|
| 1 | +--- |
| 2 | +title: Release notes for disconnected operations for Azure Local |
| 3 | +description: Read about the known issues and fixed issues for disconnected operations for Azure Local. |
| 4 | +author: haraldfianbakken |
| 5 | +ms.topic: conceptual |
| 6 | +ms.date: 07/14/2025 |
| 7 | +ms.author: hafianba |
| 8 | +ms.reviewer: hafianba |
| 9 | +--- |
| 10 | + |
| 11 | +# Known issues for disconnected operations for Azure Local |
| 12 | + |
| 13 | +::: moniker range=">=azloc-2506" |
| 14 | + |
| 15 | +<!--[!INCLUDE [IMPORTANT](../includes/disconnected-operations-preview.md)]--> |
| 16 | + |
| 17 | +This article lists critical known issues and their workarounds in disconnected operations for Azure Local. |
| 18 | + |
| 19 | +These release notes update continuously, and we add critical issues that require a workaround as we find them. Before you deploy disconnected operations with Azure Local, review the information here. |
| 20 | + |
| 21 | +## Known issues for version 2506 |
| 22 | + |
| 23 | +### Azure Local deployment with Azure Keyvault |
| 24 | + |
| 25 | +Role-Based Access Control (RBAC) permissions on a newly created Azure Key Vault take up to 20 minutes to propagate. If you create the Azure Key Vault in the local portal and try to finish the cloud deployment, you might encounter permission issues when validating the cluster before deployment. |
| 26 | + |
| 27 | +**Mitigation**: Wait 20 minutes after you create the Azure Key Vault to finish deploying the cluster, or create the key vault ahead of time. Assign the managed identity for each node, the key vault admin, and the user deploying to the cloud explicit roles on the key vault: **Key Vault Secrets Officer** and **Key Vault Data Access Administrator**. |
| 28 | + |
| 29 | +Here's an example script. Modify and use this script to create the key vault ahead of time: |
| 30 | + |
| 31 | +```powershell |
| 32 | +param($resourceGroupName = "aldo-disconnected", $keyVaultName = "aldo-kv", $subscriptionName = "Starter Subscription") |
| 33 | +
|
| 34 | +$location = "autonomous" |
| 35 | +
|
| 36 | +Write-Verbose "Login interactive with user that will do cloud deployment" |
| 37 | +# Login to Azure CLI (use the user you will run the portal deployment flow)" |
| 38 | +az login |
| 39 | +az account set --subscription $subscriptionName |
| 40 | +$accountInfo = (az account show)|convertfrom-json |
| 41 | +# Create the Resource Group |
| 42 | +$rg = (az group create --name $resourceGroupName --location $location)|Convertfrom-json |
| 43 | +
|
| 44 | +# Create a Key Vault |
| 45 | +$kv = (az keyvault create --name $keyVaultName --resource-group $resourceGroupName --location $location --enable-rbac-authorization $true)|Convertfrom-json |
| 46 | +
|
| 47 | +Write-Verbose "Assigning permissions to $($accountInfo.user.name) on the Key Vault" |
| 48 | +# Assign the secrets officer role to the resource group (could use KV explicit). |
| 49 | +az role assignment create --assignee $accountInfo.user.name --role "Key Vault Secrets Officer" --scope $kv.Id |
| 50 | +az role assignment create --assignee $accountInfo.user.name --role "Key Vault Data Access Administrator" --scope $kv.Id |
| 51 | +
|
| 52 | +$machines = (az connectedmachine list -g $resourceGroupName)|ConvertFrom-Json |
| 53 | +
|
| 54 | +# For now only supporting minimum 3 machines for ALDO |
| 55 | +if($machines.Count -lt 3){ |
| 56 | + Write-Error "No machines found in the resource group $resourceGroupName. Please check the resource group and try again. Please use the same resource group as where your Azure Local nodes are" |
| 57 | + return 1 |
| 58 | +} |
| 59 | +
|
| 60 | +Write-Verbose "Assigning permissions to MSIs $($machines.count) on the Key Vault" |
| 61 | +
|
| 62 | +$apps =(az ad sp list)|ConvertFrom-Json |
| 63 | +$managedIds=$machines.displayname | foreach-object { |
| 64 | + $name = $_ |
| 65 | + $apps|Where-Object {$_.ServicePrincipalType -eq 'ManagedIdentity' -and $_.displayname -match $name} |
| 66 | +} |
| 67 | +
|
| 68 | +# Assign role to each of the managed IDs (Arc-VMs) in the RG |
| 69 | +$managedIds|foreach-object { |
| 70 | + az role assignment create --role "Key Vault Administrator" --assignee $_.Id --scope $kv.id |
| 71 | +} |
| 72 | +
|
| 73 | +## |
| 74 | +Write-Verbose "Wait 30 min before running cloud deployment from portal" |
