Error- "The requested operation cannot be executed on the entity in the current state" while deleting the front-door using CLI

[munishm]

It doesn't let you delete front door, when trying to delete it in subscription while other resources are allowed to be deleted. Note: This subscription is in disabled state, even though I was able to delete the other resources in subscription other than front-door.

Version Information:

azure-cli 2.2.0 *

command-modules-nspkg 2.0.3 core 2.2.0 * nspkg 3.0.4 telemetry 1.0.4

Extensions: azure-devops 0.17.0 application-insights 0.1.1 front-door 1.0.4

Python location '/opt/az/bin/python3'

Description of issue (in as much detail as possible)

Running the command: az network front-door delete --name --resource-group

output: BadRequest - The requested operation cannot be executed on the entity in the current state.

Debug output:

Command arguments: ['network', 'front-door', 'delete', '--name', 'fd-openhack-urlist-dev-gbl', '--resource-group', 'rg-openhack-urlist-dev-gbl', '--debug']
Event: Cli.PreExecute []
Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x7f8beacc1d08>, <function OutputProducer.on_global_arguments at 0x7f8bea7f9ae8>, <funct
ion CLIQuery.on_global_arguments at 0x7f8bea824b70>]
Event: CommandInvoker.OnPreCommandTableCreate []
Installed command modules ['acr', 'acs', 'advisor', 'ams', 'apim', 'appconfig', 'appservice', 'backup', 'batch', 'batchai', 'billing', 'botservice', 'cdn', 'cloud', 'cognitiveser
vices', 'configure', 'consumption', 'container', 'cosmosdb', 'deploymentmanager', 'dla', 'dls', 'dms', 'eventgrid', 'eventhubs', 'extension', 'feedback', 'find', 'hdinsight', 'in
teractive', 'iot', 'iotcentral', 'keyvault', 'kusto', 'lab', 'managedservices', 'maps', 'monitor', 'natgateway', 'netappfiles', 'network', 'policyinsights', 'privatedns', 'profil
e', 'rdbms', 'redis', 'relay', 'reservations', 'resource', 'role', 'search', 'security', 'servicebus', 'servicefabric', 'signalr', 'sql', 'sqlvm', 'storage', 'vm']
Loaded module 'acr' in 0.006 seconds.
Loaded module 'acs' in 0.023 seconds.
Loaded module 'advisor' in 0.001 seconds.
Event: CommandLoader.OnLoadCommandTable []
Loaded module 'ams' in 0.005 seconds.
Loaded module 'apim' in 0.002 seconds.
Loaded module 'appconfig' in 0.003 seconds.
Loaded module 'appservice' in 0.011 seconds.
Loaded module 'backup' in 0.004 seconds.
Event: CommandLoader.OnLoadCommandTable []
Loaded module 'batch' in 0.007 seconds.
Loaded module 'batchai' in 0.002 seconds.
Loaded module 'billing' in 0.001 seconds.
Loaded module 'botservice' in 0.003 seconds.
Event: CommandLoader.OnLoadCommandTable []
Loaded module 'cdn' in 0.039 seconds.
Loaded module 'cloud' in 0.002 seconds.
Loaded module 'cognitiveservices' in 0.001 seconds.
Loaded module 'configure' in 0.001 seconds.
Loaded module 'consumption' in 0.002 seconds.
Loaded module 'container' in 0.001 seconds.
Loaded module 'cosmosdb' in 0.005 seconds.
Loaded module 'deploymentmanager' in 0.002 seconds.
Loaded module 'dla' in 0.004 seconds.
Loaded module 'dls' in 0.003 seconds.
Loaded module 'dms' in 0.002 seconds.
Loaded module 'eventgrid' in 0.002 seconds.
Loaded module 'eventhubs' in 0.003 seconds.
Loaded module 'extension' in 0.001 seconds.
Loaded module 'feedback' in 0.001 seconds.
Loaded module 'find' in 0.001 seconds.
Loaded module 'hdinsight' in 0.002 seconds.
Loaded module 'interactive' in 0.000 seconds.
Loaded module 'iot' in 0.004 seconds.
Loaded module 'iotcentral' in 0.001 seconds.
Loaded module 'keyvault' in 0.005 seconds.
Loaded module 'kusto' in 0.002 seconds.
Loaded module 'lab' in 0.004 seconds.
Loaded module 'managedservices' in 0.001 seconds.
Loaded module 'maps' in 0.001 seconds.
Loaded module 'monitor' in 0.006 seconds.
Loaded module 'natgateway' in 0.001 seconds.
Event: CommandLoader.OnLoadCommandTable []
Loaded module 'netappfiles' in 0.003 seconds.
