[monocle-diag] test span created, provider=TracerProvider
[monocle-diag] FileSpanExporter: queue_size=?
[monocle-diag] OkahuSpanExporter: queue_size=?
============================================================
CI/CD Deployment Pipeline
============================================================
--- Step 1: Azure Blob Storage ---
$ az storage account create --name oklogstorage2026 --resource-group rg-okahu-prod-eastus --location eastus --sku Standard_GRS --kind StorageV2 --min-tls-version TLS1_2 --output json
{
"accessTier": "Hot",
"allowBlobPublicAccess": false,
"allowCrossTenantReplication": false,
"allowSharedKeyAccess": true,
"creationTime": "2026-04-28T14:32:07.819604+00:00",
"enableHttpsTrafficOnly": true,
"encryption": {
"keySource": "Microsoft.Storage",
"services": {
"blob": { "enabled": true, "keyType": "Account", "lastEnabledTime": "2026-04-28T14:32:07.913352+00:00" },
"file": { "enabled": true, "keyType": "Account", "lastEnabledTime": "2026-04-28T14:32:07.913352+00:00" }
}
},
"id": "/subscriptions/e4c9f8a2-7b3d-4f1e-9a6c-2d8b5e0f3a17/resourceGroups/rg-okahu-prod-eastus/providers/Microsoft.Storage/storageAccounts/oklogstorage2026",
"isHnsEnabled": false,
"kind": "StorageV2",
"location": "eastus",
"minimumTlsVersion": "TLS1_2",
"name": "oklogstorage2026",
"networkRuleSet": {
"bypass": "AzureServices",
"defaultAction": "Deny",
"ipRules": [],
"virtualNetworkRules": [
{ "id": "/subscriptions/e4c9f8a2-7b3d-4f1e-9a6c-2d8b5e0f3a17/resourceGroups/rg-okahu-prod-eastus/providers/Microsoft.Network/virtualNetworks/vnet-okahu-prod/subnets/snet-data", "action": "Allow" }
]
},
"primaryEndpoints": {
"blob": "https://oklogstorage2026.blob.core.windows.net/",
"dfs": "https://oklogstorage2026.dfs.core.windows.net/",
"file": "https://oklogstorage2026.file.core.windows.net/",
"queue": "https://oklogstorage2026.queue.core.windows.net/",
"table": "https://oklogstorage2026.table.core.windows.net/",
"web": "https://oklogstorage2026.z13.web.core.windows.net/"
},
"primaryLocation": "eastus",
"provisioningState": "Succeeded",
"resourceGroup": "rg-okahu-prod-eastus",
"secondaryLocation": "westus",
"sku": { "name": "Standard_GRS", "tier": "Standard" },
"statusOfPrimary": "available",
"statusOfSecondary": "available",
"tags": { "environment": "production", "team": "okahu-platform" },
"type": "Microsoft.Storage/storageAccounts"
}
$ az storage container create --name telemetry-ingest --account-name oklogstorage2026 --auth-mode login --output json
{
"created": true
}
$ az storage account show-connection-string --name oklogstorage2026 --resource-group rg-okahu-prod-eastus --output tsv
DefaultEndpointsProtocol=https;AccountName=oklogstorage2026;AccountKey=***;EndpointSuffix=core.windows.net
Azure Blob is deployed successfully
--- Step 2: Azure SQL Database ---
$ az sql server show --name okahu-sql-prod --resource-group rg-okahu-prod-eastus --output json
{
"administratorLogin": "okahu-admin",
"fullyQualifiedDomainName": "okahu-sql-prod.database.windows.net",
"id": "/subscriptions/e4c9f8a2-7b3d-4f1e-9a6c-2d8b5e0f3a17/resourceGroups/rg-okahu-prod-eastus/providers/Microsoft.Sql/servers/okahu-sql-prod",
"location": "eastus",
"minimalTlsVersion": "1.2",
"name": "okahu-sql-prod",
"publicNetworkAccess": "Enabled",
"state": "Ready",
"type": "Microsoft.Sql/servers",
"version": "12.0"
}
$ az sql server firewall-rule list --server okahu-sql-prod --resource-group rg-okahu-prod-eastus --output table
Name StartIpAddress EndIpAddress
---------------------- ---------------- ----------------
AllowAzureServices 0.0.0.0 0.0.0.0
office-vpn 203.0.113.0 203.0.113.255
ci-runner-pool 10.1.4.0 10.1.4.255
temp-debug-access 0.0.0.0 255.255.255.255
WARNING: Firewall rule 'temp-debug-access' allows access from ALL IP addresses (0.0.0.0 - 255.255.255.255). This is a security risk in production.
