{"record":{"id":"3a1135a3fac740c4","repo":"rancher/rancher","slug":"failed-to-get-locations-w","errorCode":null,"errorMessage":"failed to get locations: %w","messagePattern":"failed to get locations: %w","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"pkg/api/norman/customization/aks/listers.go","lineNumber":545,"sourceCode":"}\n\ntype locationsResponseBody struct {\n\tName        string `json:\"name\"`\n\tDisplayName string `json:\"displayName\"`\n}\n\nfunc listLocations(ctx context.Context, cap *Capabilities) ([]byte, int, error) {\n\tclient, err := NewSubscriptionServiceClient(cap)\n\tif err != nil {\n\t\treturn nil, http.StatusInternalServerError, err\n\t}\n\n\tvar locations []locationsResponseBody\n\tpager := client.NewListLocationsPager(cap.SubscriptionID, nil)\n\tfor pager.More() {\n\t\tpage, err := pager.NextPage(ctx)\n\t\tif err != nil {\n\t\t\treturn nil, http.StatusBadRequest, fmt.Errorf(\"failed to get locations: %w\", err)\n\t\t}\n\n\t\tfor _, v := range page.Value {\n\t\t\tlocations = append(locations, locationsResponseBody{\n\t\t\t\tName:        to.String(v.Name),\n\t\t\t\tDisplayName: to.String(v.DisplayName),\n\t\t\t})\n\t\t}\n\t}\n\n\treturn encodeOutput(locations)\n}\n\ntype regionsResponseBody struct {\n\tName              string `json:\"name\"`\n\tDisplayName       string `json:\"displayName\"`\n\tAvailabilityZones bool   `json:\"availabilityZones\"`\n}","sourceCodeStart":527,"sourceCodeEnd":563,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/api/norman/customization/aks/listers.go#L527-L563","documentation":"listLocations wraps any pager.NextPage failure from the subscriptions ListLocations call as HTTP 400 with %w. The cause is an ARM failure on /subscriptions/{id}/providers/locations: invalid or unreadable SubscriptionID, credential/tenant mismatch, throttling, or connectivity.","triggerScenarios":"cap.SubscriptionID empty or malformed so ARM 400s; credential from a different tenant than the subscription (401/403); secret expiry; ARM 429; egress blocked.","commonSituations":"Cloud credential created against the wrong directory; subscription ID copied with whitespace or braces; national-cloud credential used against global ARM.","solutions":["Inspect the wrapped azcore error for status and error code","Verify the subscription ID: az account show -o json | jq -r .id","Re-create the cloud credential with matching tenant/client/subscription","Retry on 429/5xx; confirm egress to management.azure.com"],"exampleFix":"// before\npager := client.NewListLocationsPager(cap.SubscriptionID, nil)\n// after - validate the subscription shape first\nif !subscriptionIDRe.MatchString(cap.SubscriptionID) {\n    return nil, http.StatusBadRequest, fmt.Errorf(\"invalid subscription ID %q\", cap.SubscriptionID)\n}\npager := client.NewListLocationsPager(cap.SubscriptionID, nil)","handlingStrategy":"retry","validationCode":"# verifies read access to subscription locations before the call\naz account list-locations --subscription $SUB -o table","typeGuard":null,"tryCatchPattern":"var re *azcore.ResponseError\nif errors.As(err, &re) {\n\tif re.StatusCode == 401 || re.StatusCode == 403 { /* credential/tenant mismatch */ }\n\tif re.StatusCode == 429 || re.StatusCode >= 500 { /* retry with backoff */ }\n}","preventionTips":["Validate SubscriptionID format (UUID) before building ARM clients","Keep credential tenant and subscription in sync when re-issuing secrets","Retry location listing on transient ARM errors"],"tags":["azure","locations","arm","credentials","http-400"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}