Managed Identity auth_source: msi no longer works with collection 1.11, returns KeyError: 'credential'

[gowenrw]

SUMMARY

In azure.azcollection version 1.10 managed identity auth_source: msi on tasks worked without errors.
Starting with azure.azcollection version 1.11 we get a traceback error on the file azure_rm_common.py with KeyError: 'credential'
This error happens when calling any of the modules in the collection.
Looking at the code for azure_rm_common.py three things are apparent

1. the credentials are good since the def _get_msi_credentials is not returning the defined error message for missing or bad credentials and
2. something is looking for 'credential' singular and the def _get_msi_credentials only returns 'credentials' plural and
3. a similar issue related to CLI credentials seems to have been fixed in DEV recently in the def _get_azure_cli_credentials area by adding a line 'credential': credentials to add the singular version.
   When manually editing the file azure_rm_common.py we were able to fix the managed identity issues.
   We found two different modifications in azure_rm_common.py that both work and don't know which one is correct:
4. In def _get_msi_credentials section on lines 1593:1608 add a new line in the return area to add 'credential': credentials
5. In this IF section on lines 1506:1509 modify the last line to change 'credential' to 'credentials'
   if self.credentials.get('credentials') is not None:
   # AzureCLI credentials
   self.azure_credentials = self.credentials['credentials']
   self.azure_credential_track2 = self.credentials['credential']
   Don't know the code well enough to understand which of these two fixes would correct the root bug versus masking it.

ISSUE TYPE

• Bug Report

COMPONENT NAME

azure_rm_common.py

ANSIBLE VERSION

Multiple

COLLECTION VERSION

azure.azcollection 1.11.0

STEPS TO REPRODUCE

Create a managed identity in Azure with contributor role on the subscription to be tested.
Run a playbook using any module and the auth_source: msi setting

  tasks:
    - name: "Test azure_rm_securitygroup_info"
      azure.azcollection.azure_rm_securitygroup_info:
        subscription_id: "{{ nsg_msi_test_sub }}"
        resource_group: "{{ nsg_msi_test_rg }}"
        name: "{{ nsg_msi_test_name }}"
        auth_source: msi

EXPECTED RESULTS

We expect the managed identity to work and allow the module to execute sucessfully.

ACTUAL RESULTS

What actually happens is a traceback error that ends in KeyError: 'credential'

