Latest API version not available in sovereign clouds

[jiasli]

Previously reported by

• Microsoft.Cdn: Need a central place to record the Azure cli api-version change  #16094
• Microsoft.Storage: Wrong api version used for enabling atp with the azure-cli on a storage account in China tenant #18828, az storage endpoint not available for AzureCLI 2.20.0 in Azure Goverment #17189
• Microsoft.ManagedIdentity: AzureUSGovernment; az identity create; NoRegisteredProviderFound API version 2021-09-30-preview for type userAssignedIdentities #22661
• Microsoft.KeyVault: Azure Key Vault API Error - Azure CLI version 2.30.0 #20226, "az keyvault update" not working in Azure China after upgrading to 2.40.0 #23888

Symptom

We have a centralized location to define API versions for each resource provider:

azure-cli/src/azure-cli-core/azure/cli/core/profiles/_shared.py

Lines 154 to 158 in daa5685

	AZURE_API_PROFILES = {
	'latest': {
	ResourceType.MGMT_STORAGE: '2022-05-01',
	ResourceType.MGMT_NETWORK: '2022-01-01',
	ResourceType.MGMT_COMPUTE: SDKProfile('2022-03-01', {

Azure CLI supports 4 clouds, including 3 sovereign clouds:

• AzureCloud
• AzureChinaCloud
• AzureUSGovernment
• AzureGermanCloud

All of them use the same latest profile and the same API version for each resource provider.

However, it happens frequently that a new API version is only deployed to AzureCloud, but not other clouds. Using Azure CLI to call that API version leads to error like:

NoRegisteredProviderFound - No registered resource provider found for location 'chinanorth' and API version '2019-06-15-preview' for type 'profiles/endpoints'. The supported api-versions are '2015-06-01, 2016-04-02, 2016-10-02, 2017-04-02, 2017-10-12, 2018-04-02, 2019-04-15'. The supported locations are 'chinanorth, chinanorth2, chinaeast, chinaeast2'.

Temporary workaroud

Install previous versions of Azure CLI that use old API versions in sovereign clouds. The installation document has detailed instruction on how to install previous versions: https://learn.microsoft.com/en-us/cli/azure/install-azure-cli

Solution

Service team should deploy the new API version to all clouds synchronously.

[jiasli]

A similar issue is when a new API version is only deployed to certain regions, but not other regions. This happened for network RP before:

• Unsupported API version '2020-04-01' for Network Resource. MS is fixing it. #13827

[jiasli]

Azure PowerShell faces the same issue:

• Az.Storage version 3.4 does not work in AzureGovernment Regions azure-powershell#14395

[jonathanzhang02]

Hi this happened again in our pipeline, could some actions be taken to ensure API version consistencies in sovereign clouds?

08:53:58  fatal: [127.0.0.1]: FAILED! => {"attempts": 3, "changed": true, "cmd": "az keyvault update  --resource-group \"modelt-tcyz0otvcne\"  --name \"modelt-tcyz0otvcne-vault\"  --default-action Deny\n", "delta": "0:00:02.765346", "end": "2023-04-06 00:53:56.239069", "msg": "non-zero return code", "rc": 1, "start": "2023-04-06 00:53:53.473723", "stderr": "ERROR: (NoRegisteredProviderFound) No registered resource provider found for location 'chinanorth3' and API version '2023-02-01' for type 'vaults'. The supported api-versions are '2015-06-01, 2016-10-01, 2018-02-14-preview, 2018-02-14, 2019-09-01, 2021-04-01-preview, 2021-06-01-preview, 2021-10-01, 2021-11-01-preview, 2022-07-01, 2022-11-01, 2022-02-01'. The supported locations are 'chinanorth, chinaeast, chinanorth2, chinaeast2, chinanorth3, chinaeast3'.\nCode: NoRegisteredProviderFound\nMessage: No registered resource provider found for location 'chinanorth3' and API version '2023-02-01' for type 'vaults'.