Unable to use variable in ADO pipeline azureSubscription

[cwash05]

Please provide us with the following information:

This issue is a: (mark with an x)

• [x ] bug report -> please search issues before submitting
• [ ] documentation issue or request
• [ ] regression (a behavior that used to work and stopped in a new release)

Issue description

I am unable to use a variable for the azureSubscription parameter in my ADO pipeline. When used I get the following error.

"The pipeline is not valid. Job Deploy: Step AzureContainerApps input connectedServiceNameARM references service connection $(connectionName) which could not be found. The service connection does not exist, has been disabled or has not been authorized for use. For authorization details, refer to https://aka.ms/yamlauthz."

all of the other parameters using variables are okay

Steps to reproduce

the pipeline code

stages:
    - stage: Deploy
    # dependsOn: Build
    # condition: succeeded()
    jobs:
    - job: Deploy
      strategy:
        matrix:
          chwashPipeline:
            buildinfo: $(chwashPipelineVar)
          # dkingPipeline:
          #   buildinfo: $(dkingPipelineVar)
      pool:
        # vmImage: 'ubuntu-latest'
        name: Default    
      steps:
      - task: PowerShell@2
        name: GetUserVariables
        inputs:
          targetType: 'inline'
          script: |
            $json = $env:BUILDINFO 
            $obj = ConvertFrom-Json -InputObject $json 
            $connectionName = $obj.connectionName 
            $containerAppName = $obj.containerAppName 
            $resourceGroup = $obj.resourceGroup 
            $name = $obj.name 

            Write-Host "Connection Name: $connectionName"
            Write-Host "Container App Name: $containerAppName"
            Write-Host "Resource Group: $resourceGroup"
            Write-Host "Name: $name"

            Write-Host "##vso[task.setvariable variable=connectionName]$connectionName"
            Write-Host "##vso[task.setvariable variable=containerAppName]$containerAppName"
            Write-Host "##vso[task.setvariable variable=resourceGroup]$resourceGroup"
            Write-Host "##vso[task.setvariable variable=name]$name"

      - task: AzureContainerApps@1
        displayName: 'ContainerAppDeploy-$(name)'
        inputs:
          appSourcePath: '$(Build.SourcesDirectory)'
          azureSubscription: '$(connectionName)'  
          acrName: 'akscbweb'
          containerAppName: '$(containerAppName)'
          resourceGroup: '$(resourceGroup)'

it only works when the azureSubscription value is hard coded.

Expected behavior [What you expected to happen.] Expected that i would be able use a variable in the azureSubscription paremeter

Actual behavior [What actually happened.] receive error above

Screenshots

[simonjj]

Thanks for reaching out @cwash05. There's been some changes to opt-in vs. opt-out on the connection front. Would you mind checking that the connection your are trying to use is opted into being used by the pipeline please.

[cwash05]

@simonjj the service connection is good. if i replace the variable with the service everything works. even the other variables. it just seem for some reason it wont do the interpolation for the azureSubscription feild

[anthonychu]

I think this is related to when these variables are resolved, explained here:

It also answers another common issue: why can't I use variables to resolve service connection / environment names? Resources are authorized before a stage can start running, so stage- and job-level variables aren't available. Pipeline-level variables can be used, but only those variables explicitly included in the pipeline. Variable groups are themselves a resource subject to authorization, so their data is likewise not available when checking resource authorization.

Not sure if you can get around this by setting the variable in a prior stage.

[bowlerma]

I think this is related to when these variables are resolved, explained here:

It also answers another common issue: why can't I use variables to resolve service connection / environment names? Resources are authorized before a stage can start running, so stage- and job-level variables aren't available. Pipeline-level variables can be used, but only those variables explicitly included in the pipeline. Variable groups are themselves a resource subject to authorization, so their data is likewise not available when checking resource authorization.

Not sure if you can get around this by setting the variable in a prior stage.

This is correct. The issue isn't specific to the AzureContainerApps task but is applicable across all tasks that use the azureSubscription input. Due to the evaluation order you cannot use variables for this input. You can however, use parameters. The way we have gotten around this in a past is to put the task into a template and then pass the subscription value in as a parameter to the template.