{
    "module_stdout": "",
    "module_stderr": "Traceback (most recent call last):\n  File \"/var/lib/awx/.ansible/tmp/ansible-tmp-1644429743.4528656-96-165730162148775/AnsiballZ_azure_rm_securitygroup_info.py\", line 102, in <module>\n    _ansiballz_main()\n  File \"/var/lib/awx/.ansible/tmp/ansible-tmp-1644429743.4528656-96-165730162148775/AnsiballZ_azure_rm_securitygroup_info.py\", line 94, in _ansiballz_main\n    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n  File \"/var/lib/awx/.ansible/tmp/ansible-tmp-1644429743.4528656-96-165730162148775/AnsiballZ_azure_rm_securitygroup_info.py\", line 40, in invoke_module\n    runpy.run_module(mod_name='ansible_collections.azure.azcollection.plugins.modules.azure_rm_securitygroup_info', init_globals=None, run_name='__main__', alter_sys=True)\n  File \"/usr/lib64/python3.6/runpy.py\", line 205, in run_module\n    return _run_module_code(code, init_globals, run_name, mod_spec)\n  File \"/usr/lib64/python3.6/runpy.py\", line 96, in _run_module_code\n    mod_name, mod_spec, pkg_name, script_name)\n  File \"/usr/lib64/python3.6/runpy.py\", line 85, in _run_code\n    exec(code, run_globals)\n  File \"/tmp/ansible_azure.azcollection.azure_rm_securitygroup_info_payload_ux3w469s/ansible_azure.azcollection.azure_rm_securitygroup_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_securitygroup_info.py\", line 393, in <module>\n  File \"/tmp/ansible_azure.azcollection.azure_rm_securitygroup_info_payload_ux3w469s/ansible_azure.azcollection.azure_rm_securitygroup_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_securitygroup_info.py\", line 389, in main\n  File \"/tmp/ansible_azure.azcollection.azure_rm_securitygroup_info_payload_ux3w469s/ansible_azure.azcollection.azure_rm_securitygroup_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_securitygroup_info.py\", line 335, in __init__\n  File \"/tmp/ansible_azure.azcollection.azure_rm_securitygroup_info_payload_ux3w469s/ansible_azure.azcollection.azure_rm_securitygroup_info_payload.zip/ansible_collections/azure/azcollection/plugins/module_utils/azure_rm_common.py\", line 464, in __init__\n  File \"/tmp/ansible_azure.azcollection.azure_rm_securitygroup_info_payload_ux3w469s/ansible_azure.azcollection.azure_rm_securitygroup_info_payload.zip/ansible_collections/azure/azcollection/plugins/module_utils/azure_rm_common.py\", line 1509, in __init__\nKeyError: 'credential'\n",
    "exception": "Traceback (most recent call last):\n  File \"/var/lib/awx/.ansible/tmp/ansible-tmp-1644429743.4528656-96-165730162148775/AnsiballZ_azure_rm_securitygroup_info.py\", line 102, in <module>\n    _ansiballz_main()\n  File \"/var/lib/awx/.ansible/tmp/ansible-tmp-1644429743.4528656-96-165730162148775/AnsiballZ_azure_rm_securitygroup_info.py\", line 94, in _ansiballz_main\n    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n  File \"/var/lib/awx/.ansible/tmp/ansible-tmp-1644429743.4528656-96-165730162148775/AnsiballZ_azure_rm_securitygroup_info.py\", line 40, in invoke_module\n    runpy.run_module(mod_name='ansible_collections.azure.azcollection.plugins.modules.azure_rm_securitygroup_info', init_globals=None, run_name='__main__', alter_sys=True)\n  File \"/usr/lib64/python3.6/runpy.py\", line 205, in run_module\n    return _run_module_code(code, init_globals, run_name, mod_spec)\n  File \"/usr/lib64/python3.6/runpy.py\", line 96, in _run_module_code\n    mod_name, mod_spec, pkg_name, script_name)\n  File \"/usr/lib64/python3.6/runpy.py\", line 85, in _run_code\n    exec(code, run_globals)\n  File \"/tmp/ansible_azure.azcollection.azure_rm_securitygroup_info_payload_ux3w469s/ansible_azure.azcollection.azure_rm_securitygroup_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_securitygroup_info.py\", line 393, in <module>\n  File \"/tmp/ansible_azure.azcollection.azure_rm_securitygroup_info_payload_ux3w469s/ansible_azure.azcollection.azure_rm_securitygroup_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_securitygroup_info.py\", line 389, in main\n  File \"/tmp/ansible_azure.azcollection.azure_rm_securitygroup_info_payload_ux3w469s/ansible_azure.azcollection.azure_rm_securitygroup_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_securitygroup_info.py\", line 335, in __init__\n  File \"/tmp/ansible_azure.azcollection.azure_rm_securitygroup_info_payload_ux3w469s/ansible_azure.azcollection.azure_rm_securitygroup_info_payload.zip/ansible_collections/azure/azcollection/plugins/module_utils/azure_rm_common.py\", line 464, in __init__\n  File \"/tmp/ansible_azure.azcollection.azure_rm_securitygroup_info_payload_ux3w469s/ansible_azure.azcollection.azure_rm_securitygroup_info_payload.zip/ansible_collections/azure/azcollection/plugins/module_utils/azure_rm_common.py\", line 1509, in __init__\nKeyError: 'credential'\n",
    "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error",
    "rc": 1,
    "_ansible_no_log": false,
    "changed": false
}

[chadgeary]

For:

    - name: Get ph_password from Azure Vault Secret
      azure.azcollection.azure_rm_keyvaultsecret_info:
        auth_source: msi
        vault_uri: "https://{{ ph_prefix }}-secret-{{ ph_suffix }}.vault.azure.net"
        name: "{{ ph_prefix }}-secret"
        version: "current"
      register: ph_password

Full verbosity:

