34.6 Troubleshooting Issues Related to AKS Deployment

The following table lists the issues you might encounter and the suggested actions for working on these issues. If the problem persists, contact your NetIQ representative.

Issue

Suggested action

When you are running the Terraform commands in the Azure portal, you might come across errors that can block the infrastructure deployment. Some of the possible errors are given below.

Error: making Read request on Azure KeyVault Secret slesvmpwd: azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to https://idmkv88211894240361.vault.azure.net/secrets/slesvmpwd/?api-version=7.1: StatusCode=401 -- Original Error: adal: Refresh request failed. Status Code = '401'. Response body: {"error":{"code":"invalid_request","message":"Required audience parameter not specified"}} Endpoint http://localhost:50342/oauth2/token │ │ with module.server.data.azurerm_key_vault_secret.slesvmpwd, │ on sles15sp2-server/main.tf line 42, in data "azurerm_key_vault_secret" "slesvmpwd": │ 42: data "azurerm_key_vault_secret" "slesvmpwd" { kubernetes_secret.example3: Creation complete after 1s [id=idm/ingress-tls] ╷│ Error: error detecting capabilities: error PostgreSQL version: dial tcp 52.186.162.130:5432: connect: connection timed out │ │ with module.dbserver.postgresql_database.igaworkflowdb, │ on Azure-PG-Server/main.tf line 217, in resource "postgresql_database" "igaworkflowdb": │ 217: resource "postgresql_database" "igaworkflowdb" { │ az aks get-credentials --resource-group rajj_rg --name cluster-name --overwrite-existing│ Error: making Read request on Azure KeyVault Secret uawfedbuser: azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to https://idmkv80357639695488.vault.azure.net/secrets/uawfedbuser/?api-version=7.1: StatusCode=401 -- Original Error: adal: Refresh request failed. Status Code = '401'. Response body: {"error":{"code":"invalid_request","message":"Required audience parameter not specified"}} Endpoint http://localhost:50342/oauth2/token │ │ with module.dbserver.data.azurerm_key_vault_secret.uawfedbuser, │ on Azure-PG-Server/main.tf line 28, in data "azurerm_key_vault_secret" "uawfedbuser": │ 28: data "azurerm_key_vault_secret" "uawfedbuser" { module.dbserver.null_resource.delay: Creation complete after 5m0s [id=5961346882319865424] ╷│ Error: waiting for creation of Managed Kubernetes Cluster "test-akscluster" (Resource Group "idmtest_rg"): Code="ReconcileStandardLoadBalancerError" Message="Reconcile standard load balancer failed. Details: outboundReconciler retry failed: Category: ClientError; SubCode: PublicIPCountLimitReached; Dependency: Microsoft.Network/PublicIPAddresses; OrginalError: Code=\"PublicIPCountLimitReached\" Message=\"Cannot create more than 10 public IP addresses for this subscription in this region.\" Details=[]; AKSTeam: Networking, Retriable: false." │ │ with module.aks.azurerm_kubernetes_cluster.main, │ on .terraform/modules/aks/main.tf line 10, in resource "azurerm_kubernetes_cluster" "main": │ 10: resource "azurerm_kubernetes_cluster" "main" {

To resolve this issue, perform the following steps:

  1. Login to the Azure portal.

  2. (Optional) Locate the Azure Kubernetes cluster configuration file path.

  3. Run the following commands to overwrite the default config file ~/.kube/config.

    aks get-credentials --resource-group <resource-group-name> --name <kube-cluster-name> --overwrite-existing

    export KUBE_CONFIG_PATH=~/.kube/config

  4. Re-run the Terraform commands. For more information, see Step 14, Step 15, Step 16 in the Deployment using the Configuration Generator.

When you are trying to create a public IP address on Azure, you might see the following error.

│ Error: waiting for creation of Managed Kubernetes Cluster "cluster-name" (Resource Group "raj_rg"): Code="ReconcileStandardLoadBalancerError" Message="Reconcile standardload balancer failed. Details: outboundReconciler retry failed: Category: ClientError; SubCode: PublicIPCountLimitReached; Dependency: Microsoft.Network/PublicIPAddresses;OrginalError: Code=\"PublicIPCountLimitReached\" Message=\"Cannot create more than 10 public IP addresses for this subscription in this region.\" Details=[]; AKSTeam: Networking, Retriable: false." │ │ with module.aks.azurerm_kubernetes_cluster.main, │ on .terraform/modules/aks/main.tf line 10, in resource "azurerm_kubernetes_cluster" "main": │ 10: resource "azurerm_kubernetes_cluster" "main" {

Contact the Azure team to increase the quota for subscription or try to remove unused public IP addresses that are already assigned.

When you are running the terraform apply command in the Azure portal, you might see the following exception:

(AgentPoolK8sVersionNotSupported) Version <version> is not supported in this region. Please use [az aks get-versions] command to get the supported version list in this region. For more information, please check https://aka.ms/supported-version-list

To resolve this issue, perform the following steps:

  1. Log in to the Azure portal.

  2. Click .

  3. Run the following command to identify the supported versions available in your location:

    az aks get-versions -l <location>

    For example,

    az aks get-versions -l eastus

  4. Navigate to the IDM_4.9_Cloud_Deployment_files directory, go to main.tf file and edit the following values:

    kubernetes_version = "<version>"

    orchestrator_version = "<version>"

    For example,

    kubernetes_version = "1.20.15"

    orchestrator_version = "1.20.15"

    NOTE:Version 1.20.x is certified and supported on AKS Kubernetes.

  5. Re-run the following command:

    terraform apply --auto-approve

When you are deploying multi-instance containers on Azure Kubernetes Service, you might see a few pods in pending state.

To resolve the issue, perform the following steps:

  1. Log in to the Azure portal.

  2. Type kubernetes services in the search and press enter.

  3. Select your kubernetes cluster.

  4. Click Diagnose and solve problems > Troubleshoot.

  5. (Conditional) If the issue is not resolved using troubleshooting method, check the usage quota of your azure account.

    1. Go to Home page, type quotas in the search and press enter.

    2. Click Compute.

    3. (Conditional) If the current usage column displays 100% with a red line, click Request quota increase.

    4. Enter a new limit in New limit text box.

    5. Click Submit.

When you restart the engine instance pod, the driver’s deployment will fail for the existing Identity Vault. You might see the following error in the Designer application:

The deployment of 'cn=Azure AD Driver,cn=Driver Set,o=system' failed with errors and/or warnings.

Go to Designer application and re-import the Identity Vault into Designer.

When you restart the primary server a new IP address is assigned to it, this new IP address does not match the one in the SSL certificate of the secondary server.

Restarting the secondary server would make it reissue the SSL certificate with the new IP address.

In Identity Manager Reporting, when you try to import multiple reports with a total size exceeding 1MB, it will show error 413. This happens because the default request body size allowed by the nginx-ingress controller is 1MB.

There was an error calling the URL (/IDMRPT-CORE/rpt/definitions/import?uploadid=<id>&content=text/html&format=application/json&overwrite=true). The server returned the status code 413 with the following data which was not parsable JSON data:

This issue can be resolved by allowing a larger request body size, by adding the following annotation in the values.yaml file under the Ingress Configuration section:

nginx.ingress.kubernetes.io/proxy-body-size: 3m