Azure / Azure/azure-cli

Support Linux Hybrid Runbook Worker VM's Managed Identity

Open
#22,243 6 comments 0 reactions 1 assignee Assigned to @jiasli View on GitHub
Account act-identity-squad act-platform-engineering-squad Auto-Assign Feature Candidate feature-request Installation Service Attention
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Describe the bug**

Running python script in az automation hybrid worker that uses azure.cli.core library to authenticate with a managed identity:

Command Name
"az login --identity"

Error:

ERROR: Failed to connect to MSI. Please make sure MSI is configured correctly.

that's the output for the job in the automation account.

**To Reproduce**
- Configure a linux hybrid worker
- create a python3 runbook
- use the following code:

```python

#!/usr/bin/env python3

import sys
import os
from azure.cli.core import get_default_cli

def main():
commnd = f'login --identity'
exAzCli(commnd, False) #login to azure cli using service principal credentials
subs = exAzCli('account list --all', False) #executing cli command
showingSubs(subs)

def exAzCli(str):
ipt = str.split()
azc = get_default_cli()
azc.invoke(ipt, out_file = open(os.devnull, 'w'))
if azc.result.result:
return azc.result.result
elif azc.result.error:
return '{"return": "error"}'

def showingSubs(subs):
for sub in subs:
print('Subscription "' + str(sub['name']) + '" is currently ' + str(sub['state']) + ' and has the Id: ' + str(sub['id']))

if __name__ == "__main__":
main()

```

**Expected behavior**
The runbook should be able to authenticate using the managed identity

If we execute the script manually, without using the runbook, it will work

**Environment summary**

azure-cli 2.32.0 *core 2.32.0 *
telemetry 1.0.6Extensions:
automation 0.1.1Dependencies:
msal 1.16.0
azure-mgmt-resource 20.0.0

**Install Method**

```bash
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
sudo apt-get install python3-pip
sudo -H pip3 install azure-cli-core
sudo -H pip3 install azure-cli
sudo apt-get install glibc-source
sudo apt-get install openssl
sudo apt-get install libpam-modules
```

**Additional context**

When we run the python code in the hybrid worker (in the console) it works fine, however when we execute the same code, through Azure automation, we are unable to login, and we received the error.

• If the same code uses SPN, it will work fine
• We need to use an hybrid worker because the azure sandbox won’t allow to install the azure.core.cli dependencies
• We can’t use powershell due to standardization of their cloud automation in all clouds

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.