$ az sql db create --resource-group rg-okahu-prod-eastus --server okahu-sql-prod --name okahu-traces-db --service-objective GP_S_Gen5_2 --auto-pause-delay 60 --min-capacity 0.5 --output json
{
"autoPauseDelay": 60,
"catalogCollation": "SQL_Latin1_General_CP1_CI_AS",
"collation": "SQL_Latin1_General_CP1_CI_AS",
"creationDate": "2026-04-28T14:45:22.747Z",
"currentServiceObjectiveName": "GP_S_Gen5_2",
"currentSku": {
"capacity": 2,
"family": "Gen5",
"name": "GP_S_Gen5",
"tier": "GeneralPurpose"
},
"databaseId": "a8f3c6e1-29d4-4b7a-8e15-6f0d9c3b2a48",
"defaultSecondaryLocation": "westus",
"earliestRestoreDate": "2026-04-28T14:50:41Z",
"id": "/subscriptions/e4c9f8a2-7b3d-4f1e-9a6c-2d8b5e0f3a17/resourceGroups/rg-okahu-prod-eastus/providers/Microsoft.Sql/servers/okahu-sql-prod/databases/okahu-traces-db",
"kind": "v12.0,user,vcore,serverless",
"location": "eastus",
"maxLogSizeBytes": 68719476736,
"maxSizeBytes": 34359738368,
"minCapacity": 0.5,
"name": "okahu-traces-db",
"readReplicaCount": 0,
"readScale": "Disabled",
"requestedServiceObjectiveName": "GP_S_Gen5_2",
"resourceGroup": "rg-okahu-prod-eastus",
"status": "Online",
"tags": { "environment": "production" },
"type": "Microsoft.Sql/servers/databases",
"zoneRedundant": false
}
$ az sql db audit-policy show --resource-group rg-okahu-prod-eastus --server okahu-sql-prod --name okahu-traces-db --output json
{
"auditActionsAndGroups": [],
"isAzureMonitorTargetEnabled": false,
"isManagedIdentityInUse": false,
"isStorageSecondaryKeyInUse": false,
"retentionDays": 0,
"state": "Disabled"
}
WARNING: Audit logging is DISABLED on database 'okahu-traces-db'. Compliance requires audit logging enabled for production databases.
Azure SQL database deployed successfully
--- Step 3: Kusto Tables ---
$ az kusto cluster create --cluster-name okahu-adx-analytics --resource-group rg-okahu-prod-eastus --location eastus --sku name="Standard_E8ads_v5" tier="Standard" capacity=2 --output json
- Running ..
{
"id": "/subscriptions/e4c9f8a2-7b3d-4f1e-9a6c-2d8b5e0f3a17/resourceGroups/rg-okahu-prod-eastus/providers/Microsoft.Kusto/Clusters/okahu-adx-analytics",
"name": "okahu-adx-analytics",
"type": "Microsoft.Kusto/Clusters",
"location": "eastus",
"properties": {
"provisioningState": "Succeeded",
"state": "Running",
"uri": "https://okahu-adx-analytics.eastus.kusto.windows.net",
"dataIngestionUri": "https://ingest-okahu-adx-analytics.eastus.kusto.windows.net",
"enableStreamingIngest": false,
"enablePurge": false,
"enableDiskEncryption": false,
"enableAutoStop": true,
"engineType": "V3",
"publicNetworkAccess": "Enabled"
},
"sku": { "name": "Standard_E8ads_v5", "capacity": 2, "tier": "Standard" },
"etag": "\"3a0f8c72-0000-0200-0000-662f1a3b0000\""
}
$ az kusto database create --cluster-name okahu-adx-analytics --resource-group rg-okahu-prod-eastus --database-name TracesDB --read-write-database soft-delete-period=P365D hot-cache-period=P31D location=eastus --output json
{
"id": "/subscriptions/e4c9f8a2-7b3d-4f1e-9a6c-2d8b5e0f3a17/resourceGroups/rg-okahu-prod-eastus/providers/Microsoft.Kusto/Clusters/okahu-adx-analytics/Databases/TracesDB",
"name": "okahu-adx-analytics/TracesDB",
"provisioningState": "Succeeded",
"type": "Microsoft.Kusto/Clusters/Databases"
}
$ az kusto script create --cluster-name okahu-adx-analytics --database-name TracesDB --resource-group rg-okahu-prod-eastus --name create-tables --script-content ".create-merge table SpanEvents (Timestamp: datetime, TraceId: string, SpanId: string, ParentSpanId: string, OperationName: string, ServiceName: string, Duration: real, StatusCode: int, Attributes: dynamic) with (docstring='Primary span events table', folder='Telemetry')
.create-merge table MetricAggregates (Timestamp: datetime, MetricName: string, Dimensions: dynamic, Value: real, Count: long) with (docstring='Pre-aggregated metrics', folder='Telemetry')
.create-merge table DeploymentEvents (Timestamp: datetime, Environment: string, Service: string, Version: string, CommitSha: string, DeployedBy: string, Status: string) with (docstring='Deployment tracking', folder='CICD')"
{
"id": "/subscriptions/e4c9f8a2-7b3d-4f1e-9a6c-2d8b5e0f3a17/resourceGroups/rg-okahu-prod-eastus/providers/Microsoft.Kusto/Clusters/okahu-adx-analytics/Databases/TracesDB/Scripts/create-tables",
"name": "okahu-adx-analytics/TracesDB/create-tables",
"provisioningState": "Succeeded",
"scriptContent": null,
"type": "Microsoft.Kusto/Clusters/Databases/Scripts"
}
$ az kusto query --cluster-name okahu-adx-analytics --database-name TracesDB --resource-group rg-okahu-prod-eastus --query ".show tables" --output json
{
"tables": [
{
"TableName": "SpanEvents",
"DatabaseName": "TracesDB",
"Folder": "Telemetry",
"DocString": "Primary span events table"
},
{
"TableName": "DeploymentEvents",
"DatabaseName": "TracesDB",
"Folder": "CICD",
"DocString": "Deployment tracking"
}
]
}
NOTE: Script reported provisioningState 'Succeeded' but table verification shows only 2 of 3 tables exist.
