az webapp list shows CryptographyDeprecationWarning

balajisivaram15t commented 2 weeks ago

Describe the bug

We started noticing our scripts throwing warnings for az commands as below since last three days. We have been using azure cloud shell to run the az commands.

/usr/lib64/az/lib/python3.9/site-packages/paramiko/pkey.py:100: CryptographyDeprecationWarning: TripleDES has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.TripleDES and will be removed from this module in 48.0.0. "cipher": algorithms.TripleDES,

Related command

az webapp list, az appservice plan list

Errors

/usr/lib64/az/lib/python3.9/site-packages/paramiko/pkey.py:100: CryptographyDeprecationWarning: TripleDES has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.TripleDES and will be removed from this module in 48.0.0. "cipher": algorithms.TripleDES, /usr/lib64/az/lib/python3.9/site-packages/paramiko/transport.py:259: CryptographyDeprecationWarning: TripleDES has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.TripleDES and will be removed from this module in 48.0.0. "class": algorithms.TripleDES,

Issue script & Debug output

when running az appservice plan list --debug

cli.knack.cli: Command arguments: ['appservice', 'plan', 'list', '--debug'] cli.knack.cli: init debug log: Enable color in terminal. cli.knack.cli: Event: Cli.PreExecute [] cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x7f36de3851f0>, <function OutputProducer.on_global_arguments at 0x7f36de246b80>, <function CLIQuery.on_global_arguments at 0x7f36de1e0160>] cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate [] cli.azure.cli.core: Modules found from index for 'appservice': ['azure.cli.command_modules.appservice'] cli.azure.cli.core: Loading command modules: cli.azure.cli.core: Name Load Time Groups Commands cli.azure.cli.core: appservice 0.188 79 270 cli.azure.cli.core: Total (1) 0.188 79 270 cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_next'] cli.azure.cli.core: Loading extensions: cli.azure.cli.core: Name Load Time Groups Commands Directory cli.azure.cli.core: ai-examples 0.092 1 1 /usr/lib/python3.9/site-packages/azure-cli-extensions/ai-examples cli.azure.cli.core: Total (1) 0.092 1 1
cli.azure.cli.core: Loaded 80 groups, 271 commands. cli.azure.cli.core: Found a match in the command table. cli.azure.cli.core: Raw command : appservice plan list cli.azure.cli.core: Command table: appservice plan list cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x7f36dd63d790>] cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/home/msever03/.azure/commands/2024-10-08.12-22-32.appservice_plan_list.23067.log'. az_command_data_logger: command args: appservice plan list --debug cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x7f36dd6674c0>] /usr/lib64/az/lib/python3.9/site-packages/paramiko/pkey.py:100: CryptographyDeprecationWarning: TripleDES has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.TripleDES and will be removed from this module in 48.0.0. "cipher": algorithms.TripleDES, /usr/lib64/az/lib/python3.9/site-packages/paramiko/transport.py:259: CryptographyDeprecationWarning: TripleDES has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.TripleDES and will be removed from this module in 48.0.0. "class": algorithms.TripleDES, cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad [] cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x7f36dd60c4c0>, <function register_cache_arguments..add_cache_arguments at 0x7f36dd4f73a0>, <function register_upcoming_breaking_change_info..update_breaking_change_info at 0x7f36dd4f7430>] cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded [] cli.knack.cli: Event: CommandInvoker.OnPreParseArgs [] cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x7f36de246c10>, <function CLIQuery.handle_query_parameter at 0x7f36de1e01f0>, <function register_ids_argument..parse_ids_arguments at 0x7f36dd4f7310>] cli.azure.cli.core.commands.client_factory: Getting management service client client_type=WebSiteManagementClient urllib3.connectionpool: Starting new HTTP connection (1): localhost:50342 urllib3.connectionpool: http://localhost:50342/ "POST /oauth2/token