File	Description
src/commands/aksArgoCD/argoCDInstall.ts	Adds managed-extension detection and prints install method in the Argo CD status output.
src/commands/aksArgoCD/argoCDApplyApp.ts	Adds Azure host classification and a new post-apply QuickPick item linking to WIF guidance.
docs/book/src/features/argocd-gitops-integration.md	Documents installation options, WIF guidance, and production topology notes for managed vs upstream installs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bosesuneha]

lgtm