Skip to content

Azure CLI k8s-extension Installation Fails Due to Missing maturin Dependency #34062

Open
#34140
Open
Azure CLI k8s-extension Installation Fails Due to Missing maturin Dependency#34062
#34140
Labels
AKSaz aks/acs/openshiftService AttentionThis issue is responsible by Azure service team.bugThis issue requires a change to an existing behavior in the product in order to be resolved.customer-reportedIssues that are reported by GitHub users external to the Azure organization.

Description

@r-devops-github
drunkbear (r-devops-github)
opened on Sep 11, 2026

Describe the bug

Installing the Azure CLI k8s-extension fails during dependency installation on Windows.

Environment:

  • Operating system: Windows
  • Azure CLI version: 2.90.0 (latest released version)
  • Extension: k8s-extension

Steps to reproduce:

  1. Install Azure CLI version 2.90.0.
  2. Run:
    az version
  3. Run:
    az extension add --name k8s-extension --debug

Behavior:
The extension downloads successfully and passes checksum validation. However, installation fails while pip is resolving and building the cryptography dependency.

The command ends with:

pip._vendor.pyproject_hooks._impl.BackendUnavailable:
Cannot import 'maturin'

Azure CLI then reports:

An error occurred. Pip failed with status code 2.

The k8s-extension is not installed.

Relevant output:
Collecting cryptography>=41.0.5
Downloading cryptography-50.0.1.tar.gz
Installing build dependencies: started
Installing build dependencies: finished with status 'done'
Getting requirements to build wheel: started
Getting requirements to build wheel: finished with status 'done'

pip._vendor.pyproject_hooks._impl.BackendUnavailable:
Cannot import 'maturin'

Related command

az extension add -n k8s-extension --debug

Errors

pip._vendor.pyproject_hooks._impl.BackendUnavailable: Cannot import 'maturin'

