Skip to content

az aks bastion fails when bastion is on a different Subscription #33579

Closed
Azure/azure-cli-extensions
#9953

Description

Describe the bug

 az aks bastion --name aks-cluster --resource-group aks-resource-group --subscription <aks subscription id> --bastion /subscriptions/<hub subscription id>/resourceGroups/bastion-resource-group/pro
viders/Microsoft.Network/bastionHosts/bastion-name --verbose

Results in:

creating temporary directory: /tmp/teynde
Merged "aks-cluster" as current context in /tmp/teynde/.kube/config
Converted kubeconfig to use Azure CLI authentication.
Creating bastion tunnel with command: 'az network bastion tunnel --resource-group bastion-resource-group --name bastion-name --port 43157 --target-resource-id /subscriptions/<aks subscription id>/resourcegroups/aks-resource-group/providers/Microsoft.ContainerService/managedClusters/aks-cluster --resource-port 443 --subscription <aks subscription id>'

It points the subcommand to an incorrect subscription_id it should receive the subscription_id from the resource_id of the bastion but points it to the subscription id of the AKS cluster

Related command

az aks bastion --name aks-cluster --resource-group aks-resource-group --subscription --bastion /subscriptions//resourceGroups/bastion-resource-group/pro
viders/Microsoft.Network/bastionHosts/bastion-name --verbose

Errors

Bastion tunnel exited with code 3

Issue script & Debug output

N/A

Expected behavior

Properly pass the correct subscription_ids to the subcommand

Environment Summary

WSL Ubuntu

{
"azure-cli": "2.87.0",
"azure-cli-core": "2.87.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"aks-preview": "21.0.0b4",
"amg": "3.0.0",
"azure-firewall": "2.2.0",
"bastion": "1.4.3",
"k8s-extension": "1.7.0",
"log-analytics": "1.0.0b1",
"monitor-control-service": "1.2.0"
}
}

Additional context

Funnily enough this only pops up in my WSL, my Windows still works but is on an older AZ Version:

azure-cli                         2.86.0 *

core                              2.86.0 *
telemetry                          1.1.0

Extensions:
aks-preview                    19.0.0b22
bastion                            1.4.3

Dependencies:
msal                              1.35.1
azure-mgmt-resource               24.0.0

Activity

  1. added
    bugThis issue requires a change to an existing behavior in the product in order to be resolved.
    on Jun 17, 2026
  2. yonzhan commented on Jun 17, 2026

    @yonzhan
    Collaborator

    Thank you for opening this issue, we will look into it.

  3. added a commit that references this issue on Jun 22, 2026
    5d53d48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

AKSaz aks/acs/openshiftAuto-AssignAuto assign by botService AttentionThis issue is responsible by Azure service team.act-observability-squadbugThis issue requires a change to an existing behavior in the product in order to be resolved.customer-reportedIssues that are reported by GitHub users external to the Azure organization.

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions