az sig image-version create error, managed identity

[brianttu1]

az feedback auto-generates most of the information requested below, as of CLI version 2.0.62

Describe the bug
Unable to use az sig image-version create within azure cli without getting an error

To Reproduce
az sig image-version create -g ciBaseVMs --gallery-name ciImages --gallery-image-definition linux-base-vm-shared-image --end-of-life-date 2021-03-20 --gallery-image-version 1.10.0 --target-regions 'centralus' 'EastUS2=1' --replica-count 1 --managed-image '/subscriptions/XXXXXXXXXXXXXX/resourceGroups/XXXXXXXX/providers/Microsoft.Compute/images/'linux-base-vm-shared-image-1.10.0

Expected behavior
This has worked for a really long time until recent upgrades. It should create a replicated image

Environment summary
centos 7.8
az --version
azure-cli 2.17.1

core 2.17.1
telemetry 1.0.6

Extensions:
image-copy-extension 0.0.8

Python location '/usr/bin/python3'
Extensions directory '/var/lib/jenkins/.azure/cliextensions'

Python (Linux) 3.6.8 (default, Nov 16 2020, 16:55:22)
[GCC 4.8.5 20150623 (Red Hat 4.8.5-44)]

Additional context
CLIInternalError: The command failed with an unexpected error. Here is the traceback:
'MSIAuthenticationWrapper' object has no attribute 'get_all_tokens'
Traceback (most recent call last):
File '/usr/lib64/az/lib/python3.6/site-packages/knack/cli.py', line 215, in invoke
cmd_result = self.invocation.execute(args)
File '/usr/lib64/az/lib/python3.6/site-packages/azure/cli/core/commands/init.py', line 659, in execute
raise ex
File '/usr/lib64/az/lib/python3.6/site-packages/azure/cli/core/commands/init.py', line 722, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
File '/usr/lib64/az/lib/python3.6/site-packages/azure/cli/core/commands/init.py', line 715, in _run_job
six.reraise(*sys.exc_info())
File '/usr/lib64/az/lib/python3.6/site-packages/six.py', line 703, in reraise
raise value
File '/usr/lib64/az/lib/python3.6/site-packages/azure/cli/core/commands/init.py', line 693, in _run_job
result = cmd_copy(params)
File '/usr/lib64/az/lib/python3.6/site-packages/azure/cli/core/commands/init.py', line 330, in call
return self.handler(*args, **kwargs)
File '/usr/lib64/az/lib/python3.6/site-packages/azure/cli/core/init.py', line 784, in default_command_handler
return op(**command_args)
File '/usr/lib64/az/lib/python3.6/site-packages/azure/cli/command_modules/vm/custom.py', line 3275, in create_image_version
_, _, _, external_tokens = cred.get_all_tokens('https://management.azure.com/.default')
AttributeError: 'MSIAuthenticationWrapper' object has no attribute 'get_all_tokens'

[yungezz]

hi @qwordy could you pls have a look? thanks

[qwordy]

@brianttu1 Could you try 2.18.0? 2.17 1 has a known issue of az sig image-version create.

[brianttu1]

Hello,

Thanks for your reply!

/root:# az --version
azure-cli 2.18.0

core 2.18.0
telemetry 1.0.6

Extensions:
image-copy-extension 0.2.8

Python location '/usr/bin/python3'
Extensions directory '/root/.azure/cliextensions'

Python (Linux) 3.6.8 (default, Nov 16 2020, 16:55:22)
[GCC 4.8.5 20150623 (Red Hat 4.8.5-44)]

Issue remains:

From Command Line: az sig image-version create -g ciBaseVMs --gallery-name ciImages --gallery-image-definition linux-base-vm-shared-image --end-of-life-date 2021-03-23 --gallery-image-version 1.10.0 --target-regions 'centralus' 'EastUS2=1' --replica-count 1 --managed-image '/subscriptions/XXXXXXXXXXXXXXXX/resourceGroups/XXXXXXXXX/providers/Microsoft.Compute/images/'linux-base-vm-shared-image-1.10.0
Getting external tokens failed.

From Python using bash command line:
ERROR: CLIInternalError: The command failed with an unexpected error. Here is the traceback:ERROR: 'MSIAuthenticationWrapper' object has no attribute 'get_all_tokens'Traceback (most recent call last): File "/usr/lib64/az/lib/python3.6/site-packages/knack/cli.py", line 233, in invoke cmd_result = self.invocation.execute(args) File "/usr/lib64/az/lib/python3.6/site-packages/azure/cli/core/commands/init.py", line 659, in execute raise ex File "/usr/lib64/az/lib/python3.6/site-packages/azure/cli/core/commands/init.py", line 722, in _run_jobs_serially results.append(self._run_job(expanded_arg, cmd_copy)) File "/usr/lib64/az/lib/python3.6/site-packages/azure/cli/core/commands/init.py", line 715, in _run_job six.reraise(*sys.exc_info()) File "/usr/lib64/az/lib/python3.6/site-packages/six.py", line 703, in reraise raise value File "/usr/lib64/az/lib/python3.6/site-packages/azure/cli/core/commands/init.py", line 693, in _run_job result = cmd_copy(params) File "/usr/lib64/az/lib/python3.6/site-packages/azure/cli/core/commands/init.py", line 330, in call return self.handler(*args, **kwargs) File "/usr/lib64/az/lib/python3.6/site-packages/azure/cli/core/init.py", line 786, in default_command_handler return op(**command_args) File "/usr/lib64/az/lib/python3.6/site-packages/azure/cli/command_modules/vm/custom.py", line 3280, in create_image_version _, _, _, external_tokens = cred.get_all_tokens('https://management.azure.com/.default')AttributeError: 'MSIAuthenticationWrapper' object has no attribute 'get_all_tokens'To open an issue, please run: 'az feedback'

[qwordy]

@brianttu1 I will open an investigation into this issue.

[mbearup]

The issue seems to affect 2.17.0, 2.17.1, and 2.18.0.
2.16.0 is the last version without this defect.

[qwordy]

The issue seems to affect 2.17.0, 2.17.1, and 2.18.0.
2.16.0 is the last version without this defect.

Thank you for the information.

[qwordy]

I have found the cause. We updated token related code from 2.17.0, but we have not adapted these code for MSI login.

[anlatsko]

@qwordy Do you have a timeline for when you'll adapt this code for MSI login?

[xuto2]

@qwordy I have the same ask here - is it possible to expedite the fix?

[qwordy]

I plan to fix it in release on 3/23/2021. Release on 3/2/2021 is hard to catch. Authentication utilities in azure-cli-core and azure-core are evolving. They are no stable yet. I put the implementation in command code and added header manually last time. It is not elegant. It is a compromised solution.

[yungezz]

hi @qwordy, can this issue be closed now?

[qwordy]

hi @qwordy, can this issue be closed now?

No. It depends on #16797. I am reviewing and testing it.

[Juliehzl]

hi @qwordy, can this issue be closed now?

No. It depends on #16797. I am reviewing and testing it.

@qwordy #16797 is merged already. The issue should be resolved, right?

[qwordy]

We don't have two tenants for testing now. Microsoft tenant requires two factor authentication. We can't automate it.

[Juliehzl]

@brianttu1 could you try with latest azure cli? az upgrade could help you upgrade to latest cli. The issue should be fixed in PR #16797, but it is hard for us to testing. Could you help check if the issue is resolved?

[sgerace]

I can confirm that this appears to be fixed in the latest version of the Azure CLI (it was not working for us in 2.21.0, but is now working after upgrading to 2.27.2). Thanks!