HTTP/1.1" 200 2129 msrestazure.azure_active_directory: MSI: Retrieving a token from http://localhost:50342/oauth2/token , with payload {'resource': ' https://management.core.windows.net/'} cli.azure.cli.core.auth.adal_authentication: MSIAuthenticationWrapper.get_token: scopes=(' https://management.core.windows.net//.default',)) , kwargs={} urllib3.connectionpool: Starting new HTTP connection (1): localhost:50342 urllib3.connectionpool: http://localhost:50342/ "POST /oauth2/token HTTP/1.1" 200 2129 msrestazure.azure_active_directory: MSI: Retrieving a token from http://localhost:50342/oauth2/token , with payload {'resource': ' https://management.core.windows.net/'} cli.azure.cli.core.auth.adal_authentication: Normalize expires_on: '1728394545' -> 1728394545 cli.azure.cli.core.sdk.policies: Request URL: ' https://management.azure.com/subscriptions/8ff1cc25-ed8a-4312-99a0-c93dd224a948/providers/Microsoft.Web/serverfarms?detailed=true&api-version=2023-01-01' cli.azure.cli.core.sdk.policies: Request method: 'GET' cli.azure.cli.core.sdk.policies: Request headers: cli.azure.cli.core.sdk.policies: 'Accept': 'application/json' cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': 'fde2891e-856f-11ef-98d5-00155d2b970d' cli.azure.cli.core.sdk.policies: 'CommandName': 'appservice plan list' cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--debug' cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.65.0 (RPM) azsdk-python-core/1.28.0 Python/3.9.19 (Linux-6.1.91.1-microsoft-standard-x86_64-with-glibc2.35) cloud-shell/1.0' cli.azure.cli.core.sdk.policies: 'Authorization': '*****' cli.azure.cli.core.sdk.policies: Request body: cli.azure.cli.core.sdk.policies: This request has no body urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443 urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/8ff1cc25-ed8a-4312-99a0-c93dd224a948/providers/Microsoft.Web/serverfarms?detailed=true&api-version=2023-01-01 HTTP/1.1" 200 25818 cli.azure.cli.core.sdk.policies: Response status: 200 cli.azure.cli.core.sdk.policies: Response headers: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache' cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache' cli.azure.cli.core.sdk.policies: 'Content-Length': '25818' cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8' cli.azure.cli.core.sdk.policies: 'Expires': '-1' cli.azure.cli.core.sdk.policies: 'x-ms-original-request-ids': 'b2c43727-3794-40b5-8262-c9912f34ecfb, d468a5d2-cb89-4be0-99a4-a5d1f5685e87, fc45ccfd-69e7-494b-8c66-3689f94528a8, f71e3599-c082-4a2c-bc2b-6521daa9b673' cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-reads': '249' cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-global-reads': '3749' cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '3400d34c-ce4c-42d0-94cc-abeeb7b130f1' cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '3400d34c-ce4c-42d0-94cc-abeeb7b130f1' cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'EASTUS:20241008T122233Z:3400d34c-ce4c-42d0-94cc-abeeb7b130f1' cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains' cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff' cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE' cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': 'Ref A: 5D87FDD30EA84C328B6A3C6570BB8A43 Ref B: MNZ221060619039 Ref C: 2024-10-08T12:22:32Z' cli.azure.cli.core.sdk.policies: 'Date': 'Tue, 08 Oct 2024 12:22:33 GMT' cli.azure.cli.core.sdk.policies: Response content:

Expected behavior

It should list the appservice plan in the subscription without the warning

Environment Summary

{ "azure-cli": "2.65.0", "azure-cli-core": "2.65.0", "azure-cli-telemetry": "1.1.0", "extensions": { "ai-examples": "0.2.5", "datafactory": "1.0.2", "ml": "2.30.1", "ssh": "2.0.5" } }

Python Version: 3.9.19

Additional context

Please be informed these commands are being run inside the cloud shell so there is no alternative vm/system to test it.

yonzhan commented 2 weeks ago

Thank you for opening this issue, we will look into it.

microsoft-github-policy-service[bot] commented 2 weeks ago

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @AzureAppServiceCLI, @antcp.

