Azure / Azure/azure-cli-extensions

az ssh arc exits with code 0 even on SSH connection failure

Open
#8,809 1 comment 0 reactions 0 assignees View on GitHub
Auto-Assign bug Service Attention VM SSH
Dominant language
Python
Stars
454
Forks
1.7k
Avg merge
2d 19h
Merged PRs (30d)
64

Description

### Describe the bug

When running the az ssh arc command, even if the underlying SSH connection fails completely, the command still exits with code 0, indicating success.

This behavior is incorrect and breaks automation workflows (scripts, pipelines, retries), which depend on exit codes to determine success or failure.

Below screenshot taken from generated log files post running the following command (intentionally not providing substituted details but the code ensures all the substitution is correct)

_cmdArcSSH := fmt.Sprintf("az ssh arc --debug --subscription %s --resource-group %s --name %s --local-user azureuser --private-key-file %s --port 22 --yes -- -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null &> %s", subscription, managedRGName, controlPlaneARCVM, internal.SSHPrivateKeyLocation, arcSSHCmdLogPath)_

Image

I see the the code opens a subprocess here:
https://github.com/Azure/azure-cli-extensions/blob/1ceafea82844345065fd47d484ffdc75ab9a9bf1/src/ssh/azext_ssh/ssh_utils.py#L68C1-L68C21

and then waits:

https://github.com/Azure/azure-cli-extensions/blob/1ceafea82844345065fd47d484ffdc75ab9a9bf1/src/ssh/azext_ssh/ssh_utils.py#L144

but there is no check for exit code to propagate the failure

### Related command

_cmdArcSSH := fmt.Sprintf("az ssh arc --debug --subscription %s --resource-group %s --name %s --local-user azureuser --private-key-file %s --port 22 --yes -- -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null &> %s", subscription, managedRGName, controlPlaneARCVM, internal.SSHPrivateKeyLocation, arcSSHCmdLogPath)_

### Errors

WARNING: cli.azext_ssh.ssh_utils: SSH connection failure could still be due to Service Configuration update. Please re-run command.
DEBUG: cli.knack.cli: Event: CommandInvoker.OnTransformResult [, ]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnFilterResult []
DEBUG: cli.knack.cli: Event: Cli.SuccessfulExecute []
DEBUG: cli.knack.cli: Event: Cli.PostExecute []
INFO: az_command_data_logger: exit code: 0

### Issue script & Debug output

WARNING: cli.azext_ssh.ssh_utils: SSH connection failure could still be due to Service Configuration update. Please re-run command.
DEBUG: cli.knack.cli: Event: CommandInvoker.OnTransformResult [, ]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnFilterResult []
DEBUG: cli.knack.cli: Event: Cli.SuccessfulExecute []
DEBUG: cli.knack.cli: Event: Cli.PostExecute []
INFO: az_command_data_logger: exit code: 0

### Expected behavior

**If the SSH connection succeeds:**
The CLI should return exit code 0

Standard output and stderr should contain normal connection or command output

**If the SSH connection fails (examples):**
The proxy fails to connect (404 There are no listeners connected)

SSH times out

Authentication fails

Remote host is unreachable

Then:

The CLI should return a non-zero exit code, ideally matching the SSH or proxy process's return code (commonly 255).

This is consistent with standard CLI behavior (like ssh, scp, etc.) and is crucial for:

Automation

Scripting

Retry logic

CI/CD pipelines

### Environment Summary

Image

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.