This message was deleted.

This is the error I get

pulumi:pulumi:Stack (operator-environment.artigas-int.shared):
    error: an unhandled error occurred: 1 error occurred:
      * failed to lookup PostgreSQL server: rpc error: code = Unknown desc = invocation of azure-native:dbforpostgresql/v20210601preview:getServer returned an error: request failed /subscriptions/<****>/resourceGroups/default/providers/Microsoft.DBforPostgreSQL/flexibleServers/fr-test-4: azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to <https://management.azure.com/subscriptions/><****>/resourceGroups/default/providers/Microsoft.DBforPostgreSQL/flexibleServers/fr-test-4?api-version=2021-06-01-preview: StatusCode=404 -- Original Error: adal: Refresh request failed. Status Code = '404'. Response body: getting assigned identities for pod operator/operator-controller-manager-6fc967455-5rsls in CREATED state failed after 16 attempts, retry duration [5[]s, error: <nil>. Check MIC pod logs for identity assignment errors
     Endpoint <http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F>

Hi @thankful-thailand-77405, sorry you’re running into trouble here. • What version of pulumi-azure-native are you using? • Did you per chance set `msiEndpoint`/`ARM_MSI_ENDPOINT`?

Hello Thomas, thanks for replying. I am running 1.103, so one of the latest before the major version upgrade. I didnt set MSI ENPOINT, I assumed this shouldn't be touched.

Hi Federico, by workload identity, do you mean this and this? I haven’t yet configured this myself. It seems different from the scenarios https://www.pulumi.com/registry/packages/azure-native/installation-configuration/#authenticate-using-managed-service-identity-msi is intended for, like running a program on a trusted VM. The “adal” error in your logs is indeed odd, MSAL should be used. Did you set `useMsi`/`ARM_USE_MSI`?

Hello Thomas, I agree MSI vanilla use case is the one where Azure VMs are prepopulated w/ credentials that allow you to do "MSI" for secret-less auth of workloads. My comprehension is that, now, with new azure identity libraries MSI auth is also possible on containers using federated workload identities, and that these libraries (like MSAL) handle the token exchange needed all under the hood I read that this depends on the MSAL version being used though..