Skip to content

Commit 3a22afb

Browse files
AmandaAZAmandaAZ
authored
AB#5668, AB#5252: Private PR for PR#1840
1 parent 30fd321 commit 3a22afb

File tree

3 files changed

+121
-0
lines changed

3 files changed

+121
-0
lines changed

‎support/azure/azure-kubernetes/error-codes/vmextensionerror-oraspullnetworktimeout.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
title: OrasPullNetworkTimeoutVMExtensionError when creating AKS clusters
3+
description: Learn how to troubleshoot the OrasPullNetworkTimeoutVMExtensionError error (211) and when you try to create and deploy an Azure Kubernetes Service (AKS) cluster.
4+
ms.date: 05/02/2025
5+
ms.reviewer: xinhl, v-weizhu
6+
ms.service: azure-kubernetes-service
7+
#Customer intent: As an Azure Kubernetes user, I want to troubleshoot the OrasPullNetworkTimeoutVMExtensionError error code (OrasPullNetworkTimeoutVMExtensionError (211)) so that I can successfully create and deploy an Azure Kubernetes Service (AKS) cluster.
8+
ms.custom: sap:Create, Upgrade, Scale and Delete operations (cluster or nodepool)
9+
---
10+
# OrasPullNetworkTimeoutVMExtensionError error code (211) when deploying an AKS cluster
11+
12+
This article discusses how to identify and resolve the `OrasPullNetworkTimeoutVMExtensionError` error code (error code number 211) that occurs when you try to create and deploy a Microsoft Azure Kubernetes Service (AKS) cluster.
13+
14+
## Symptoms
15+
16+
When you try to create an AKS cluster with the outbound type `none` or `block`, you receive the following error message:
17+
18+
> VMExtensionProvisioningError: VM has reported a failure when processing extension 'vmssCSE'.
19+
>
20+
> Error message: "Enable failed: failed to execute command: command terminated with exit status=211
21+
>
22+
> Bootstrap Container Registry is not reachable. Please check the network configuration and try again.
23+
24+
## Cause
25+
26+
For [network isolated cluster]( /azure/aks/concepts-network-isolated), egress traffic is limited. Private ACR cache acts as a proxy to download necessary binaries/images from MAR for AKS bootstrapping. VM instances connect to the private ACR via private link. Incorrect configuration of the private link will cause VM bootstrap CSE to fail.
27+
28+
## Solution
29+
30+
To resolve this issue, follow these steps:
31+
32+
1. Retrieve the ACR resource ID that AKS uses as the bootstrap ACR by running the folllowing command:
33+
34+
```console
35+
az aks show -g ${RESOURCE_GROUP} -n ${CLUSTER_NAME} --query 'bootstrapProfile.containerRegistryResourceId
36+
```
37+
38+
2. Verify the ACR cache rule. It should include `aks-managed-rule` with source repo `mcr.microsoft.com/*` and target repo `aks-managed-reposity/*`. Ensure no other cache rule exists with source or target repo as `*`, which would override `aks-managed-rule`.
39+
40+
3. Review the [container registry private link](/azure/container-registry/container-registry-private-link) to ensure that the connection configuration is correct, including the private DNS zone and private link.
41+
42+
4. Access any failed VM instance using SSH and run curl on the ACR host. If successful, reconcile the cluster. If it still fails, return to step 3.
43+
44+
## References
45+
46+
- [General troubleshooting of AKS cluster creation issues](../create-upgrade-delete/troubleshoot-aks-cluster-creation-issues.md)
47+
48+
- [Network isolated Azure Kubernetes Service (AKS) clusters](/azure/aks/concepts-network-isolated)
49+
50+
- [Container registry private link](/azure/container-registry/container-registry-private-link)
51+
52+
[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)]

