[Question] Multiple Subscriptions.... Why? Need help!!!

[marcovanluyk]

Release version

APIOPS 5.1.1

Question Details

Hi all, I am fighting a lot of hours with these problem.

I have 2 Subscriptions: 1 for PROD, and 1 for NonProd. Therefore I have 2 ServiceConnections in DevOps and different variables in my variable group.

Expected behavior

Connection to my Prod Service Connection will be connected to my PROD subscription and the deployment is working fine.

Actual behavior

The Service Connection is connected to 2 Subscritions (PROD and NONPROD). Why? This is the root cause.

Publisher is asking for a subscription-id (set it manually). But if I sent it manually I get the following error: System.Net.Http.HttpRequestException: HTTP request to URI https://management.azure.com/subscriptions/$(AZURE_SUBSCRIPTION_ID)/resourceGroups/API-Management-prod-rg/providers/Microsoft.ApiManagement/service/mxxxx-prod-apim/namedValues/trxxxlity-url?api-version=2022-04-01-preview failed with status code 400. Content is '{"error":{"code":"InvalidSubscriptionId","message":"The provided subscription identifier '$(AZURE_SUBSCRIPTION_ID)' is malformed or invalid."}}'.
at common.HttpPipelineExtensions.Validate(Response response, Uri requestUri)

Reproduction Steps

Start publisher with 2 or more stages with different subscriptions.

[github-actions]

  Thank you for opening this issue! Please be patient while we will look into it and get back to you as this is an open source project. In the meantime make sure you take a look at the [closed issues](https://github.com/Azure/apiops/issues?q=is%3Aissue+is%3Aclosed) in case your question has already been answered. Don't forget to provide any additional information if needed (e.g. scrubbed logs, detailed feature requests,etc.).
  Whenever it's feasible, please don't hesitate to send a Pull Request (PR) our way. We'd greatly appreciate it, and we'll gladly assess and incorporate your changes.

[vandriot]

Hi @marcovanluyk,

I had the same issue, my apim are in different subscription depending on the environment.
The pipelines provided are just starter pipelines which allow people to modify to meet their specific requirements.

To make ApiOps tool work in my context, I did the following:

1. Updated the run-publisher-with-env.yaml file to add a new parameter called SERVICE_CONNECTION_NAME_ENV.
   Make sure to report the new parameter to the Set publishing variables task.
   

2. Create 2 variables in the apim-automation library, for example SERVICE_CONNECTION_NAME_DEV and SERVICE_CONNECTION_NAME_PRD and put as the value the name of service connection for each environment.

3. Update the run-publisher.yaml file to set the new parameter SERVICE_CONNECTION_NAME_ENV for both DEV and PRD stages with the variable SERVICE_CONNECTION_NAME_DEV for DEV environment and SERVICE_CONNECTION_NAME_PRD for PRD environment.
   

Let me know if this solves your issue.

[marcovanluyk]

@vandriot Thanks for your reply! I implented your code snippets but I still get the message:

"Multiple subscriptions are accessible. Please set the AZURE_SUBSCRIPTION_ID environment variable manually."

I see in the Set publishing variable section of the PROD deployment that the process is finding 2 subscriptions but I still don't know why. In the first steps of the same pipeline (deploy to Dev and Uat) the pipeline is referencing only 1 subscription....

Here is the code of the publisher pipeline:

[waelkdouh]

The powershell script we have causes this. You may have to modify it to adapt to your use case. Our code assumes a single subscription target otherwise it would be confusing.

[marcovanluyk]

OK! Thanks.... Do you mean the Powershell step....

And how can I modify it? Sorry for that question ;-)...

[waelkdouh]

Search the code base for the message you are receiving about setting the subscription manually. This way you will locate the code.

[marcovanluyk]

Ok. I found it. Thanks....

[vandriot]

@marcovanluyk so it means that your PROD service account has access to more than 1 subscription. You might want to check if it is normal.

I had a similar issue before, I didn't modify the PowerShell script in run-publisher-with-env.yaml.
Instead, I just added the following in my run-publisher.yaml pipeline:

I added a environment variable named AZURE_SUBSCRIPTION_ID and gave it the value of the target subscription.

[marcovanluyk]

@vandriot I will check it and give you a feedback.

[guythetechie]

Just for information, the publisher needs to know which subscription ID to use. It gets it from the AZURE_SUBSCRIPTION_ID environment variable.

apiops/tools/azdo_pipelines/run-publisher-with-env.yaml

Line 138 in 156314f

AZURE_SUBSCRIPTION_ID: $(AZURE_SUBSCRIPTION_ID)

If you've set the AZURE_SUBSCRIPTION_ID variable in your ADO pipeline (either directly in your YAML or in a variable group), the publisher will use it.

If you have not, the publisher will check which subscriptions can be accessed by the pipeline agent. If it can only access one subscription, the publisher will use that subscription. Otherwise, it will throw an error message.

apiops/tools/azdo_pipelines/run-publisher-with-env.yaml

Line 48 in 156314f

if (-not $env:AZURE_SUBSCRIPTION_ID) {