kubelogin get-token --login azurecli stuck on cloudshell

[tdihp]

Hi,

I have a fresh Azure cloud-shell bash session, with az aks get-credentials ran, then kubelogin convert-kubeconfig -l azurecli. we found kubectl get nodes to be stuck.

checking kubelogin get-token --login azurecli --server-id <redacted> -v 99, I realize it is stuck on:

I0514 02:48:14.721632     935 execCredentialPlugin.go:34] Login Method: azurecli, Environment: AzurePublicCloud, TenantID: , ServerID: <redacted>, ClientID: , IsLegacy: false, msiResourceID: , Timeout: 30s, tokenCacheDir: /home/ping/.kube/cache/kubelogin/, tokenCacheFile: /home/ping/.kube/cache/kubelogin/AzurePublicCloud-<redacted>--.json, AZURE_CONFIG_DIR: 
I0514 02:48:14.721807     935 execCredentialPlugin.go:114] acquire new token

Unfortunately there isn't much logged all the way until it times out with those messages:

Error: failed to get token: expected an empty error but received: AzureCLICredential: ERROR: Failed to connect to MSI. Please make sure MSI is configured correctly.

This error goes away if I explicitly run az login. It looks like NewAzureCLICredential-->GetToken does something unexpected with the vanilla cloud-shell credentials.

[bcho]

Is it the same issue like Azure/azure-cli#17695 ?

[tdihp]

It should be @bcho, it will be nice if kubelogin or upstream can do something to at least make the error message clear.