az keyvault command suddenly fails with "ERROR: APIVersion 2020-04-01-preview is not available Traceback"

Question

Issue

I have created a pipeline in Azure DevOps (using the classic editor - no YAML), which configures some Azure resources including an Azure Key Vault. The pipeline was working successfully, when I ran it last time in August 2020. Now it is February 2021 and the same unmodified pipeline crashes with the first Azure CLI task (see error logs at the end).

The code that causes the issue is

az keyvault set-policy \
  --resource-group $RESOURCEGROUP_NAME \
  --name $KEYVAULT_NAME \
  --object-id $APPREGISTRATION_OBJECTID \
  --secret-permissions get list set

From the log of the last successful run (in August 2020) I can see that Azure CLI version 2.0.16 was used. When I run it today (in February 2021) and see it crash, it uses Azure CLI version 2.19.1. I assume the Azure CLI task always uses the most recent version.

Idea

So my suspicion is that something changed in the Azure CLI library. But neither can I figure out what the problem is, nor are there any settings to downgrade to my original version.

Since the pipeline runs on an Ubuntu-Linux machine, I tried to replace the Azure CLI task by a bash script task in order to control the Azure CLI version. I tried the following code, but I was only able to downgrade the version down to 2.0.81, which strangely dates back to February 2020 according to the release notes: https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli?tabs=azure-cli#february-04-2020

sudo apt-get update
sudo apt-get install ca-certificates curl apt-transport-https lsb-release gnupg

curl -sL https://packages.microsoft.com/keys/microsoft.asc |
    gpg --dearmor |
    sudo tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null

AZ_REPO=$(lsb_release -cs)
echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" |
    sudo tee /etc/apt/sources.list.d/azure-cli.list

sudo apt-get update
sudo apt-get remove azure-cli
sudo apt-get install azure-cli=2.0.81+ds-4ubuntu0.2

I can verify that Azure CLI 2.0.81 was installed. But unfortunately I still see the same error log (see below).

Any suggestions are highly appreciated!

Error logs

ERROR: The command failed with an unexpected error. Here is the traceback:
ERROR: APIVersion 2020-04-01-preview is not available
Traceback (most recent call last):
  File "/opt/hostedtoolcache/Python/3.7.9/x64/lib/python3.7/site-packages/knack/cli.py", line 233, in invoke
    cmd_result = self.invocation.execute(args)
  File "/opt/hostedtoolcache/Python/3.7.9/x64/lib/python3.7/site-packages/azure/cli/core/commands/__init__.py", line 664, in execute
    raise ex
  File "/opt/hostedtoolcache/Python/3.7.9/x64/lib/python3.7/site-packages/azure/cli/core/commands/__init__.py", line 727, in _run_jobs_serially
    results.append(self._run_job(expanded_arg, cmd_copy))
  File "/opt/hostedtoolcache/Python/3.7.9/x64/lib/python3.7/site-packages/azure/cli/core/commands/__init__.py", line 720, in _run_job
    six.reraise(*sys.exc_info())
  File "/opt/hostedtoolcache/Python/3.7.9/x64/lib/python3.7/site-packages/six.py", line 703, in reraise
    raise value
  File "/opt/hostedtoolcache/Python/3.7.9/x64/lib/python3.7/site-packages/azure/cli/core/commands/__init__.py", line 698, in _run_job
    result = cmd_copy(params)
  File "/opt/hostedtoolcache/Python/3.7.9/x64/lib/python3.7/site-packages/azure/cli/core/commands/__init__.py", line 331, in __call__
    return self.handler(*args, **kwargs)
  File "/opt/hostedtoolcache/Python/3.7.9/x64/lib/python3.7/site-packages/azure/cli/core/__init__.py", line 807, in default_command_handler
    client = client_factory(cmd.cli_ctx, command_args) if client_factory else None
  File "/opt/hostedtoolcache/Python/3.7.9/x64/lib/python3.7/site-packages/azure/cli/command_modules/keyvault/_client_factory.py", line 124, in _keyvault_mgmt_client_factory
    return getattr(get_mgmt_service_client(cli_ctx, resource_type), client_name)
  File "/opt/hostedtoolcache/Python/3.7.9/x64/lib/python3.7/site-packages/azure/mgmt/keyvault/_key_vault_management_client.py", line 157, in vaults
    raise NotImplementedError("APIVersion {} is not available".format(api_version))
NotImplementedError: APIVersion 2020-04-01-preview is not available

Edit - 03/01/2021

I previously created the key vault with the help of a resource template (json-file) from the deployment pipeline and there is one particular line that just caught my attention:

"apiVersion": "2016-10-01",

If I create the key vault manually in Azure, a template with the same api version is created. This api version does not match the one mentioned in the error logs, but I am not sure if they should.

ERROR: APIVersion 2020-04-01-preview is not available

@Kevin Lu-MSFT: My Azure CLI output looks very similar to yours. But the error persists.

Answer 1

why I get python errors running a Azure CLI command.

For this question, as far as I know, azure cli is written in python code， so when you get the errors, it will show python errors.

Here is the source code of the azure cli .

ERROR: APIVersion 2020-04-01-preview is not available

I have tested the same script in Azure Cli task with all kind of Linux Agents(e.g. ubuntu 16.04 18.04 20.04) in Azure Devops. But they all could work fine.

Here is my sample:

The Azure CLI version: 2.19.1 (latest)

The error message is related to the APIVersion, but we couldn't set it in Azure CLI. So this could be related to azure cli version or keyvault itself.

You could try my Azure CLI task settings. Or you could create a new Azure Key Vault and test the same script. Then you could check if it could work.