| 75 | +``` |
| 76 | + |
| 77 | +### Arc-initialization (node) fails with error code 42 |
| 78 | + |
| 79 | +When attempting to initialize an Arc-enabled node, you may encounter error code 42. |
| 80 | + |
| 81 | +**Cause**: Signing in with a service principal name (SPN) causes arc initialization to fail. |
| 82 | + |
| 83 | +**Mitigation**: Until the underlying issue is fixed, sign in to each Azure Local node by running `az login –use-device-code` instead of using a SPN. |
| 84 | + |
| 85 | +### Azure Local VMs (Arc VMs) |
| 86 | + |
| 87 | +#### Azure Resource Graph add or edit tags error |
| 88 | + |
| 89 | +When adding or editing a tag on an Arc VM, you might see an Azure Resource Graph error. |
| 90 | + |
| 91 | +**Mitigation**: Use Azure Command-Line Interface (CLI) to add or edit tags for the resource. |
| 92 | + |
| 93 | +#### Start, restart, or delete buttons disabled after stopping VM |
| 94 | + |
| 95 | +After you stop an Arc VM, the start, restart, and delete buttons in the Azure portal are disabled. |
| 96 | + |
| 97 | +**Mitigation**: Refresh your browser and the page. |
| 98 | + |
| 99 | +#### Unable to view the network interface or read properties on an Arc VM |
| 100 | + |
| 101 | +Viewing the network interface or properties on an Arc VM in the portal isn't supported in this release. |
| 102 | + |
| 103 | +#### Portal showing unsaved change notification after updating VM size |
| 104 | + |
| 105 | +If the notification in the top right shows that the save operation is complete, you can ignore the unsaved message and continue navigating away. The VM size is updated. |
| 106 | + |
| 107 | +#### Delete a VM resource |
| 108 | + |
| 109 | +When you delete a VM from the portal, you might see the message ***Delete associated resource failed*** and ***Failed to delete the associated resource 'name' of type 'Network interface'***. |
| 110 | + |
| 111 | +**Mitigation**: After you delete the VM, use the CLI to delete the associated network interface. Run this command: |
| 112 | + |
| 113 | +```azurecli |
| 114 | +az stack-hci-vm network nic delete |
| 115 | +``` |
| 116 | + |
| 117 | +### Azure Kubernetes Service (AKS) on Azure Local |
| 118 | + |
| 119 | +#### Use an existing public key when creating AKS cluster |
| 120 | + |
| 121 | +In this release, you can only use an existing public key when creating an AKS cluster. |
| 122 | + |
| 123 | +**Mitigation**: To create an SSH key, use the following command-line tool and paste the public key in the UI: |
| 124 | + |
| 125 | +```powershell |
| 126 | +ssh-keygen -t rsa |
| 127 | +(cat ~\.ssh\id_rsa.pub)|set-clipboard |
| 128 | +``` |
| 129 | + |
| 130 | +#### Update or scale a node pool from the portal is disabled |
| 131 | + |
| 132 | +Updating or scaling a node pool from the portal is currently not supported. |
| 133 | + |
| 134 | +**Mitigation**: Use the CLI to update or scale a node pool. |
| 135 | + |
| 136 | +```azurecli |
| 137 | +az aksarc nodepool update |
| 138 | +az aksarc nodepool scale |
| 139 | +``` |
| 140 | + |
| 141 | +#### Kubernetes cluster list empty under Azure Local (Kubernetes clusters) |
| 142 | + |
| 143 | +When you navigate to Azure Local and click **Kubernetes clusters**, you might see an empty list of clusters. |
| 144 | + |
| 145 | +**Mitigation**: Navigate to **Kubernetes** > **Azure Arc** in the left menu or using the search bar. Your clusters should appear in the list. |
| 146 | + |
| 147 | +#### Save Kubernetes service notification stuck |
| 148 | + |
| 149 | +After updating to a newer version of Kubernetes, you might encounter a stuck notification, `Save Kubernetes service`. |
| 150 | + |
| 151 | +**Mitigation**: Navigate to the cluster view page and refresh it. Verify that the state is still upgrading or has completed. If it's completed, you can ignore the notification. |
| 152 | + |
| 153 | +#### Activity log shows authentication issue |
| 154 | + |
| 155 | +Ignore the portal warning for this release. |
| 156 | + |
| 157 | +#### Microsoft Entra authentication with Kubernetes RBAC fails |
| 158 | + |
| 159 | +When attempting to create a Kubernetes cluster with Entra authentication, you encounter an error. |
| 160 | + |
| 161 | +**Mitigation**: Only local accounts with Kubernetes RBAC are supported in this preview. |
| 162 | + |
