hashicorp / hashicorp/packer

Error Fetching subscriptionID from VM metadata service for Managed Identity authentication - azure

Open
#12,782 3 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
15.8k
Forks
3.3k
PR merge metrics
PR metrics pending

Description

#### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

When filing a bug, please include the following headings if possible. Any
example text in this template can be deleted.

#### Overview of the Issue
I am trying to execute a Packer build for Azure with a configured Service Principal. For an unknown reason it is always trying to use a Managed Identity. I don't see any issue with my packer template, I am providing the necessary details for "client_id" and "client_secret". The variables are specified and values are correct. Has anyone seen this kind of behaviour before?

#### Reproduction Steps
This is happening with every build.
I tried several packer versions & azure plugins but it doesn't make a difference.

### Packer version
Packer v1.10.0

packer-plugin-azure_v2.0.2_x5.0_windows_amd64
packer-plugin-azure_v2.0.1_x5.0_windows_amd64
packer-plugin-azure_v1.4.5_x5.0_windows_amd64

### Simplified Packer Template
source "azure-arm" "test" {

#Azure Info
subscription_id = "${var.subscription_id}"
client_id = "${var.AZURE_CLIENT_ID}"
client_secret = "${var.AZURE_CLIENT_SECRET}"
cloud_environment_name = "Public" # China, Germany, or USGovernment

#Packer Azure
build_resource_group_name = "rg-test # Resource Group needs to exist before!!
managed_image_name = "${var.managed_image_name}-${formatdate("YYYY-MM-DD-hhmm",timestamp())}"
managed_image_resource_group_name = "rg-test"
managed_image_storage_account_type = "Premium_LRS" # Standard_LRS

### Operating system and Environment details

Windows 11, Local

### Log Fragments and crash.log files
`==> Some builds didn't complete successfully and had errors:
2024/01/10 09:40:04 machine readable: azure-arm.avd,error []string{"error fetching subscriptionID from VM metadata service for Managed Identity authentication: Get \"http://169.254.169.254/metadata/instance/compute?api-version=2017-08-01&format=json\": dial tcp 169.254.169.254:80: connectex: A socket operation was attempted to an unreachable network."}
2024/01/10 09:40:04 ui error: --> azure-arm.avd: error fetching subscriptionID from VM metadata service for Managed Identity authentication: Get "http://169.254.169.254/metadata/instance/compute?api-version=2017-08-01&format=json": dial tcp 169.254.169.254:80: connectex: A socket operation was attempted to an unreachable network.`

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the failure with the supplied Azure ARM template and review the logged request to the VM metadata endpoint. The issue is done when valid client_id and client_secret settings use service-principal authentication without attempting the unavailable managed-identity metadata service.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go
Domain
authentication, cli, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.