Issue script & Debug output

Collecting kubernetes==24.2.0 (from k8s-extension==1.8.0)
Downloading kubernetes-24.2.0-py2.py3-none-any.whl.metadata (1.5 kB)
Collecting oras==0.2.25 (from k8s-extension==1.8.0)
Downloading oras-0.2.25-py3-none-any.whl.metadata (11 kB)
Collecting azure-mgmt-network>=18.0.0 (from k8s-extension==1.8.0)
Downloading azure_mgmt_network-32.0.0-py3-none-any.whl.metadata (129 kB)
Collecting certifi>=14.05.14 (from kubernetes==24.2.0->k8s-extension==1.8.0)
Downloading certifi-2026.7.22-py3-none-any.whl.metadata (2.5 kB)
Collecting six>=1.9.0 (from kubernetes==24.2.0->k8s-extension==1.8.0)
Downloading six-1.17.0-py2.py3-none-any.whl.metadata (1.7 kB)
Collecting python-dateutil>=2.5.3 (from kubernetes==24.2.0->k8s-extension==1.8.0)
Downloading python_dateutil-2.9.0.post0-py2.py3-none-any.whl.metadata (8.4 kB)
Collecting setuptools>=21.0.0 (from kubernetes==24.2.0->k8s-extension==1.8.0)
Downloading setuptools-84.0.0-py3-none-any.whl.metadata (6.6 kB)
Collecting pyyaml>=5.4.1 (from kubernetes==24.2.0->k8s-extension==1.8.0)
Downloading pyyaml-6.0.3.tar.gz (130 kB)
Installing build dependencies: started
Installing build dependencies: finished with status 'done'
Getting requirements to build wheel: started
Getting requirements to build wheel: finished with status 'done'
Preparing metadata (pyproject.toml): started
Preparing metadata (pyproject.toml): finished with status 'done'
Collecting google-auth>=1.0.1 (from kubernetes==24.2.0->k8s-extension==1.8.0)
Downloading google_auth-2.58.0-py3-none-any.whl.metadata (6.0 kB)
Collecting websocket-client!=0.40.0,!=0.41.,!=0.42.,>=0.32.0 (from kubernetes==24.2.0->k8s-extension==1.8.0)
Downloading websocket_client-1.9.2-py3-none-any.whl.metadata (8.3 kB)
Collecting requests (from kubernetes==24.2.0->k8s-extension==1.8.0)
Downloading requests-2.34.2-py3-none-any.whl.metadata (4.8 kB)
Collecting requests-oauthlib (from kubernetes==24.2.0->k8s-extension==1.8.0)
Downloading requests_oauthlib-2.0.0-py2.py3-none-any.whl.metadata (11 kB)
Collecting urllib3>=1.24.2 (from kubernetes==24.2.0->k8s-extension==1.8.0)
Downloading urllib3-2.7.0-py3-none-any.whl.metadata (6.9 kB)
Collecting jsonschema (from oras==0.2.25->k8s-extension==1.8.0)
Downloading jsonschema-4.26.0-py3-none-any.whl.metadata (7.6 kB)
Collecting isodate>=0.6.1 (from azure-mgmt-network>=18.0.0->k8s-extension==1.8.0)
Downloading isodate-0.7.2-py3-none-any.whl.metadata (11 kB)
Collecting azure-mgmt-core>=1.6.0 (from azure-mgmt-network>=18.0.0->k8s-extension==1.8.0)
Downloading azure_mgmt_core-1.6.0-py3-none-any.whl.metadata (4.6 kB)
Collecting typing-extensions>=4.6.0 (from azure-mgmt-network>=18.0.0->k8s-extension==1.8.0)
Downloading typing_extensions-4.16.0-py3-none-any.whl.metadata (3.3 kB)
Collecting azure-core>=1.32.0 (from azure-mgmt-core>=1.6.0->azure-mgmt-network>=18.0.0->k8s-extension==1.8.0)
Downloading azure_core-1.41.0-py3-none-any.whl.metadata (49 kB)
Collecting pyasn1-modules>=0.2.1 (from google-auth>=1.0.1->kubernetes==24.2.0->k8s-extension==1.8.0)
Downloading pyasn1_modules-0.4.2-py3-none-any.whl.metadata (3.5 kB)
Collecting cryptography>=41.0.5 (from google-auth>=1.0.1->kubernetes==24.2.0->k8s-extension==1.8.0)
Downloading cryptography-50.0.1.tar.gz (880 kB)
---------------------------------------- 880.4/880.4 kB 5.7 MB/s 0:00:00
Installing build dependencies: started
Installing build dependencies: finished with status 'done'
Getting requirements to build wheel: started
Getting requirements to build wheel: finished with status 'done'
ERROR: Exception:
Traceback (most recent call last):
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\cli\base_command.py", line 109, in _run_wrapper
status = _inner_run()
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\cli\base_command.py", line 102, in _inner_run
return self.run(options, args)
~~~~~~~~^^^^^^^^^^^^^^^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\cli\req_command.py", line 106, in wrapper
return func(self, options, args)
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\commands\install.py", line 478, in run
requirement_set = resolver.resolve(
reqs, check_supported_wheels=not options.target_dir
)
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\resolution\resolvelib\resolver.py", line 103, in resolve
result = self._result = resolver.resolve(
~~~~~~~~~~~~~~~~^
collected.requirements, max_rounds=limit_how_complex_resolution_can_be
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_vendor\resolvelib\resolvers\resolution.py", line 601, in resolve
state = resolution.resolve(requirements, max_rounds=max_rounds)
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_vendor\resolvelib\resolvers\resolution.py", line 513, in resolve
failure_criterion = self._attempt_to_pin_criterion(name)
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_vendor\resolvelib\resolvers\resolution.py", line 220, in _attempt_to_pin_criterion
criteria = self._get_updated_criteria(candidate)
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_vendor\resolvelib\resolvers\resolution.py", line 211, in _get_updated_criteria
self._add_to_criteria(criteria, requirement, parent=candidate)
~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_vendor\resolvelib\resolvers\resolution.py", line 150, in _add_to_criteria
if not criterion.candidates:
^^^^^^^^^^^^^^^^^^^^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_vendor\resolvelib\structs.py", line 194, in bool
return bool(self._sequence)
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\resolution\resolvelib\found_candidates.py", line 165, in bool
self._bool = any(self)
~~~^^^^^^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\resolution\resolvelib\found_candidates.py", line 149, in
return (c for c in iterator if id(c) not in self._incompatible_ids)
^^^^^^^^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\resolution\resolvelib\found_candidates.py", line 39, in _iter_built
candidate = func()
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\resolution\resolvelib\factory.py", line 181, in _make_candidate_from_link
base: BaseCandidate | None = self._make_base_candidate_from_link(
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
link, template, name, version
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\resolution\resolvelib\factory.py", line 227, in _make_base_candidate_from_link
self._link_candidate_cache[link] = LinkCandidate(
~~~~~~~~~~~~~^
link,
^^^^^
...<3 lines>...
version=version,
^^^^^^^^^^^^^^^^
)
^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\resolution\resolvelib\candidates.py", line 325, in init
super().init(
~~~~~~~~~~~~~~~~^
link=link,
^^^^^^^^^^
...<4 lines>...
version=version,
^^^^^^^^^^^^^^^^
)
^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\resolution\resolvelib\candidates.py", line 167, in init
self.dist = self._prepare()
~~~~~~~~~~~~~^^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\resolution\resolvelib\candidates.py", line 245, in _prepare
dist = self._prepare_distribution()
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\resolution\resolvelib\candidates.py", line 336, in _prepare_distribution
return preparer.prepare_linked_requirement(self._ireq, parallel_builds=True)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\operations\prepare.py", line 664, in prepare_linked_requirement
return self._prepare_linked_requirement(req, parallel_builds)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\operations\prepare.py", line 783, in _prepare_linked_requirement
dist = _get_prepared_distribution(
req,
...<4 lines>...
self.allow_editables,
)
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\operations\prepare.py", line 82, in _get_prepared_distribution
abstract_dist.prepare_distribution_metadata(
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
build_env_installer, build_isolation, check_build_deps, allow_editables
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\distributions\sdist.py", line 63, in prepare_distribution_metadata
self._install_build_reqs(
~~~~~~~~~~~~~~~~~~~~~~~~^
build_env_installer, build_isolation, allow_editables=allow_editables
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\distributions\sdist.py", line 159, in _install_build_reqs
build_reqs = self._get_build_requires_wheel()
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\distributions\sdist.py", line 131, in _get_build_requires_wheel
return backend.get_requires_for_build_wheel()
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_internal\utils\misc.py", line 734, in get_requires_for_build_wheel
return super().get_requires_for_build_wheel(config_settings=cs)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_vendor\pyproject_hooks_impl.py", line 196, in get_requires_for_build_wheel
return self._call_hook(
~~~~~~~~~~~~~~~^
"get_requires_for_build_wheel", {"config_settings": config_settings}
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\pip_vendor\pyproject_hooks_impl.py", line 402, in _call_hook
raise BackendUnavailable(
...<4 lines>...
)
pip._vendor.pyproject_hooks._impl.BackendUnavailable: Cannot import 'maturin'