| 163 | +#### Arc extensions |
| 164 | + |
| 165 | +When navigating to extensions on an AKS cluster the add button is disabled and there aren't any extensions listed. |
| 166 | + |
| 167 | +Arc extensions are unsupported in this release. |
| 168 | + |
| 169 | +#### AKS resource shows on portal after deletion |
| 170 | + |
| 171 | +After successfully deleting an AKS cluster from portal the resource continues to show. |
| 172 | + |
| 173 | +**Mitigation**: Use the CLI to delete and clean up the cluster. Run this command: |
| 174 | + |
| 175 | +```azurecli |
| 176 | +az aksarc delete |
| 177 | +``` |
| 178 | + |
| 179 | +### Export Host Guardian Service certificates |
| 180 | + |
| 181 | +This feature isn't supported in this release. |
| 182 | + |
| 183 | +### Restart a node or the control plane VM |
| 184 | + |
| 185 | +After you restart a node or the control plane VM, the system might take up to an hour to become fully ready. If you notice issues with the local portal, missing resources, or failed deployments, check the appliance health using the **OperationsModule** to confirm that all services are fully converged. |
| 186 | + |
| 187 | +### Subscriptions |
| 188 | + |
| 189 | +### Operator create subscription |
| 190 | + |
| 191 | +After you create a new subscription as an operator, the subscription appears in the list as non-clickable and displays ***no access*** for the owner. |
| 192 | + |
| 193 | +**Mitigation**: Refresh your browser window. |
| 194 | + |
| 195 | +### Operator subscriptions view (timeout) |
| 196 | + |
| 197 | +If you're signed in as an operator, you might see a timeout screen and be unable to view, list, or create subscriptions. |
| 198 | + |
| 199 | +**Cause**: This issue happens when a subscription owner is deleted or isn't synced from the source identity system to the local control plane. When you try to view subscriptions, the process fails because the owner's identity isn't available. |
| 200 | + |
| 201 | +**Mitigation**: If the portal doesn't work, use Azure CLI or REST API to create and list subscriptions. To assign a different owner, use the REST API and enter the `subscriptionOwnerId` parameter when you create the subscription. |
| 202 | + |
| 203 | +### Azure CLI |
| 204 | + |
| 205 | +#### Manage clouds |
| 206 | + |
| 207 | +When you use the `az cloud` commands, such as `az cloud register`, `az cloud show`, or `az cloud set`, you might encounter issues if you use uppercase letters in the cloud name. |
| 208 | + |
| 209 | +**Mitigation**: Only use lowercase letters for cloud names in `az cloud` subcommands, such as `register`, `show`, or `set`. |
| 210 | + |
| 211 | +#### Create subscriptions |
| 212 | + |
| 213 | +Azure CLI doesn't support providing `subscriptionOwnerId` for new subscriptions. This makes the operator the default owner of newly created subscriptions without a way of changing the owner currently. |
| 214 | + |
| 215 | +**Mitigation**: Use `az rest` to create subscriptions with a different owner if required to automate directly with different owner |
| 216 | + |
| 217 | +### Azure portal |
| 218 | + |
| 219 | +#### Signout fails |
| 220 | + |
| 221 | +When you select Sign-out, the request doesn't work. |
| 222 | + |
| 223 | +**Mitigation**: Close your browser, then go to the portal URL. |
| 224 | + |
| 225 | +<!--### Deployment |
| 226 | +
|
| 227 | +### Azure Local VMs |
| 228 | +
|
| 229 | +### AKS on Azure Local--> |
| 230 | + |
| 231 | +### Azure Resource Manager |
| 232 | + |
| 233 | +#### Template specs |
| 234 | + |
| 235 | +Template specs aren't supported in the preview release. Deployments that use ARM templates with template specs fail. |
| 236 | + |
| 237 | +## Unsupported scenarios |
| 238 | + |
| 239 | +The following scenarios are unsupported in the preview release. |
| 240 | + |
| 241 | +- Arc-Enabled servers (remote or non Azure Local VMs) |
| 242 | +- Arc-Enabled Kubernetes clusters (remote or non AKS clusters) |
| 243 | + |
| 244 | +If you test these scenarios, these systems must trust your custom CA and you need to pass `-custom-ca-cert` when Arc-enabling them. |
| 245 | + |
| 246 | +::: moniker-end |
| 247 | + |
| 248 | +::: moniker range="<=azloc-2505" |
| 249 | + |
| 250 | +This feature is available only in Azure Local 2506. |
| 251 | + |
| 252 | +::: moniker-end |
0 commit comments