UntiIted commented 2 weeks ago

Worth noting that similar issues have appeared before https://github.com/Azure/azure-cli/issues/25406 This is once again breaking scripts and pipelines, and there's no way to suppress it.

balajisivaram15t commented 1 week ago

Team, Any updates?

waggonerh commented 1 week ago

This is affecting our organization as well, most if not all pipelines inoperable.

Edit: This is happening on multiple CLI commands. We run physical agents, downgrading to 2.64.0 circumvents this error.

csanchez83 commented 1 week ago

Hi!!!

Any patch or recipe to fix this error??

Greetings!!

agravity-philipp commented 5 days ago

I would love to see some progress here. Any updates @yonzhan ?

brianhodgman commented 3 days ago

We've just encountered the same issue with az webapp list in our organisation, which is impacting numerous Azure DevOps pipelines. I suspect the Azure CLI update has recently been pushed to the Microsoft Hosted agents that are allocated to our agent pool.

Has there been any progress on this issue? Also any idea of a workaround so we can get back to deploying our apps?

manuelblum commented 3 days ago

@brianhodgman

One could use a workaround, as mentioned in this comment: https://github.com/Azure/azure-cli/issues/25406#issuecomment-1438417076

      # This is a workaround for a bug in Azure CLI 2.65.0, see Bug https://github.com/Azure/azure-cli/issues/30048
      - task: Bash@3
        name: InstallAzureCLI
        displayName: 'Install AZ CLI 2.64.0 as workaround'
        inputs:
          targetType: 'inline'
          script: |
            pip install azure-cli==2.64.0 --break-system-packages

      - task: AzureCLI@2
      ....

Looking forward to a fix 🙂

sit-md commented 3 days ago

@brianhodgman

One could use a workaround, as mentioned in this comment: #25406 (comment)

      # This is a workaround for a bug in Azure CLI 2.65.0, see Bug https://github.com/Azure/azure-cli/issues/30048
      - task: Bash@3
        name: InstallAzureCLI
        displayName: 'Install AZ CLI 2.64.0 as workaround'
        inputs:
          targetType: 'inline'
          script: |
            pip install azure-cli==2.64.0 --break-system-packages

      - task: AzureCLI@2
      ....

Looking forward to a fix 🙂

I tried the workaround but unfortunately --break-system-packages throws an error for me. If I remove it, it works but I receive other errors that versions do not match (but it goes through afterwards anyway). Any idea how to fix this?

brianhodgman commented 3 days ago

@brianhodgman

One could use a workaround, as mentioned in this comment: #25406 (comment)

      # This is a workaround for a bug in Azure CLI 2.65.0, see Bug https://github.com/Azure/azure-cli/issues/30048
      - task: Bash@3
        name: InstallAzureCLI
        displayName: 'Install AZ CLI 2.64.0 as workaround'
        inputs:
          targetType: 'inline'
          script: |
            pip install azure-cli==2.64.0 --break-system-packages

      - task: AzureCLI@2
      ....

Looking forward to a fix 🙂

Thanks for the suggestion @manuelblum! I had to update the command to the following for it to work in my environment, and it's working well. I'm looking forward to a proper fix too 🙂

- task: Bash@3
  name: InstallAzureCLI
  displayName: 'Install AZ CLI 2.64.0 as workaround'
  inputs:
    targetType: 'inline'
    script: |
      pip install --force-reinstall azure-cli==2.64.0

Hey @sit-md, maybe try the above to see if that works for you?

sit-md commented 3 days ago

Hey @sit-md, maybe try the above to see if that works for you?

This did it for us. Thank you very much! Pipeline is up and running again 👍

jaromirmikulik commented 2 days ago

From my perspective, it could be caused by: https://github.com/Azure/azure-cli/issues/30148

rLindorfer commented 2 days ago

This bug breaks our deploy pipelines too, but the fix mentioned above worked for us. Note: DO NOT forget the --force-reinstall flag!

- task: Bash@3
  name: InstallAzureCLI
  displayName: 'Install AZ CLI 2.64.0 as workaround'
  inputs:
    targetType: 'inline'
    script: |
      pip install --force-reinstall azure-cli==2.64.0

Azure / azure-cli