Expected behavior

The k8s-extension installs successfully with all required dependencies.

Environment Summary

azure-cli 2.90.0

core 2.90.0
telemetry 1.1.0

Extensions:
k8s-configuration 2.3.0

Dependencies:
msal 1.36.0
azure-mgmt-resource 24.0.0

Python (Windows) 3.14.6 (tags/v3.14.6:c63aec6, Jun 10 2026, 10:13:15) [MSC v.1944 32 bit (Intel)]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

Additional context

No response

Activity

  1. drunkbear (r-devops-github)
    added
    bugThis issue requires a change to an existing behavior in the product in order to be resolved.
    on Sep 11, 2026
  2. microsoft-github-policy-service
    added
    customer-reportedIssues that are reported by GitHub users external to the Azure organization.
    on Sep 11, 2026

  3. yonzhan commented on Sep 11, 2026

    @yonzhan
    Yong Zhang (yonzhan)
    on Sep 11, 2026
    Collaborator

    Thank you for opening this issue, we will look into it.

  4. Yong Zhang (yonzhan)
    added
    AKSaz aks/acs/openshift
    Service AttentionThis issue is responsible by Azure service team.
    on Sep 11, 2026

  5. r-devops-github commented on Sep 17, 2026

    @r-devops-github
    drunkbear (r-devops-github)
    on Sep 17, 2026
    Author

    Hello, could we please get an update on the status of this issue?

  6. Aditya Pujara (a0x1ab)
    added
    Request X Engineering AgentRequest X Engineering Agent testing and review
    on Sep 28, 2026

  7. microsoft-github-policy-service commented on Sep 28, 2026

    @microsoft-github-policy-service
    microsoft-github-policy-servicebot
    on Sep 28, 2026 – with Microsoft GitHub Policy Service
    Contributor

    Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc FumingZhang, elvazhu521, Daniel Sol (@danielsollondon), @Azure/act-observability-squad.

  8. x-engineering-agent commented on Sep 28, 2026

    @x-engineering-agent
    x-engineering-agentbot
    on Sep 28, 2026 – with X Engineering Agent
    Contributor

    Bug Analysis

    Affected area: Azure CLI's extension installer (az extension add), in Azure/azure-cli; k8s-extension is the reported installation target.

    Reported reproducer: On Windows with Azure CLI 2.90.0, az extension add --name k8s-extension --debug downloads and verifies k8s-extension 1.8.0, but dependency installation selects cryptography-50.0.1.tar.gz through kubernetes -> google-auth. pip then raises BackendUnavailable: Cannot import 'maturin' and exits with status 2. Expected behavior is a successful extension installation. This is the reporter's evidence, not an independently reproduced result.

