Skip to content

fix(ci): use variable reference for AllNodesClientId in e2e test stage#1683

Merged
zanejohnson-azure merged 1 commit into
ci_prodfrom
zanejohnson-azure/fix-all-nodes-client-id-var
May 14, 2026
Merged

fix(ci): use variable reference for AllNodesClientId in e2e test stage#1683
zanejohnson-azure merged 1 commit into
ci_prodfrom
zanejohnson-azure/fix-all-nodes-client-id-var

Conversation

@zanejohnson-azure
Copy link
Copy Markdown
Contributor

Problem

The ci-logs-dev-aks-all-nodes E2E test was failing on KubePodInventory (and other log-query tests) with:

Failed to query logs: DefaultAzureCredential: failed to acquire a token.
...
ManagedIdentityCredential authentication failed. the requested identity isn't assigned to this resource
{
  "error": "invalid_request",
  "error_description": "Identity not found"
}

Root cause

In .pipelines/azure_pipeline_mergedbranches.yaml, the E2E test stage for the ci-logs-dev-aks-all-nodes cluster was passing the literal string 'AllNodesClientId' as azureClientId instead of the variable reference $(AllNodesClientId).

Every other cluster stage in the file uses the $(...) form (e.g. $(AksWorkLoadIdentityClientId), $(WcusFipsClientId), $(NetworkFlowLogsClientId)), which substitutes the actual workload-identity client GUID from the variable group. The literal string was being plumbed all the way into the test pod as AZURE_CLIENT_ID, so no managed identity matched and token acquisition failed.

Fix

-          azureClientId: 'AllNodesClientId'
+          azureClientId: $(AllNodesClientId)

Note

This assumes a variable named AllNodesClientId exists in the variable group bound to this pipeline (containing the workload-identity client ID GUID for the ci-logs-dev-aks-all-nodes cluster). If it doesn't yet, it needs to be added there alongside the other *ClientId variables — otherwise the substitution will be empty and the test will still fail with the same auth error.

The ci-logs-dev-aks-all-nodes E2E test stage was passing the literal string 'AllNodesClientId' as azureClientId instead of the variable reference $(AllNodesClientId). This caused the test pod's workload identity to be configured with a non-GUID client ID, resulting in ManagedIdentityCredential failing with 'Identity not found' when querying Log Analytics.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@zanejohnson-azure zanejohnson-azure requested a review from a team as a code owner May 13, 2026 22:27
@zanejohnson-azure zanejohnson-azure merged commit dec249e into ci_prod May 14, 2026
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants