Indefinite hang when getting token

[hmillerbakewell]

Generating credentials hangs indefinitely / crashes on the standard python:3.13 docker image.

Minimal Setup

The following code causes the problem:

from redis_entraid.cred_provider import create_from_managed_identity, ManagedIdentityType, ManagedIdentityIdType

provider = create_from_managed_identity(
    identity_type=ManagedIdentityType.USER_ASSIGNED,
    resource="https://redis.azure.com",
    id_type=ManagedIdentityIdType.CLIENT_ID,
    id_value="<My Azure Service ID>"
)

return provider.get_credentials()

System details:

• The above code works correctly when run on Ubuntu 24.04.2 LTS (full specs below)
• Running that code within a docker image (FROM python:3.13) on that Ubuntu machine causes an indefinite hang
• Running that code within a docker image (FROM python:3.13) running as an Azure Container App forces the container app to crash and restart

Here are the further system details of the host machine (where things are working):

Icon name: computer-vm
Chassis: vm 🖴
Virtualization: microsoft
Operating System: Ubuntu 24.04.2 LTS              
Kernel: Linux 6.14.0-1013-azure
Architecture: x86-64
Hardware Vendor: Microsoft Corporation
Hardware Model: Virtual Machine
Firmware Version: Hyper-V UEFI Release v4.1
Firmware Date: Mon 2024-05-13
Firmware Age: 1y 5month 4d

The Azure Container App is running on 1 CPU core with 2 Gi memory.

EDIT: Relevant parts of pip freeze:

redis-entraid==1.0.0
azure-common==1.1.28
redis==6.4.0
azure-identity==1.20.0

[bobymicroby]

@hmillerbakewell Hi, do you have any crash logs from the docker container? If you want to help us address this issue, could you provide us with a gist/repo containing a Dockerfile and a simple python script that instantiates the client for the managed identity auth flow, so we can reproduce the issue locally?

[hmillerbakewell]

I'm afraid I don't have any crash logs, the only relevant log entry stored on the Azure Contain App (that I didn't create in my own code) is Token manager started.

I have created https://github.com/hmillerbakewell/redis-py-entraid-55 which recreates the issue in a minimal container.

[bobymicroby]

Thank you very much for the repo! We will have a look.

[jonathan-fileread]

We're experiencing the same issues - running within docker container as well. After "Token manager started" our apps hang - occuring outside of docker image and within)

from redis_entraid.cred_provider import create_from_default_azure_credential

create_from_default_azure_credential(
("https://redis.azure.com/.default",)
)

nslookup works

[vladvildanov]

@hmillerbakewell Hi! Sorry for the delay. I think it might be a networking problem, when you run application on Azure VM it uses a hardcoded pre-defined IP address to get a token from.

GET 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/' HTTP/1.1 Metadata: true

You need to make sure that this address is reachable from your docker container.

https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token

[vladvildanov]

@hmillerbakewell You can also provide timeout configuration to prevent infinite hang

[vladvildanov]

@hmillerbakewell https://learn.microsoft.com/en-us/azure/container-instances/container-instances-managed-identity

[jonathan-fileread]

@vladvildanov Hey Vlad - the token is reachable - we have user assigned identities setup correctly with the correct RBAC permission to the managed redis. As well as nslookup pointing to the correct private dns IP for the private endpoint of the resource

[vstoyanoff]

Is this resolved? It doesn't work locally for me as well. It hangs at "Token manager started"