# azure.azcollection azure\_rm.yml inventory plugin failing to use az login credentials in execution environment **URL:** \ **Category:** Ansible Project\ **Tags:** azure, galaxy-ng, ee\ **Created:** [July 24, 2023, 11:21am UTC](https://forum.ansible.com/t/azure-azcollection-azure-rm-yml-inventory-plugin-failing-to-use-az-login-credentials-in-execution-environment/38255 "2023-07-24T11:21:08Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Will\_McDonald](https://avatars.discourse-cdn.com/v4/letter/w/f475e1/32.png) [@Will\_McDonald](https://forum.ansible.com/u/Will_McDonald)\ **Post date:** [July 24, 2023, 11:21am UTC](https://forum.ansible.com/t/azure-azcollection-azure-rm-yml-inventory-plugin-failing-to-use-az-login-credentials-in-execution-environment/38255/1 "2023-07-24T11:21:08Z")
Hi all, I was looking for some help debugging an unusual issue I’m seeing with azure.azcollection and the azure-cli in an Ansible execution environment. TL;DR, if I manually build a container, pip install ansible-core, ansible-galaxy install the azure.azcollection, then pip install its requirements, install azure-cli, setup a dynamic inventory plugin, az login and then run ansible-inventory, everything works. If I use ansible-builder to accomplish the same end result, ansible-inventory fails with the following stack trace: [root@3209917451f4 runner]# ansible-inventory -i inventory/azure\_rm.yml --graph [WARNING]: \* Failed to parse /runner/inventory/azure\_rm.yml with auto plugin: Failed to get credentials. Either pass as parameters, set environment variables, define a profile in ~/.azure/credentials, or install Azure CLI and log in (`az login`). [WARNING]: \* Failed to parse /runner/inventory/azure\_rm.yml with ini plugin: Invalid host pattern ‘plugin:’ supplied, ending in ‘:’ is not allowed, this character is reserved to provide a port. [WARNING]: Unable to parse /runner/inventory/azure\_rm.yml as an inventory source [WARNING]: No inventory was parsed, only implicit localhost is available @all: > –@ungrouped: > [root@3209917451f4 runner]# ansible-inventory -vvv -i inventory/azure\_rm.yml --graph > ansible-inventory [core 2.15.2] > config file = /runner/project/ansible.cfg > configured module search path = [‘/root/.ansible/plugins/modules’, ‘/usr/share/ansible/plugins/modules’] > ansible python module location = /usr/local/lib/python3.11/site-packages/ansible > ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections > executable location = /usr/local/bin/ansible-inventory > python version = 3.11.4 (main, Jun 7 2023, 00:00:00) [GCC 13.1.1 20230511 (Red Hat 13.1.1-2)] (/usr/bin/python3) > jinja version = 3.1.2 > libyaml = True > Using /runner/project/ansible.cfg as config file > Using inventory plugin ‘ansible\_collections.azure.azcollection.plugins.inventory.azure\_rm’ to process inventory source ‘/runner/inventory/azure\_rm.yml’ > [WARNING]: \* Failed to parse /runner/inventory/azure\_rm.yml with auto plugin: Failed to get credentials. Either pass as parameters, set environment variables, define a profile in ~/.azure/credentials, or install Azure CLI and log in (`az login`). > File “/usr/local/lib/python3.11/site-packages/ansible/inventory/manager.py”, line 293, in parse\_source > plugin.parse(self.\_inventory, self.\_loader, source, cache=cache) > File “/usr/local/lib/python3.11/site-packages/ansible/plugins/inventory/auto.py”, line 59, in parse > plugin.parse(inventory, loader, path, cache=cache) > File “/usr/share/ansible/collections/ansible\_collections/azure/azcollection/plugins/inventory/azure\_rm.py”, line 221, in parse > self.\_credential\_setup() > File “/usr/share/ansible/collections/ansible\_collections/azure/azcollection/plugins/inventory/azure\_rm.py”, line 242, in \_credential\_setup > self.azure\_auth = AzureRMAuth(\*\*auth\_options) > ^^^^^^^^^^^^^^^^^^^^^^^^^^^ > File “/usr/share/ansible/collections/ansible\_collections/azure/azcollection/plugins/module\_utils/azure\_rm\_common.py”, line 1514, in **init** > self.fail("Failed to get credentials. Either pass as parameters, set environment variables, " > File “/usr/share/ansible/collections/ansible\_collections/azure/azcollection/plugins/module\_utils/azure\_rm\_common.py”, line 1640, in fail > self.