Azure-pipelines-tasks: Error: Endpoint auth data not present in Azure Resource Group Deployment task

[cmielke]

Required Information

Type: Bug

Enter Task Name: Azure Resource Group Deployment

Environment

• Server - Azure Pipelines

  • account name: Emdat
  • team project name: Emdat
  • release definition name/number: _test_azure_cli (Release-21)

• Agent - Hosted:

  • agent queue name: Azure Pipelines
  • agent specification: windows-2019

Issue Description

When running the Azure Resource Group Deployment Task (v2 or v3-preview) with a Service Connection that is configured to use certificate-based authentication, I am getting the following error:

This is a screenshot of the last success at 10:50 AM (Central Time). Notice the version of the task was v2.157.7:

The next release at 11:21 AM (Central Time) failed with the error. Notice that it was running v2.161.8 of the task:

Note that the task works fine if I use a Service Connection that is configured for secret-based authentication. This is our short term workaround. In the long run, I would like to use certificate-based authentication.

Task logs

ReleaseLogs_10178.zip

Error logs

2019-12-16T20:48:26.7350586Z ##[error]Error: Task failed while initializing. Error: Endpoint auth data not present: b344ceed-dc46-4ca2-9d7a-3d6bd5b6ab88

[agupta-au]

We're experiencing this too and is impacting our release planning.

Any known workarounds? We don't have an option to fall back to shared secret!

Possibly related to work being done in this sprint? https://docs.microsoft.com/en-au/azure/devops/release-notes/2019/sprint-162-update --> specifically, there's work being done on ServiceConnections

[vineetmimrot]

Thanks @cmielke & @agupta-au for reporting the issue, we will try to unblock you at earliest.

[mrsmitty]

I have a client that's also being impacted by this. @bishal-pdMSFT please let me know if you require info from their ADO Org and pipelines to help resolution.

I've also tried on the v3 preview task and same issue.

2019-12-17T04:05:59.8063265Z ==============================================================================
2019-12-17T04:05:59.8063365Z Task : ARM template deployment
2019-12-17T04:05:59.8063420Z Description : Deploy an Azure Resource Manager (ARM) template to all the deployment scopes
2019-12-17T04:05:59.8063489Z Version : 3.1.9
2019-12-17T04:05:59.8063889Z Author : Microsoft Corporation
2019-12-17T04:05:59.8064114Z Help : https://docs.microsoft.com/azure/devops/pipelines/tasks/deploy/azure-resource-group-deployment
2019-12-17T04:05:59.8064333Z ==============================================================================
2019-12-17T04:06:00.4186362Z ARM Service Conection deployment scope - Subscription
2019-12-17T04:06:00.4301148Z ##[error]Error: Task failed while initializing. Error: Endpoint auth data not present: 8a05e693-a1a1-4117-9ea9-90a5fe754621

[bishal-pdMSFT]

Ack. From preliminary investigation we seem to have identified the root cause. We will update once the fix is done and is starting rollout.

[segraef]

Same issue here but with self-hosted agents in connection with assigned managed identities in Azure.

Current agent version: '2.160.1'

[IkePCampbell]

Same issue as @segraef, self-hosted agent with connection with assigned managed identity

Current agent version: '3.1.9'

[segraef]

@IkePCampbell just fyi the mentioned version is the version of the ARM template deployment task, your agent version ca be seen at the agent pool or once the agent spins up in your pipeline.

[IkePCampbell]

@segraef Oh thank you! My bad, then my version is '2.163.1'

[agupta-au]

We've been recommended to use the v3.* (preview) version of the task. Will report back with findings once the build pipelines have been modified.

[cmielke]

I get the same error on v3.1.9 of the task.

[agupta-au]

Same issue here!

I get the same error on v3.1.9 of the task.

[SupporterMan]

I have a customer also has this issue and they are unable to use Service Principal Key authorization in Service Connection to unblock them because they have many service principals, which will let them do lots of work to change their service connections.
Now they are blocked and all the pipelines using the service connection are unable to be executed.

Could you please provide an ETA about this?

[MarkAtAgilliance]

Also with 2.161.8. We too are using MSI / self hosted build server.

[vineetmimrot]

@All, the issue has been hotfixed. Let us know if you face any issues.

[IkePCampbell]

@vineetmimrot are there any settings we need to change? I am still facing the same issue

[MarkAtAgilliance]

This hotfix succeeded for me. Thank you :-) .

[cmielke]

It looks like the hotfix has resolved the issue for me. Thank you for the quick turnaround.

[agupta-au]

The issue is NOT resolved for us:

[agupta-au]

It looks like the hotfix has resolved the issue for me. Thank you for the quick turnaround.

What version of the task do your logs show?

[cmielke]

It looks like the hotfix has resolved the issue for me. Thank you for the quick turnaround.

What version of the task do your logs show?

I am seeing v2.162.2

[agupta-au]

2.162.1 for us.

[MarkAtAgilliance]

2.161.9 (which was successful).
2019-12-18T18:50:19.7336399Z Version : 2.161.9
Adding this for comparison with agupta-au's result.
HTH. Mark.

[agupta-au]

Thanks @cmielke and @MarkAtAgilliance

I guess our tenant just hasn't been upgraded as yet.

[agupta-au]

@vineetmimrot

On 2.162.1 version of the Task (does not address issue), we are now using Service Principal Key for one of the deployments that is due for a release. We're now seeing a a multitude of warnings that were not present before in the Deploy pipelines. All of the warnings are _exactly_ the same: ##[warning]Can\'t find loc string for key: CorrelationIdForARM

Anyone know if there's a way we can force our tenant to use the new version of the task?

[vineetmimrot]

@agupta-au can you please check now. The task is upgraded to 2.162.2.