{"record":{"id":"4cd1b5fba5ca9564","repo":"microsoft/aspire","slug":"az-resource-list-failed-while-checking-aks-cluster-existence","errorCode":null,"errorMessage":"az resource list failed while checking AKS cluster existence (exit code {result.ExitCode}): {result.StandardError}","messagePattern":"az resource list failed while checking AKS cluster existence \\(exit code (.+?)\\): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.Kubernetes/AzureKubernetesEnvironmentResource.AksPipeline.cs","lineNumber":988,"sourceCode":"        string resourceGroup,\n        string clusterName,\n        Func<string, string, Task<AzCommandResult>> runAzCommandAsync)\n    {\n        var result = await runAzCommandAsync(\n            azPath,\n            BuildAksResourceExistsArguments(subscriptionId, resourceGroup, clusterName)).ConfigureAwait(false);\n\n        if (result.ExitCode != 0)\n        {\n            // Azure CLI reports an out-of-band deleted resource group as:\n            //   (ResourceGroupNotFound) Resource group 'deployment-rg' could not be found.\n            // This proves the persisted AKS resource is absent, so cluster cleanup can be skipped.\n            if (result.StandardError.Contains(\"(ResourceGroupNotFound)\", StringComparison.OrdinalIgnoreCase))\n            {\n                return false;\n            }\n\n            throw new InvalidOperationException(\n                $\"az resource list failed while checking AKS cluster existence \" +\n                $\"(exit code {result.ExitCode}): {result.StandardError}\");\n        }\n\n        return !string.IsNullOrWhiteSpace(result.StandardOutput);\n    }\n\n    internal static string BuildGetCredentialsArguments(\n        string subscriptionId,\n        string resourceGroup,\n        string clusterName)\n        => $\"aks get-credentials --resource-group \\\"{resourceGroup}\\\" --name \\\"{clusterName}\\\" --file - --subscription \\\"{subscriptionId}\\\"\";\n\n    internal static string BuildResourceGroupQueryArguments(string subscriptionId, string clusterName)\n        => $\"resource list --resource-type Microsoft.ContainerService/managedClusters --name \\\"{clusterName}\\\" --query [].resourceGroup -o tsv --subscription \\\"{subscriptionId}\\\"\";\n\n    internal static string BuildAksResourceExistsArguments(\n        string subscriptionId,","sourceCodeStart":970,"sourceCodeEnd":1006,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.Kubernetes/AzureKubernetesEnvironmentResource.AksPipeline.cs#L970-L1006","documentation":"Before fetching credentials, AksResourceExistsAsync runs `az resource list` to check whether the persisted AKS cluster still exists. Non-zero exit normally throws; the only tolerated case is a '(ResourceGroupNotFound)' error in stderr, which cleanly maps to 'cluster absent' so cleanup can be skipped. Any other CLI failure raises this error.","triggerScenarios":"GetAksCredentialsAsync calls AksResourceExistsAsync and `az resource list` exits non-zero with an error other than ResourceGroupNotFound: authentication failure, subscription not found/accessible, malformed query arguments, network/ARM outages, or az CLI internal errors.","commonSituations":"az session expired mid-destroy; subscription ID resolved from stale state that no longer exists; service principal lacking Reader on the subscription; transient ARM 5xx/timeouts in CI.","solutions":["Re-authenticate with `az login` or refresh the service-principal credentials and retry.","Manually execute the az resource list arguments from the error output to see the full ARM error.","Confirm the subscription ID exists and the identity has at least Reader on it.","If transient (network/5xx), retry the destroy/deploy operation."],"exampleFix":"// before\naz resource list --subscription <stale-sub> ...  // exits 3: subscription not found\n\n// after\naz login\naz account set --subscription <current-sub>\n# rerun; or explicitly set Azure:SubscriptionId to the live subscription","handlingStrategy":"retry","validationCode":"var acct = Process.Start(\"az\", \"account show\");\nacct.WaitForExit();\nif (acct.ExitCode != 0) throw new InvalidOperationException(\"az not authenticated.\");","typeGuard":null,"tryCatchPattern":"try { await DestroyAsync(); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"az resource list failed while checking AKS cluster existence\"))\n{\n    // re-authenticate or fix subscription, then retry; ResourceGroupNotFound is benign\n}","preventionTips":["Confirm identity has Reader on the subscription","Re-authenticate before long CI jobs","Treat only ResourceGroupNotFound as a signal the cluster is absent; other errors need fixing"],"tags":["azure","aks","az-cli","existence-check"],"backgroundTag":"cli-command-failed","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}