‎support/azure/azure-kubernetes/error-codes/vmextensionerror-oraspullunauthorized.md‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
title: OrasPullUnauthorizedVMExtensionError when creating AKS clusters
3+
description: Learn how to troubleshoot the OrasPullUnauthorizedVMExtensionError error (212) and when you try to create and deploy an Azure Kubernetes Service (AKS) cluster.
4+
ms.date: 05/02/2025
5+
ms.reviewer: xinhl, v-weizhu
6+
ms.service: azure-kubernetes-service
7+
#Customer intent: As an Azure Kubernetes user, I want to troubleshoot the OrasPullUnauthorizedVMExtensionError error code (OrasPullUnauthorizedVMExtensionError (212)) so that I can successfully create and deploy an Azure Kubernetes Service (AKS) cluster.
8+
ms.custom: sap:Create, Upgrade, Scale and Delete operations (cluster or nodepool)
9+
---
10+
# OrasPullUnauthorizedVMExtensionError error code (212) when deploying an AKS cluster
11+
12+
This article discusses how to identify and resolve the `OrasPullUnauthorizedVMExtensionError` error code (error code number 212) that occurs when you try to create and deploy a Microsoft Azure Kubernetes Service (AKS) cluster.
13+
14+
## Symptoms
15+
16+
When you try to create an AKS cluster with the outbound type `none` or `block`, you receive the following error message:
17+
18+
> VMExtensionProvisioningError: VM has reported a failure when processing extension 'vmssCSE'.
19+
>
20+
> Error message: "Enable failed: failed to execute command: command terminated with exit status=212
21+
>
22+
> Bootstrap Container Registry authorization failed. Please ensure kubelet identity has pull access to the registry.
23+
24+
## Cause
25+
26+
For [network isolated cluster](/azure/aks/concepts-network-isolated), egress traffic is limited. The feature introduces private acr cache rule as proxy to download necessary binary/images from MAR for AKS to bootstrap. It's suggested to disable anonymous access to the ACR. The AKS node will use the kubelet identity to access the ACR. If the `acrpull` permission is not set correctly or the kubelet identity is not bound to the VM instance, an unauthorized error will occur.
27+
28+
## Solution
29+
30+
To resolve this issue, follow these steps:
31+
32+
1. Access the VM instance using SSH to get the log file`/var/log/azure/cluster-provision.log`. Review the log to determine if the issue is related to a 401 error, Azure Instance Metadata Service (IMDS) connection timeout, or an identity not found with HTTP code 400.
33+
34+
2. Retrieve the ACR resource ID that AKS uses as the bootstrap ACR by running the folllowing command:
35+
36+
```console
37+
export REGISTRY_ID=$(az aks show -g ${RESOURCE_GROUP} -n ${CLUSTER_NAME} --query 'bootstrapProfile.containerRegistryId' -o tsv)
38+
```
39+
40+
3. If the issue is related to a 401 error, check if the kubelet identity has the `acrpull` permission to the ACR by running the folllowing command:
41+
42+
```console
43+
export KUBELET_IDENTITY_PRINCIPAL_ID=$(az aks show -g ${RESOURCE_GROUP} -n ${CLUSTER_NAME} --query 'identityProfile.kubeletidentity.clientId' -o tsv)
44+
```
45+
46+
If not, run the following command:
47+
48+
```console
49+
az role assignment create --role AcrPull --scope ${REGISTRY_ID} --assignee-object-id ${KUBELET_IDENTITY_PRINCIPAL_ID} --assignee-principal-type ServicePrincipal
50+
```
51+
52+
4. If the log error indicates that the identity isn't found, manually bind the kubelet identity to the VMSS for a quick fix.
53+
54+
5. If the issue is related to IMDS connection timeout, submit a support ticket.
55+
6. Reconcile the cluster if the preceding operations are completed.
56+
57+
## References
58+
59+
- [General troubleshooting of AKS cluster creation issues](../create-upgrade-delete/troubleshoot-aks-cluster-creation-issues.md)
60+
61+
- [Network isolated Azure Kubernetes Service (AKS) clusters](/azure/aks/concepts-network-isolated)
62+
63+
- [container registry authentication managed identity](/azure/container-registry/container-registry-authentication-managed-identity)
64+
65+
[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)]

‎support/azure/azure-kubernetes/toc.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -372,6 +372,10 @@
372372
href: error-codes/vmextensionerror-vhdfilenotfound.md
373373
- name: VMExtensionError_ProvisioningTimeout error
374374
href: error-codes/vmextensionerror-provisioningtimeout.md
375+
- name: OrasPullNetworkTimeoutVMExtensionError
376+
href: error-codes/vmextensionerror-oraspullnetworktimeout.md
377+
- name: OrasPullUnauthorizedVMExtensionError
378+
href: error-codes/vmextensionerror-oraspullunauthorized.md
375379
- name: UnsatisfiablePDB error
376380
href: error-codes/unsatisfiablepdb-error.md
377381
- name: AksCapacityHeavyUsage error

0 commit comments

Comments
 (0)