search

microsoft / AzureTRE

An accelerator to help organizations build Trusted Research Environments on Azure.
https://microsoft.github.io/AzureTRE
MIT License
184 stars 141 forks source link

Run E2E Test Failures #4108

Open cnn-tt opened 5 days ago

cnn-tt commented 5 days ago

Description

In my Azure TRE deployment I am trying to Run E2E test pipeline and i'm getting the following error on two tests

  1. Image

and

  1. Image

Steps

The steps I have tried are:

  1. Registered all necessary providers
  2. Given appropriate permissions to all SPNs used for deployments
Danny-Cooke-CK commented 5 days ago

hi @cnn-tt. Can you provide some more information please. which job is failing? Can you provide some more detailed jobs on the stage the job was running. What version of the TRE where you using ? Is this error coming from a standard azuretre feature or is it from a custom one youve added ? What version is the provider?

cnn-tt commented 5 days ago

Hi @Danny-Cooke-CK of course! It is the Run E2E Tests that fails to complete. I am using the V0.19.1 version. The error is coming from a standard azuretre feature. No custom configs have been added. I am assuming you mean the terraform providers, please see below: Image

also the tests that are failing are as seen below: Image

Danny-Cooke-CK commented 5 days ago

Thanks @cnn-tt. We updated all the providers recently and this one didn't fail. So something must have become deprecated recently.

I recommend trying azurerm version 3.112.0 and if that works, raise a PR back to here to fix it?

if not we can add it to the backlog and will prioritise it accordingly.

marrobi commented 5 days ago

The error looks like the managed identity hasn't got the correct permissions, rather than a specific provider being the issue. To register resource providers, as a Subscription Contributor I believe this should be the case as per:

You must have permission to do the /register/action operation for the resource provider. The permission is included in the Contributor and Owner roles.

From - https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-providers-and-types

@cnn-tt is this a new subscription? Can you check IAM at the Subscription level that the resource processor MSI has appropriate permissions, it should look bit like:

Image

marrobi commented 5 days ago

Also is this a fresh deployment, or upgrade from v0.19.0? Thanks.