Loaded module 'network' in 0.027 seconds.
Loaded module 'policyinsights' in 0.002 seconds.
Loaded module 'privatedns' in 0.005 seconds.
Loaded module 'profile' in 0.001 seconds.
Loaded module 'rdbms' in 0.006 seconds.
Loaded module 'redis' in 0.002 seconds.
Loaded module 'relay' in 0.003 seconds.
Loaded module 'reservations' in 0.002 seconds.
Loaded module 'resource' in 0.010 seconds.
Loaded module 'role' in 0.004 seconds.
Loaded module 'search' in 0.002 seconds.
Loaded module 'security' in 0.002 seconds.
Loaded module 'servicebus' in 0.005 seconds.
Loaded module 'servicefabric' in 0.002 seconds.
Loaded module 'signalr' in 0.002 seconds.
Loaded module 'sql' in 0.009 seconds.
Loaded module 'sqlvm' in 0.002 seconds.
Event: CommandLoader.OnLoadCommandTable []
Loaded module 'storage' in 0.038 seconds.
Loaded module 'vm' in 0.014 seconds.
Loaded all modules in 0.305 seconds. (note: there's always an overhead with the first module loaded)
Extensions directory: '/home/munish/.azure/cliextensions'
Found 3 extensions: ['azure-devops', 'application-insights', 'front-door']
Extensions directory: '/home/munish/.azure/cliextensions'
Extension compatibility result: is_compatible=True cli_core_version=2.2.0 min_required=2.0.69 max_required=None
Extensions directory: '/home/munish/.azure/cliextensions'
Loaded extension 'azure-devops' in 0.050 seconds.
Extensions directory: '/home/munish/.azure/cliextensions'
Extension compatibility result: is_compatible=True cli_core_version=2.2.0 min_required=2.0.56 max_required=None
Extensions directory: '/home/munish/.azure/cliextensions'
Loaded extension 'application-insights' in 0.004 seconds.
Extensions directory: '/home/munish/.azure/cliextensions'
Extension compatibility result: is_compatible=True cli_core_version=2.2.0 min_required=2.0.68 max_required=None
Extensions directory: '/home/munish/.azure/cliextensions'
Loaded extension 'front-door' in 0.027 seconds.
Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x7f8be9fee7b8>]
az_command_data_logger : command args: network front-door delete --name {} --resource-group {} --debug
metadata file logging enabled - writing logs to '/home/munish/.azure/commands'.
Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument.<locals>.add_subscription_parameter at 0x7f8be9f84620>]
Event: CommandInvoker.OnPostArgumentLoad []
Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument.<locals>.add_ids_arguments at 0x7f8be9f44488>, <function register_cache_arguments.<locals>.add_cac
he_arguments at 0x7f8be9f44620>]
Event: CommandInvoker.OnCommandTableLoaded []
Event: CommandInvoker.OnPreParseArgs [<function _documentdb_deprecate at 0x7f8be789d6a8>]
Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x7f8bea7f9b70>, <function CLIQuery.handle_query_parameter at 0x7f8bea824bf8>, <function
 register_ids_argument.<locals>.parse_ids_arguments at 0x7f8be9f44510>, <function handler at 0x7f8be776bea0>, <function DevCommandsLoader.post_parse_args at 0x7f8be6efc9d8>]
Extensions directory: '/home/munish/.azure/cliextensions'
Extensions directory: '/home/munish/.azure/cliextensions'
az_command_data_logger : extension name: front-door
az_command_data_logger : extension version: 1.0.4
Getting management service client client_type=FrontDoorManagementClient
msrest.universal_http.requests : Configuring retry: max_retries=4, backoff_factor=0.8, max_backoff=90
msrest.service_client : Accept header absent and forced to application/json
attempting to read file /home/munish/.azure/accessTokens.json as utf-8-sig
adal-python : d03588ca-3aaa-426c-93a2-710fda3d7cf5 - Authority:Performing instance discovery: ...
adal-python : d03588ca-3aaa-426c-93a2-710fda3d7cf5 - Authority:Performing static instance discovery
adal-python : d03588ca-3aaa-426c-93a2-710fda3d7cf5 - Authority:Authority validated via static instance discovery
