https://pulumi.com logo
#azure
Title
# azure
w

wet-noon-14291

02/08/2020, 10:53 PM
I'm working on a sample application in F# that I want to over engineer the hell out to learn me some new things. The plan is to use pulumi to handle the deployment. What I do want to deploy is the F# application I'm building on a kubernetes cluster that runs istio. The pulumi stuff will also be written in F#. So far I have ported a C# sample that sets up kubernetes that I was pointed to, but for some reason my deploy fails to create the active directory application due to "Insufficient privileges to complete the operation". Complete error
error: graphrbac.ApplicationsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Unknown" Message="Unknown service error" Details=[{"odata.error":{"code":"Authorization_RequestDenied","date":"2020-02-08T223551","message":{"lang":"en","value":"Insufficient privileges to complete the operation."},"requestId":"b8e3bf38-925b-4898-9d14-fc101c14e5c4"}}]
Any idea on how to debug this?
I think I should have sufficient privileges, since it should be my personal subscription connected to it. But I’m by no means an azure active directory expert and can be mistaking, that whole part of azure is overly complex IMO.
Is it anything I can try on the command line to figuring out what's up.
or in the UI to see if I can achieve what I'm doing here in the UI. Not sure what this represent in the UI though, is it "App registrations" that I can't create?
e

enough-oil-63049

02/09/2020, 12:57 AM
w

wet-noon-14291

02/09/2020, 7:42 PM
@colossal-room-15708 I managed to create an app through the portal and using the CLI, so I'm a little bit confused over which credentials that is used when I try to do it through Pulumi, and if they are using the same API as the CLI for creating the app or if the Pulumi command also does something else.
I thought Pulumi would use the account that I signed in with using
az login
I have a problem as described in this thread, and my general question is what account does pulumi use when doing azure commands? Is it the account that was used when running
az login
?
According to https://www.pulumi.com/docs/get-started/azure/configure/ it should use whatever I logged in with.
t

tall-librarian-49374

02/09/2020, 8:01 PM
Yes, it’s
az account show
by default unless you override with env variables
w

wet-noon-14291

02/09/2020, 8:05 PM
@tall-librarian-49374, thanks. Hmm. Any idea of what might causing my Pulumi deploy to fail: https://pulumi-community.slack.com/archives/CRVK66N5U/p1581202394064300 ?
t

tall-librarian-49374

02/09/2020, 8:05 PM
I haven’t seen this before, unfortunately
w

wet-noon-14291

02/09/2020, 8:59 PM
Is there a way to get the output from pulumi to show which account that is used? I tried verbose level 3 and 5 but that didn’t reveal that kind of information.
c

colossal-room-15708

02/09/2020, 9:27 PM
Can you show us a code snippet of what you're trying to do? I've not seen this error before.
w

wet-noon-14291

02/09/2020, 10:59 PM
I created a project only containing the pulumi stuff, and that sort of fixed it. I think the problem was that I was looking at multiple Pulumi templates at once, and one of them configured a service principal that should be used to actually execute pulumi (I guess that is what the
azure:clientId/clientSecret
are for). Moving everything over I removed those settings and it worked. Here is the code if you want a sample using F# to set up a kubernetes cluser on Azure. It's basically a port of the C# sample https://github.com/mastoj/pulumifsharpkubernetesdemo. If you have dotnet core 3.1 installed I think you should be able to clone and run
make deploy
(will use
-y
). Feel free to use the code as an F# sample if you like now when it works, I think.
t

tall-librarian-49374

02/10/2020, 7:26 AM
I’m happy you solved it! Would love to see your code as a PR to our examples repo 😉
w

wet-noon-14291

02/10/2020, 8:25 AM
Sure, I'll see what I can do @tall-librarian-49374
Here you go @tall-librarian-49374 https://github.com/pulumi/examples/pull/546 🙂
🎉 1
4 Views