The full traceback is:
Traceback (most recent call last):
  File "/root/.ansible/tmp/ansible-tmp-1644901939.280348-22275-103308931251022/AnsiballZ_azure_rm_keyvaultsecret_info.py", line 100, in <module>
    _ansiballz_main()
  File "/root/.ansible/tmp/ansible-tmp-1644901939.280348-22275-103308931251022/AnsiballZ_azure_rm_keyvaultsecret_info.py", line 92, in _ansiballz_main
    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)
  File "/root/.ansible/tmp/ansible-tmp-1644901939.280348-22275-103308931251022/AnsiballZ_azure_rm_keyvaultsecret_info.py", line 41, in invoke_module
    run_name='__main__', alter_sys=True)
  File "/usr/lib/python3.6/runpy.py", line 205, in run_module
    return _run_module_code(code, init_globals, run_name, mod_spec)
  File "/usr/lib/python3.6/runpy.py", line 96, in _run_module_code
    mod_name, mod_spec, pkg_name, script_name)
  File "/usr/lib/python3.6/runpy.py", line 85, in _run_code
    exec(code, run_globals)
  File "/tmp/ansible_azure_rm_keyvaultsecret_info_payload_mcgnw12_/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py", line 430, in <module>
  File "/tmp/ansible_azure_rm_keyvaultsecret_info_payload_mcgnw12_/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py", line 426, in main
  File "/tmp/ansible_azure_rm_keyvaultsecret_info_payload_mcgnw12_/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py", line 239, in __init__
  File "/tmp/ansible_azure_rm_keyvaultsecret_info_payload_mcgnw12_/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/module_utils/azure_rm_common.py", line 464, in __init__
  File "/tmp/ansible_azure_rm_keyvaultsecret_info_payload_mcgnw12_/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/module_utils/azure_rm_common.py", line 1509, in __init__
KeyError: 'credential'
fatal: [localhost]: FAILED! => {
    "changed": false,
    "module_stderr": "Traceback (most recent call last):\n  File \"/root/.ansible/tmp/ansible-tmp-1644901939.280348-22275-103308931251022/AnsiballZ_azure_rm_keyvaultsecret_info.py\", line 100, in <module>\n    _ansiballz_main()\n  File \"/root/.ansible/tmp/ansible-tmp-1644901939.280348-22275-103308931251022/AnsiballZ_azure_rm_keyvaultsecret_info.py\", line 92, in _ansiballz_main\n    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n  File \"/root/.ansible/tmp/ansible-tmp-1644901939.280348-22275-103308931251022/AnsiballZ_azure_rm_keyvaultsecret_info.py\", line 41, in invoke_module\n    run_name='__main__', alter_sys=True)\n  File \"/usr/lib/python3.6/runpy.py\", line 205, in run_module\n    return _run_module_code(code, init_globals, run_name, mod_spec)\n  File \"/usr/lib/python3.6/runpy.py\", line 96, in _run_module_code\n    mod_name, mod_spec, pkg_name, script_name)\n  File \"/usr/lib/python3.6/runpy.py\", line 85, in _run_code\n    exec(code, run_globals)\n  File \"/tmp/ansible_azure_rm_keyvaultsecret_info_payload_mcgnw12_/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py\", line 430, in <module>\n  File \"/tmp/ansible_azure_rm_keyvaultsecret_info_payload_mcgnw12_/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py\", line 426, in main\n  File \"/tmp/ansible_azure_rm_keyvaultsecret_info_payload_mcgnw12_/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py\", line 239, in __init__\n  File \"/tmp/ansible_azure_rm_keyvaultsecret_info_payload_mcgnw12_/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/module_utils/azure_rm_common.py\", line 464, in __init__\n  File \"/tmp/ansible_azure_rm_keyvaultsecret_info_payload_mcgnw12_/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/module_utils/azure_rm_common.py\", line 1509, in __init__\nKeyError: 'credential'\n",
    "module_stdout": "",
    "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error",
    "rc": 1
}

[NeckBeardPrince]

BUMP

[gowenrw]

Bump for visibility. MI's not working is a big issue. Seems to be an easy fix. Hopefully this will get some traction soon.