adal-python : d03588ca-3aaa-426c-93a2-710fda3d7cf5 - TokenRequest:Getting token from cache with refresh if necessary.
adal-python : d03588ca-3aaa-426c-93a2-710fda3d7cf5 - CacheDriver:finding with query keys: {'_clientId': '...', 'userId': '...'}
adal-python : d03588ca-3aaa-426c-93a2-710fda3d7cf5 - CacheDriver:Looking for potential cache entries: {'_clientId': '...', 'userId': '...'}
adal-python : d03588ca-3aaa-426c-93a2-710fda3d7cf5 - CacheDriver:Found 4 potential entries.
adal-python : d03588ca-3aaa-426c-93a2-710fda3d7cf5 - CacheDriver:Resource specific token found.
adal-python : d03588ca-3aaa-426c-93a2-710fda3d7cf5 - CacheDriver:Returning token from cache lookup, AccessTokenId: b'7Zz6ms1/mZNX32AGKJyjUIXT7TglVdr/VXlmiUtZfOc=', RefreshTokenId
: b'r+/4l2QHj6V/i8AsCYTuACXMmz2HAqUWG9yllZNUamA='
msrest.http_logger : Request URL: 'https://management.azure.com/subscriptions/10587334-7ba8-4367-84de-099426c363d4/resourceGroups/rg-openhack-urlist-dev-gbl/providers/Microsoft.N
etwork/frontDoors/fd-openhack-urlist-dev-gbl?api-version=2019-05-01'
msrest.http_logger : Request method: 'DELETE'
msrest.http_logger : Request headers:
msrest.http_logger :     'accept-language': 'en-US'
msrest.http_logger :     'Accept': 'application/json'
msrest.http_logger :     'User-Agent': 'python/3.6.5 (Linux-4.19.81-microsoft-standard-x86_64-with-debian-buster-sid) msrest/0.6.9 msrest_azure/0.6.2 azure-mgmt-frontdoor/0.1.0 A
zure-SDK-For-Python AZURECLI/2.2.0'
msrest.http_logger : Request body:
msrest.http_logger : None
msrest.universal_http : Configuring redirects: allow=True, max=30
msrest.universal_http : Configuring request: timeout=100, verify=True, cert=None
msrest.universal_http : Configuring proxies: ''
msrest.universal_http : Evaluate proxies against ENV settings: True
urllib3.connectionpool : Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool : https://management.azure.com:443 "DELETE /subscriptions/10587334-7ba8-4367-84de-099426c363d4/resourceGroups/rg-openhack-urlist-dev-gbl/providers/Microsof
t.Network/frontDoors/fd-openhack-urlist-dev-gbl?api-version=2019-05-01 HTTP/1.1" 400 147
msrest.http_logger : Response status: 400
msrest.http_logger : Response headers:
msrest.http_logger :     'Cache-Control': 'no-cache'
msrest.http_logger :     'Pragma': 'no-cache'
msrest.http_logger :     'Content-Length': '147'
msrest.http_logger :     'Content-Type': 'application/json; charset=utf-8'
msrest.http_logger :     'Content-Language': 'en-US'
msrest.http_logger :     'Expires': '-1'
msrest.http_logger :     'x-ms-request-id': 'c4cc6371-5101-4e73-a0de-377c7827f1dd'
msrest.http_logger :     'x-ms-client-request-id': 'ace60180-7a2f-11ea-977c-00155d42b3ce'
msrest.http_logger :     'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
msrest.http_logger :     'Server': 'Microsoft-IIS/8.5'
msrest.http_logger :     'X-AspNet-Version': '4.0.30319'
msrest.http_logger :     'X-Powered-By': 'ASP.NET'
msrest.http_logger :     'x-ms-ratelimit-remaining-subscription-deletes': '14999'
msrest.http_logger :     'x-ms-correlation-request-id': 'f25e119b-f490-441a-ab8b-5625b29cb985'
msrest.http_logger :     'x-ms-routing-request-id': 'WESTINDIA:20200409T065949Z:f25e119b-f490-441a-ab8b-5625b29cb985'
msrest.http_logger :     'X-Content-Type-Options': 'nosniff'
msrest.http_logger :     'Date': 'Thu, 09 Apr 2020 06:59:48 GMT'
msrest.http_logger : Response content:
msrest.http_logger : {
  "error": {
    "code": "BadRequest",
    "message": "The requested operation cannot be executed on the entity in the current state."
  }
}
msrest.exceptions : Operation returned an invalid status code 'Bad Request'
cli.azure.cli.core.util : BadRequest - The requested operation cannot be executed on the entity in the current state.
BadRequest - The requested operation cannot be executed on the entity in the current state.
az_command_data_logger : exit code: 1
telemetry.save : Save telemetry record of length 2568 in cache