\_fail\_impl(msg) > File “/usr/share/ansible/collections/ansible\_collections/azure/azcollection/plugins/module\_utils/azure\_rm\_common.py”, line 1643, in \_default\_fail\_impl > raise AzureRMAuthException(msg) > [WARNING]: \* Failed to parse /runner/inventory/azure\_rm.yml with ini plugin: Invalid host pattern ‘plugin:’ supplied, ending in ‘:’ is not allowed, this character is reserved to provide a port. > File “/usr/local/lib/python3.11/site-packages/ansible/inventory/manager.py”, line 293, in parse\_source > plugin.parse(self.\_inventory, self.\_loader, source, cache=cache) > File “/usr/local/lib/python3.11/site-packages/ansible/plugins/inventory/ini.py”, line 137, in parse > raise AnsibleParserError(e) > [WARNING]: Unable to parse /runner/inventory/azure\_rm.yml as an inventory source > [WARNING]: No inventory was parsed, only implicit localhost is available > @all: > –@ungrouped: This is in a running instance of the ansible-builder built container, az login has successfully run, I can az account show/az vm list and see the subscription, tennant ID, resources etc. I’ve done all the usual Googling and as much RTFMing as I can but haven’t found anything that would explain the difference in behaviour. More debug info below from the non-working ansible-builder container in case it helps. The behaviour persists whether podman or docker is used for the build. The only thing that seems obviously different between the two scenarios is that ansible-builder is building the EE with dumb-init? Any suggestions are greatly appreciated. Cheers, Will. ---
**Author:** ![Will\_McDonald](https://avatars.discourse-cdn.com/v4/letter/w/f475e1/32.png) [@Will\_McDonald](https://forum.ansible.com/u/Will_McDonald)\ **Post date:** [July 24, 2023, 11:27am UTC](https://forum.ansible.com/t/azure-azcollection-azure-rm-yml-inventory-plugin-failing-to-use-az-login-credentials-in-execution-environment/38255/2 "2023-07-24T11:27:41Z")
Oh, and one more potentially useful data point, if I switch auth\_source to explicitly ‘cli’ in the inventory plugin config I see the following: [root@3209917451f4 runner]# cat inventory/azure\_rm.yml plugin: azure.azcollection.azure\_rm auth\_source: cli [root@3209917451f4 runner]# ansible-inventory -vvv -i inventory/azure\_rm.yml --graph ansible-inventory [core 2.15.2] config file = /runner/project/ansible.cfg configured module search path = [‘/root/.ansible/plugins/modules’, ‘/usr/share/ansible/plugins/modules’] ansible python module location = /usr/local/lib/python3.11/site-packages/ansible ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections executable location = /usr/local/bin/ansible-inventory python version = 3.11.4 (main, Jun 7 2023, 00:00:00) [GCC 13.1.1 20230511 (Red Hat 13.1.1-2)] (/usr/bin/python3) jinja version = 3.1.2 libyaml = True Using /runner/project/ansible.cfg as config file Using inventory plugin ‘ansible\_collections.azure.azcollection.plugins.inventory.azure\_rm’ to process inventory source ‘/runner/inventory/azure\_rm.yml’ **[WARNING]: \* Failed to parse /runner/inventory/azure\_rm.yml with auto plugin: Failed to import the required Python library (azure-cli) on 3209917451f4’s Python /usr/bin/python3. This is required for `cli` auth\_source. Please read the module documentation and install it in the** **appropriate location. If the required library is installed, but Ansible is using the wrong Python interpreter, please consult the documentation on ansible\_python\_interpreter** File “/usr/local/lib/python3.11/site-packages/ansible/inventory/manager.py”, line 293, in parse\_source plugin.parse(self.\_inventory, self.\_loader, source, cache=cache) File “/usr/local/lib/python3.11/site-packages/ansible/plugins/inventory/auto.py”, line 59, in parse plugin.parse(inventory, loader, path, cache=cache) File “/usr/share/ansible/collections/ansible\_collections/azure/azcollection/plugins/inventory/azure\_rm.py”, line 221, in parse self.\_credential\_setup() File “/usr/share/ansible/collections/ansible\_collections/azure/azcollection/plugins/inventory/azure\_rm.py”, line 242, in \_credential\_setup self.azure\_auth = AzureRMAuth(\*\*auth\_options) ^^^^^^^^^^^^^^^^^^^^^^^^^^^ File “/usr/share/ansible/collections/ansible\_collections/azure/azcollection/plugins/module\_utils/azure\_rm\_common.py”, line 1493, in **init** self.credentials = self.\_get\_credentials( ^^^^^^^^^^^^^^^^^^^^^^ File “/usr/share/ansible/collections/ansible\_collections/azure/azcollection/plugins/module\_utils/azure\_rm\_common.py”, line 1759, in \_get\_credentials self.fail(msg=missing\_required\_lib(‘azure-cli’, reason=‘for `cli` auth\_source’), File “/usr/share/ansible/collections/ansible\_collections/azure/azcollection/plugins/module\_utils/azure\_rm\_common.py”, line 1640, in fail self.