0

I do not know how az login works, but it must be saving the credentials for subsequent az commands to use. that means it cannot be used as is in a CI pipeline, where multiple concurrent pipelines may run on the same build machine using the same system account.

So, how can we use Az CLI in the release pipeline?

(I am aware of the Az Azure DevOps task, but I could not make it work).

P.S.

We use on-prem Azure DevOps Server 2019.

mark
  • 59,016
  • 79
  • 296
  • 580

1 Answers1

0

If I'm understanding your question correctly, the answer is that it's sometimes problematic to use multiple self-hosted agents for pipelines that use singleton tools on the same machine:

You might also run into problems if parallel build jobs are using the same singleton tool deployment, such as npm packages. For example, one build might update a dependency while another build is in the middle of using it, which could cause unreliable results and errors.


I imagine this could extend to issues such as trying to have separate az sessions on the same system account. Although - and I haven't tried this myself - but I wonder if you could try using az login with a service principal client certificate, as seen here:

az login --service-principal -u http://azure-cli-2016-08-05-14-31-15 -p ~/mycertfile.pem --tenant contoso.onmicrosoft.com


Edit: Found this PR from this issue, so it looks like you can run the sessions concurrently. Although I'm still not sure what would happen if, as previously mentioned, you were to (for example) modify the Az CLI tool itself.

Tony
  • 51
  • 1
  • 4
  • I am already using it with a service principal, but it is a single principal, not one per agent - so the problem is the same. – mark Feb 06 '20 at 03:46
  • @mark I edited my answer with some resources from Github. So I guess it is possible, but I still don't know how using a singleton tool might affect it. – Tony Feb 06 '20 at 03:58