---

[yonzhan]

add to S169

[sapinderpalsingh]

Just to add, this issue with is with azure portal as well, but this happened to me only when the subscription was disabled due to insufficient credit.

[ghost]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @aznetsuppgithub.

[ajklotz]

I'm in the same boat here. Can't remove resource group because I can't delete a front door app

[ghost]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @cdnfdsuppgithub.

[TheFrogPrince]

This exact same thing happens for me whenever one of the front-ends gets stuck in a situation like this, where it says it's still on step 1 of setting up the SSL certificates (at this point, certs that have expired). Can't delete, can't update.

No choice but to create a support ticket and have the team update the status on their end.

[thetoolsmith]

This error goes beyond just when you need to delete the front door. I have come into this on many cli front-door commands. Just now, I'm hitting it on configuring rules-engine through the cli. Run one command to create a rules-engine, then try to add action or something and I get "Conflict - The requested operation cannot be executed on the entity as another operation is in progress.". After closing sessions and waiting around 20-30 minutes, the secondary command succeeded. I then hit it again the next command I ran to associate it to a routing-rule. This seems to be a cli client side problem with any of the commands under the az network front-door command group.

[TheFrogPrince]

The way I believe it "works", Front Door manages tens or even hundreds of traffic entry points around the world. Anytime we make changes, particularly when we make changes that involve SSL configuration, even though the UI (or the CLI, as the case may be) gives you the impression that the work is completed, in reality, it is actually walking around to every single one of those entry points, and updating them with the requested changes... synchronously.

You would think... they would at least do us the kindness of starting to make the updates first in the region we are working in, but best I can tell, the updates start in Bangladesh somewhere and work their way west (a possible unintended side-effect of off-shoring). It's very slow. The more changes or more complicated your Front Door configuration, the longer it takes. A simple cert update took us almost an hour to complete. God help you if you need to fix production quickly.

[mihma]

Same error on a disabled subscription. Can't delete the Front Door.

[kevinmatthews-kpmg]

I feel like frontdoor is still not a "finished" product, there are a number of small issues that seem to affect it, to not saving with no error messages to more complicated such as certificates never provisioning.

I have had a few times now where we have provisioned a DNS entry correctly pointing with a CNAME to the frontdoor and it sits stuck in the domain verification stage forever, i've had to get a microsoft support agent to delete the whole thing so it can be started again - needs to be resolved urgently i'd say.