\_fail\_impl(msg) File “/usr/share/ansible/collections/ansible\_collections/azure/azcollection/plugins/module\_utils/azure\_rm\_common.py”, line 1643, in \_default\_fail\_impl raise AzureRMAuthException(msg) [WARNING]: \* Failed to parse /runner/inventory/azure\_rm.yml with ini plugin: Invalid host pattern ‘plugin:’ supplied, ending in ‘:’ is not allowed, this character is reserved to provide a port. File “/usr/local/lib/python3.11/site-packages/ansible/inventory/manager.py”, line 293, in parse\_source plugin.parse(self.\_inventory, self.\_loader, source, cache=cache) File “/usr/local/lib/python3.11/site-packages/ansible/plugins/inventory/ini.py”, line 137, in parse raise AnsibleParserError(e) [WARNING]: Unable to parse /runner/inventory/azure\_rm.yml as an inventory source [WARNING]: No inventory was parsed, only implicit localhost is available @all: > –@ungrouped: If I run python3 in the container, I can successfully import azure.core.cli modules: [root@3209917451f4 runner]# python3 Python 3.11.4 (main, Jun 7 2023, 00:00:00) [GCC 13.1.1 20230511 (Red Hat 13.1.1-2)] on linux Type “help”, “copyright”, “credits” or “license” for more information. > > > import azure.cli.core > > > dir(azure.cli.core) > > > [‘ALWAYS\_LOADED\_EXTENSIONS’, ‘ALWAYS\_LOADED\_MODULES’, ‘ARGCOMPLETE\_ENV\_NAME’, ‘ArgumentsContext’, ‘AzCLILocalContext’, ‘AzCli’, ‘AzCommandsLoader’, ‘CLI’, ‘CLICommandsLoader’, ‘CLIError’, ‘CaseInsensitiveList’, ‘CommandIndex’, ‘EVENT\_FAILED\_EXTENSION\_LOAD’, ‘EXCLUDED\_PARAMS’, ‘ExperimentalItem’, ‘LocalContextAction’, ‘MainCommandsLoader’, ‘ModExtensionSuppress’, ‘PreviewItem’, ‘ **builtins** ’, ‘ **cached** ’, ‘ **doc** ’, ‘ **file** ’, ‘ **loader** ’, ‘ **name** ’, ‘ **package** ’, ‘ **path** ’, ‘ **spec** ’, ‘ **version** ’, ‘\_configure\_knack’, ‘extract\_args\_from\_signature’, ‘extract\_full\_summary\_from\_signature’, ‘get\_default\_cli’, ‘get\_logger’, ‘local\_context’, ‘logger’, ‘os’, ‘sys’, ‘timeit’] > > > dir(azure.cli.core.AzCli) > > > [‘ **class** ’, ‘ **delattr** ’, ‘ **dict** ’, ‘ **dir** ’, ‘ **doc** ’, ‘ **eq** ’, ‘ **format** ’, ‘ **ge** ’, ‘ **getattribute** ’, ‘ **getstate** ’, ‘ **gt** ’, ‘ **hash** ’, ‘ **init** ’, ‘ **init\_subclass** ’, ‘ **le** ’, ‘ **lt** ’, ‘ **module** ’, ‘ **ne** ’, ‘ **new** ’, ‘ **reduce** ’, ‘ **reduce\_ex** ’, ‘ **repr** ’, ‘ **setattr** ’, ‘ **sizeof** ’, ‘ **str** ’, ‘ **subclasshook** ’, ‘ **weakref** ’, ‘\_configure\_style’, ‘\_print\_init\_log’, ‘\_should\_enable\_color’, ‘\_should\_show\_version’, ‘exception\_handler’, ‘get\_cli\_version’, ‘get\_progress\_controller’, ‘get\_runtime\_version’, ‘invoke’, ‘raise\_event’, ‘refresh\_request\_id’, ‘register\_event’, ‘save\_local\_context’, ‘show\_version’, ‘unregister\_event’] ---
**Author:** ![Will\_McDonald](https://avatars.discourse-cdn.com/v4/letter/w/f475e1/32.png) [@Will\_McDonald](https://forum.ansible.com/u/Will_McDonald)\ **Post date:** [July 25, 2023, 11:45am UTC](https://forum.ansible.com/t/azure-azcollection-azure-rm-yml-inventory-plugin-failing-to-use-az-login-credentials-in-execution-environment/38255/3 "2023-07-25T11:45:24Z")
Just in case it’s of any use to someone Googling or trawling the archives, switching from prepend\_final to append\_final in additional\_build\_steps in the EE definition seems to resolve /whatever/ the issue is: [https://github.com/wmcdonald404/ee-sandbox/blob/main/.github/workflows/ee-deploy.yml#L83](https://github.com/wmcdonald404/ee-sandbox/blob/main/.github/workflows/ee-deploy.yml#L83) additional\_build\_steps: append\_final: | RUN rpm --import [https://packages.microsoft.com/keys/microsoft.asc](https://packages.microsoft.com/keys/microsoft.asc) RUN dnf install -y [https://packages.microsoft.com/config/fedora/38/packages-microsoft-prod.rpm](https://packages.microsoft.com/config/fedora/38/packages-microsoft-prod.rpm) RUN dnf -y install azure-cli It seems like the azure-cli RPM-based install pulls in all its packaged dependencies correctly and shoves them into /usr/lib//site-packages. And the pip install ansible-builder calls populates /usr/local/lib//site-packages. So I’m not sure _quite_ what’s happening in the sequencing of package/build that would be significantly different but switching prepend to append seems to do the trick.