    Scope for investigation: Inspect the bundled Python/pip invocation and isolated build environment used by the extension installer. Confirm why a source distribution was selected and why its build backend cannot be imported. The Program Files (x86) path is a clue, not proof of interpreter architecture; distinguish interpreter/ABI compatibility, wheel availability, and build-environment propagation before choosing a fix. Do not assume that installing maturin globally or pinning an unrelated extension dependency resolves the root cause.

    Requirements for the fix:

    • Target the dev branch and keep changes scoped to extension installation and its directly affected dependency handling.
    • Preserve dependency isolation, interpreter selection, download/checksum validation, and existing Linux/macOS and Windows installation behavior.
    • Add a focused regression test for the reported backend-import failure path, including the production-shaped pip/subprocess environment. Exercise successful wheel installation and supported source-build behavior as applicable; do not rely only on mocked return values or weaken error reporting.
    • Place command-module coverage under src/azure-cli/azure/cli/command_modules/extension/tests/; add core extension-installation coverage under src/azure-cli-core/azure/cli/core/tests/ if the root cause is in core. Confirm the existing focused test selectors in the checkout and document the Windows validation and any remaining platform limitations.
    • This is a durable Foundry implementation request. The trusted publisher publishes validated artifacts; no implementation or live test is run in this triage round.

    Use this EXACT PR title: [Extension] Fix #34062: az extension add: Fix Windows dependency installation failures

    Mandatory Codegen execution protocol

    Before editing implementation files, determine whether the affected extension command is AAZ-generated. Files under aaz/<profile>/ are generated output and must never be patched directly, including by an AI agent. Check out Azure/aaz beside Azure/azure-rest-api-specs, Azure/aaz-dev-tools, and the downstream repository. API-schema defects start in the specification; command naming, grouping, arguments, API-version selection, help, and examples belong in the durable Azure/aaz command model; non-modelable client behavior belongs in a handwritten subclass or wrapper in custom.py, registered from commands.py. X Engineering Agent creates and promotes the corresponding durable Azure/aaz source pull request before it promotes downstream generated output.

    Follow the Azure CLI repository's Codegen workflow and the aaz-dev setup documentation. Set up the checked-out repositories with azdev setup. Use generate only when importing or redesigning command models from Swagger/TypeSpec. For an existing module whose durable Azure/aaz model has been updated, render that model with regenerate:

    aaz-dev cli regenerate --name extension --cli-path <azure-cli>

# New/imported command model only:
aaz-dev cli generate --spec <specification-name> --module extension

    You MUST actually run the generator; do not merely describe it or imitate its output. If the AAZ/specification checkout, local source change, credentials, or generator is unavailable, stop and report the blocker instead of editing generated files. Inspect _aaz_info provenance and the complete regenerated diff, then run focused azdev style, azdev linter, and azdev test validation. For an extension, also update its version and HISTORY.rst, preserve azext_metadata.json compatibility, and let release automation update src/index.json.

    PR title & description format (required)

    This repo enforces a PR format (guide). Please author the PR exactly as follows or CI's Check the Format of Pull Request Title and Content will fail.

    Use this EXACT PR title (copy verbatim, do not reword):

    [Extension] Fix #34062: `az extension add`: Fix Windows dependency installation failures

    Keep the backticks around the command and the Fix #34062: prefix. You may only adjust the wording after the command (the final summary) if the fix changes; the [Extension] prefix, issue link, and backticked command must stay.

    Description — follow the PR template and fill in:

    • Link the issue — start the Description with a closing keyword so the PR auto-links and closes it: Fixes #34062.
    • Related command — the az ... command this affects.
    • Description (mandatory) — why the bug happens, what you changed, and the resulting behavior.
    • Testing Guide — example command(s) showing the fix works.
    • History Notes — leave the title to drive the history note, or add extra lines in the same format (component in brackets + the command in backticks), e.g. [Extension] `az <command>`: <note>.
    • Keep the template checklist and tick the items you've satisfied.

    Posted by x-engineering-agent (Fixer)

  9. x-engineering-agent
    removed
    Request X Engineering AgentRequest X Engineering Agent testing and review
    on Sep 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    AKSaz aks/acs/openshiftService AttentionThis issue is responsible by Azure service team.bugThis issue requires a change to an existing behavior in the product in order to be resolved.customer-reportedIssues that are reported by GitHub users external to the Azure organization.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions