Bug: bicep deploy towards Azure China fails
- Dominant language
- TypeScript
- Stars
- 64
- Forks
- 20
- Avg merge
- 15h 37m
- Merged PRs (30d)
- 4
Description
I have an issue to use the bicep deploy towards Azure China. The authentication is working towards both Azure Global and Azure China, but the deployment step directly after is failing.
This is the output of the azure/bicep-deploy app:
```plain
Error: Operation failed
Error: ChainedTokenCredential authentication failed.
CredentialUnavailableError: EnvironmentCredential is unavailable. No underlying credential could be used. To troubleshoot, visit https://aka.ms/azsdk/js/identity/environmentcredential/troubleshoot.
CredentialUnavailableError: Please run 'az login' from a command prompt to authenticate before using this credential.
CredentialUnavailableError: Please run 'Connect-AzAccount' from PowerShell to authenticate before using this credential.
```
This is an example of my workflow
```yaml
name: Bicep deploy to CN3
on: [push]
permissions:
id-token: write
contents: read
jobs:
build-and-deploy:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
- name: Azure login
uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 #v3.0.0
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
environment: 'AzureChinaCloud'
audience: 'api://AzureADTokenExchangeChina'
- name: Bicep validate
uses: azure/bicep-deploy@66910e9c5c7733c33a1cd605030d02234b3bc4ed #v2.3.0
with:
type: deployment
operation: validate
name: Development
location: chinanorth3
scope: subscription
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
template-file: ./main.bicep
parameters-file: ./main.bicepparam
```
There are some other one mention something about the bicep installation, but I don't think that is fully related. But maybe #85, #166 or #186 are a little related?
Contributor guide
Research direction
Start by reproducing the workflow using the Azure login and azure/bicep-deploy steps, with ./main.bicep and ./main.bicepparam against AzureChinaCloud. Trace the deployment authentication entry point after login and compare it with the reported error; done means the validate operation completes successfully in Azure China.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, github-actions
- Domain
- authentication, cloud, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100