[bastion] az network bastion ssh fails with Python error - No module named 'pkg_resources'

Source: https://github.com/Azure/azure-cli/issues/33110 (by @430am)
Affected extension: `bastion` (`src/bastion/`)

---

<<>>
# Issue #33110 (by @430am)
## Title
az network bastion ssh fails with Python error - No module named 'pkg_resources'

## Body
### Describe the bug

When trying to ssh through Azure Bastion with native client support from local machine, it fails with a python error - "No module named 'pkg_resources'"

Here is the full error:

The command failed with an unexpected error. Here is the traceback:
No module named 'pkg_resources'
Traceback (most recent call last):
File "/usr/lib64/az/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 682, in execute
raise ex
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 812, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 781, in _run_job
result = cmd_copy(params)
^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 336, in __call__
return self.handler(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/command_operation.py", line 120, in handler
return op(**command_args)
^^^^^^^^^^^^^^^^^^
File "/home/jackw/.azure/cliextensions/bastion/azext_bastion/custom.py", line 174, in ssh_bastion_host
_test_extension(SSH_EXTENSION_NAME)
File "/home/jackw/.azure/cliextensions/bastion/azext_bastion/custom.py", line 107, in _test_extension
from pkg_resources import parse_version
ModuleNotFoundError: No module named 'pkg_resources'

### Related command

az network bastion ssh --name bastion-netscus --resource-group rg-networks --target-resource-id "/subscriptions//resourceGroups/rg-cyclecloud/providers/Microsoft.Compute/virtualMachines/vm-ccapp" --auth-type ssh-key --username azureuser --ssh-key ~/.ssh/id_ed25519

### Errors

The command failed with an unexpected error. Here is the traceback:
No module named 'pkg_resources'
Traceback (most recent call last):
File "/usr/lib64/az/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 682, in execute
raise ex
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 812, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 781, in _run_job
result = cmd_copy(params)
^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 336, in __call__
return self.handler(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/command_operation.py", line 120, in handler
return op(**command_args)
^^^^^^^^^^^^^^^^^^
File "/home/jackw/.azure/cliextensions/bastion/azext_bastion/custom.py", line 174, in ssh_bastion_host
_test_extension(SSH_EXTENSION_NAME)
File "/home/jackw/.azure/cliextensions/bastion/azext_bastion/custom.py", line 107, in _test_extension
from pkg_resources import parse_version
ModuleNotFoundError: No module named 'pkg_resources'

### Issue script & Debug output

az network bastion ssh --name bastion-netscus --resource-group rg-networks --target-resource-id "/subscriptions//resourceGroups/rg-cyclecloud/providers/Microsoft.Compute/virtualMachines/vm-ccapp" --auth-type ssh-key --username azureuser --ssh-key ~/.ssh/id_ed25519 --debug 2>&1 | tee ~/az_net_ssh_debug.log

DEBUG: cli.knack.cli: Command arguments: ['network', 'bastion', 'ssh', '--name', 'bastion-netscus', '--resource-group', 'rg-networks', '--target-resource-id', '/subscriptions//resourceGroups/rg-cyclecloud/providers/Microsoft.Compute/virtualMachines/vm-ccapp', '--auth-type', 'ssh-key', '--username', 'azureuser', '--ssh-key', '/home/jackw/.ssh/id_ed25519', '--debug']
DEBUG: cli.knack.cli: __init__ debug log:
Cannot enable color.
DEBUG: cli.knack.cli: Event: Cli.PreExecute []
DEBUG: cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [, , ]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
DEBUG: cli.azure.cli.core: Modules found from index for 'network': ['azure.cli.command_modules.privatedns', 'azure.cli.command_modules.network', 'azext_bastion']
DEBUG: cli.azure.cli.core: Loading command modules...
DEBUG: cli.azure.cli.core: Loaded command modules in parallel:
DEBUG: cli.azure.cli.core: Name Load Time Groups Commands
DEBUG: cli.azure.cli.core: privatedns 0.099 14 60
DEBUG: cli.azure.cli.core: network 0.381 122 370
DEBUG: cli.azure.cli.core: Total (2) 0.383 136 430
DEBUG: cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
DEBUG: cli.azure.cli.core: Loading extensions:
DEBUG: cli.azure.cli.core: Name Load Time Groups Commands Directory
DEBUG: cli.azure.cli.core: bastion 0.004 2 9 /home/jackw/.azure/cliextensions/bastion
DEBUG: cli.azure.cli.core: Total (1) 0.004 2 9
DEBUG: cli.azure.cli.core: Loaded 136 groups, 439 commands.
DEBUG: cli.azure.cli.core: Found a match in the command table.
DEBUG: cli.azure.cli.core: Raw command : network bastion ssh
DEBUG: cli.azure.cli.core: Command table: network bastion ssh
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate []
DEBUG: cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/home/jackw/.azure/commands/2026-03-31.09-41-41.network_bastion_ssh.3442.log'.
INFO: az_command_data_logger: command args: network bastion ssh --name {} --resource-group {} --target-resource-id {} --auth-type {} --username {} --ssh-key {} --debug
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [.add_subscription_parameter at 0x7f1b9161cae0>]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [.add_ids_arguments at 0x7f1b9161cb80>, .add_cache_arguments at 0x7f1b9161cd60>, .update_breaking_change_info at 0x7f1b9161ce00>]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [, , .parse_ids_arguments at 0x7f1b9161cc20>]
INFO: az_command_data_logger: extension name: bastion
INFO: az_command_data_logger: extension version: 1.4.2
DEBUG: cli.azure.cli.core.azclierror: Traceback (most recent call last):
File "/usr/lib64/az/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands
... [truncated, original was 14312 chars]

## Comments
### Comment by @yonzhan

Thank you for opening this issue, we will look into it.

### Comment by @PawelWMS
I believe the CLI uses `setuptools` and they deprecated `pkg_resources` starting from version 82.0.0. Here's a message when running with 81.0.0:
'''
>>> from pkg_resources import parse_version
:1: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
'''

There seems to be an [ongoing thread](https://github.com/pypa/setuptools/issues/5174) regarding this topic in the upstream.

### Comment by @TheCoreMan
@430am This fixed it for me, just run:

'''
az extension update --name bastion
'''

Running `az version` after the update shows `bastion 1.4.3`

### Comment by @PawelWMS
Thanks, @TheCoreMan, that solved it for me as well.

### Comment by @paulvandenburg
@TheCoreMan's fix also worked for me.

However I'm using the official azure-cli deb source:
'''
Types: deb
URIs: https://packages.microsoft.com/repos/azure-cli/
Suites: noble
Components: main
Architectures: amd64
Signed-by: /etc/apt/keyrings/microsoft.gpg
'''

I think this should be handled by the package upgrade itself?
There might be other extensions that are in need of updates too that I just haven't run into problems with and I'm unaware of?

### Comment by @toaomatis
> '''
> az extension update --name bastion
> '''

Can confirm this also works on the Arch / pacman version of `azure-cli`

### Comment by @dstamen
updating extension for me did not fix it. the `from packaging.version import Version as parse_version` did please m[~]erge this pr!
<<>>