From abc2be2fc6c64da75607223a3a610d447efff296 Mon Sep 17 00:00:00 2001 From: Rael Garcia Date: Thu, 27 Aug 2026 14:27:43 +0000 Subject: [PATCH] fix(infra): retry cluster ARM step on Key Vault RBAC propagation (AROSLSRE-1918) Creating the aks-etcd-encryption key via bicep is a control-plane keys/write, so the deployment identity needs a Key Vault role granting it. On a fresh region buildout that role assignment can lag propagation and the cluster ARM step fails with ForbiddenByRbac. Add that error code to the existing automatedRetry trigger list on both the svc and mgmt cluster steps so the step retries once the grant lands. --- dev-infrastructure/mgmt-pipeline.yaml | 4 ++++ dev-infrastructure/svc-pipeline.yaml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/dev-infrastructure/mgmt-pipeline.yaml b/dev-infrastructure/mgmt-pipeline.yaml index 17714175eff..6218656d9a2 100644 --- a/dev-infrastructure/mgmt-pipeline.yaml +++ b/dev-infrastructure/mgmt-pipeline.yaml @@ -425,6 +425,10 @@ resourceGroups: - "Resource is in Updating state" - "There was a problem communicating with the identity service" - "DeploymentScriptExceededMaxAllowedTime" + # Transient RBAC propagation lag, mostly on fresh region buildout: the + # deployment identity's Key Vault role assignment (needed to create the + # aks-etcd-encryption key) may not have propagated yet. Retry once it lands. + - "ForbiddenByRbac" maximumRetryCount: 3 durationBetweenRetries: 2m - name: svc-mgmt-aks-permissions diff --git a/dev-infrastructure/svc-pipeline.yaml b/dev-infrastructure/svc-pipeline.yaml index e81df29fa66..df2ea67419f 100644 --- a/dev-infrastructure/svc-pipeline.yaml +++ b/dev-infrastructure/svc-pipeline.yaml @@ -480,6 +480,10 @@ resourceGroups: - "AnmPreconditionFailedException" - "MaxRetryCountReached" - "ServiceUnavailable" + # Transient RBAC propagation lag, mostly on fresh region buildout: the + # deployment identity's Key Vault role assignment (needed to create the + # aks-etcd-encryption key) may not have propagated yet. Retry once it lands. + - "ForbiddenByRbac" maximumRetryCount: 3 durationBetweenRetries: 2m - name: upgrade-aks-cluster