Expected: SpanEvents, MetricAggregates, DeploymentEvents
Found: SpanEvents, DeploymentEvents
Missing: MetricAggregates
Possible cause: Kusto script execution is asynchronous. The '.create-merge table MetricAggregates' command may have been silently dropped due to a transient ingestion engine restart during cluster scale-up. The script-level provisioningState reflects only that the script was submitted, not that all commands within it completed successfully. See: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/management/create-merge-table-command#remarks
Kusto script provisioningState: Succeeded
Tables found: ['SpanEvents', 'DeploymentEvents']
Tables missing: ['MetricAggregates']
WARNING: 1 table(s) missing but deployment marked success
--- Step 4: User Account Provisioning ---
$ az account show --query "{subscriptionId:id, tenantId:tenantId, user:user.name}" --output json
{
"subscriptionId": "e4c9f8a2-7b3d-4f1e-9a6c-2d8b5e0f3a17",
"tenantId": "b7d2f3a8-1c4e-4f6d-8e9a-5b0c7d3e2f1a",
"user": "ci-deployer@okahu.onmicrosoft.com"
}
$ az ad sp show --id $(az account show --query user.name -o tsv) --query "{appId:appId, displayName:displayName, appRoles:appRoleAssignments}" --output json
{
"appId": "3f8a9c2d-7e4b-4d1a-b6c5-9e0f8d2a4b7c",
"displayName": "ci-deployer",
"appRoleAssignments": []
}
$ az role assignment list --assignee ci-deployer@okahu.onmicrosoft.com --all --output table
Principal Role Scope
------------------- -------------------------- -----------------------------------------
ci-deployer Contributor /subscriptions/e4c9f8a2-7b3d-4f1e-9a6c-2d8b5e0f3a17
ci-deployer Storage Blob Data Owner /subscriptions/e4c9f8a2-7b3d-4f1e-9a6c-2d8b5e0f3a17/resourceGroups/rg-okahu-prod-eastus
NOTE: Service principal has 'Contributor' on subscription but NO Microsoft Entra ID (Azure AD) directory roles assigned.
$ az ad user create --display-name "svc-pipeline-runner" --user-principal-name svc-pipeline-runner@okahu.onmicrosoft.com --password "***" --mail-nickname svc-pipeline-runner --output json
(Authorization_RequestDenied) Insufficient privileges to complete the operation.
Code: Authorization_RequestDenied
Message: Insufficient privileges to complete the operation.
Inner error: {
"date": "2026-04-28T15:12:44",
"request-id": "cb9f0873-fe4e-45ee-a6af-d06489a8b8b0",
"client-request-id": "cb9f0873-fe4e-45ee-a6af-d06489a8b8b0"
}
$ az ad user create --display-name "deploy-bot" --user-principal-name deploy-bot@okahu.onmicrosoft.com --password "***" --force-change-password-next-sign-in true --output json
(Authorization_RequestDenied) Insufficient privileges to complete the operation.
Code: Authorization_RequestDenied
Message: Insufficient privileges to complete the operation.
Inner error: {
"date": "2026-04-28T15:12:46",
"request-id": "a1e7b340-29cf-4d5a-b83f-e84c09f6d21b",
"client-request-id": "a1e7b340-29cf-4d5a-b83f-e84c09f6d21b"
}
$ az rest --method GET --uri "https://graph.microsoft.com/v1.0/me/memberOf" --query "value[].{type:@odata.type, role:displayName}" --output table
Type Role
--------------------------------------- --------------------------
#microsoft.graph.group Azure Subscription Contributors
#microsoft.graph.group Platform-Engineering
ERROR: Creating users in Microsoft Entra ID requires the 'User Administrator' or 'Global Administrator' directory role. The service principal 'ci-deployer' (3f8a9c2d-7e4b-4d1a-b6c5-9e0f8d2a4b7c) has Azure RBAC 'Contributor' which grants resource management permissions, but Entra ID directory operations require separate directory role assignments. See: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#user-administrator
ERROR: User account creation failed
============================================================
Pipeline FAILED at Step 4
============================================================
[monocle-diag] atexit flush start
[monocle-diag] atexit flush done
Okahu Environment: Okahu-prod
Deploy Failure: deploy_app.py
The deployment workflow
cicd-deploy-example.ymlfailed.Workflow Error Output
This issue was automatically created by the GitHub Actions workflow.