I m using Pulumi with GitHub actions To authenticate with Az

Question

I m using Pulumi with GitHub actions To authenticate with Azure I m using a service principal Locally it works great I m using my own user to login to the CLI locally however when it executes in the GitHub Action it throws a Terraform Error related to the `skip provider registration` flag Any ideas why this behaviour occurs and what is a workaround in Pulumi Note This only occurs when I am using a method for Getting an existing registry by name and resource group If I am creating resources I am experiencing no issues ```Error invocation of azure containerservice getRegistry getRegistry returned an error 1 error occurred Error ensuring Resource Providers are registered Terraform automatically attempts to register the Resource Providers it supports to ensure it s able to provision resources If you don t have permission to register Resource Providers you may wish to use the skip provider registration flag in the Provider block to disable this functionality Please note that if you opt out of Resource Provider Registration and Terraform tries to provision a resource from a Resource Provider which is unregistered then the errors may appear misleading for example gt API version 2019 XX XX was not found for Microsoft Foo ```

acoustic-alarm-43219 · Answer

Maybe the service principle doesn t have correct permissions

white-cat-90296 · Answer

That was my first thought as well but it seems like it has contributor access across the board

acoustic-alarm-43219 · Answer

HHmmm i would double check that the SP has register action rights on the sub I mean yes i believe the Contributor role should have that but worth checking I had some simliar issue with Contributor amp Storage Account Contributor roles a few weeks back as MSFT had made some changes

white-cat-90296 · Answer

Thanks for the input John I actually found a solution I ll detail it below for anybody who bumps into this issue in the future sos

white-cat-90296 · Answer

The solution is pretty simple Instead of using the ` pulumi azure` npm package make sure you re using the ` pulumi azure native` package So a simple change to the code ``` Instead of something like this import as azure from pulumi azure const registry = azure containerservice getRegistry name myregistryname resourceGroupName myresourcegroupname ==================================================== Use something like THIS instead Notice different package import as containerregistry from pulumi azure native containerregistry const registry = containerregistry getRegistry registryName myregistryname resourceGroupName myresourcegroupname ```

white-cat-90296 · Answer

Can t explain the underlying issue but this is a solution that worked for me thumbsup

boundless-car-60268 · Answer

The other solution is to set the `SkipProviderRegistration` flag to true in the Azure config This can be done by adding the following to the `config` section in the yaml `azure skip provider registration true `

boundless-car-60268 · Answer

For various reasons we ve found some things that the azure native package doesn t support as well as the azure package and vice versa so we re currently using a mixture of the two

boundless-car-60268 · Answer

It s Terraform s fault that you need to skip provider registration if you don t have the sufficient permissions I think it tries to register the providers for anything you re trying to use even if they re already registered I had the same issue when using Terraform directly and the `azure` provider uses Terraform under the covers

white-cat-90296 · Answer

My sense was that Terraform actually tries to register providers for everything that it supports not just what you re trying to use I ve seen some errors for services completely unrelated to what I m working with e g machine learning

white-cat-90296 · Answer

Either way thanks for the heads up the config tip is very useful