microsoft/aspire · error

az resource list failed while checking AKS cluster existence

Error message

az resource list failed while checking AKS cluster existence (exit code {result.ExitCode}): {result.StandardError}

What it means

Before fetching credentials, AksResourceExistsAsync runs `az resource list` to check whether the persisted AKS cluster still exists. Non-zero exit normally throws; the only tolerated case is a '(ResourceGroupNotFound)' error in stderr, which cleanly maps to 'cluster absent' so cleanup can be skipped. Any other CLI failure raises this error.

Solutions

1. Re-authenticate with `az login` or refresh the service-principal credentials and retry.
2. Manually execute the az resource list arguments from the error output to see the full ARM error.
3. Confirm the subscription ID exists and the identity has at least Reader on it.
4. If transient (network/5xx), retry the destroy/deploy operation.

Example fix

// before
az resource list --subscription <stale-sub> ...  // exits 3: subscription not found

// after
az login
az account set --subscription <current-sub>
# rerun; or explicitly set Azure:SubscriptionId to the live subscription

var acct = Process.Start("az", "account show");
acct.WaitForExit();
if (acct.ExitCode != 0) throw new InvalidOperationException("az not authenticated.");

try { await DestroyAsync(); }
catch (InvalidOperationException ex) when (ex.Message.Contains("az resource list failed while checking AKS cluster existence"))
{
    // re-authenticate or fix subscription, then retry; ResourceGroupNotFound is benign
}

When it happens

Trigger: GetAksCredentialsAsync calls AksResourceExistsAsync and `az resource list` exits non-zero with an error other than ResourceGroupNotFound: authentication failure, subscription not found/accessible, malformed query arguments, network/ARM outages, or az CLI internal errors.

Common situations: az session expired mid-destroy; subscription ID resolved from stale state that no longer exists; service principal lacking Reader on the subscription; transient ARM 5xx/timeouts in CI.

Related errors

• az aks get-credentials failed
• az resource list failed
• Azure destroy step for environment
• Azure environment resource required by AKS environment
• AzureKubernetesLoadBalancerResource

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/4cd1b5fba5ca9564. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.Kubernetes/AzureKubernetesEnvironmentResource.AksPipeline.cs:988

        string resourceGroup,
        string clusterName,
        Func<string, string, Task<AzCommandResult>> runAzCommandAsync)
    {
        var result = await runAzCommandAsync(
            azPath,
            BuildAksResourceExistsArguments(subscriptionId, resourceGroup, clusterName)).ConfigureAwait(false);

        if (result.ExitCode != 0)
        {
            // Azure CLI reports an out-of-band deleted resource group as:
            //   (ResourceGroupNotFound) Resource group 'deployment-rg' could not be found.
            // This proves the persisted AKS resource is absent, so cluster cleanup can be skipped.
            if (result.StandardError.Contains("(ResourceGroupNotFound)", StringComparison.OrdinalIgnoreCase))
            {
                return false;
            }

            throw new InvalidOperationException(
                $"az resource list failed while checking AKS cluster existence " +
                $"(exit code {result.ExitCode}): {result.StandardError}");
        }

        return !string.IsNullOrWhiteSpace(result.StandardOutput);
    }

    internal static string BuildGetCredentialsArguments(
        string subscriptionId,
        string resourceGroup,
        string clusterName)
        => $"aks get-credentials --resource-group \"{resourceGroup}\" --name \"{clusterName}\" --file - --subscription \"{subscriptionId}\"";

    internal static string BuildResourceGroupQueryArguments(string subscriptionId, string clusterName)
        => $"resource list --resource-type Microsoft.ContainerService/managedClusters --name \"{clusterName}\" --query [].resourceGroup -o tsv --subscription \"{subscriptionId}\"";

    internal static string BuildAksResourceExistsArguments(
        string subscriptionId,

View on GitHub (pinned to 25830f84bd)