az sig image-version create --tags break in version 2.38.0-1

[LiliDeng]

Install latest version Azure CLI on ubuntu 1804
run az sig image-version create .... --tags test=true encounter this error Parameter 'tags' must be of type 'dict[str, str]', downgrade version into 2.37.0-1, it works well.

[yonzhan]

Compute

[zhoxing-ms]

2.37.0-1
2.38.0-1

I believe these version numbers are unofficial like #23094 (comment)
It should be related to issue #19640 @jiasli Please be aware

[LiliDeng]

we encounter this issue in ADO pipeline, then I install latest version on ubuntu following this guide https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-linux?pivots=apt#option-1-install-with-one-command, repro this issue.

[rafalslaby]

Seeing the same issue on azure-cli/focal 2.38.0-1~focal. We're forced to downgrade to 2.37.0-1 as a workaround

[SuperJC710e]

We've been experiencing the same issue in our pipeline build.

As a work-around, we broke the tagging portion out into a separate az tag create operation. We were able to derive the required --resource-id flag using the same variables/parameters we were feeding to the original az sig image-version create command. This is working.

  - task: AzureCLI@2
    displayName: Publish the Managed Image to the Shared Image Gallery
    enabled: true
    inputs:
      azureSubscription: ${{ parameters.azureSubscription }}
      scriptType: bash
      scriptLocation: inlineScript
      inlineScript: |
        az sig image-version create \
         --gallery-image-definition ${{ parameters.sigGalleryImageDefinition }} \
         --gallery-image-version ${{ parameters.sigGalleryImageVersion }} \
         --gallery-name ${{ parameters.sigGalleryName }} \
         --resource-group ${{ parameters.sigResourceGroup }} \
         --managed-image "/subscriptions/${{ parameters.srcImageSubscriptionId }}/resourceGroups/${{ parameters.srcImageResourceGroupName }}/providers/Microsoft.Compute/images/${{ parameters.srcImageName }}" \
         --subscription ${{ parameters.sigSubscriptionId }} \
         --target-regions ${{ parameters.sigTargetRegions }}; \
        az tag create \
         --resource-id "/subscriptions/${{ parameters.sigSubscriptionId }}/resourceGroups/${{ parameters.sigResourceGroup }}/providers/Microsoft.Compute/galleries/${{ parameters.sigGalleryName }}/images/${{ parameters.sigGalleryImageDefinition }}/versions/${{ parameters.sigGalleryImageVersion }}" \
         --tags \
         "Department"="${{ parameters.stdTagDepartment }}" \
         "Owner"="${{ parameters.stdTagOwner }}" \
         "Environment"="${{ parameters.stdTagEnvironment }}" \
         "Subscription"="${{ parameters.stdTagSubscription }}" \
         "Project"="${{ parameters.stdTagProject }}" \
         "Application"="${{ parameters.stdTagApplication }}"

Also, it looks like there could be another approach using the --set flag, as outlined here: #23191 (comment)

[eric-desrochers]

I did notice 2 workarounds:

• Downgrade
• Break the tagging portion out into separate operation.

Is there any permanent solution on the way ?

Note: This is preventing the release of SBI (Secure Base Image) using Ubuntu as the OS, as it is failing LISAv3 testing.

In the immediate situation, what approaches/workaround azure-cli team would recommend to unblock us ?

Adding @LiliDeng for visibility.

[qbradley]

I am also impacted by this bug.