[bastion] az network bastion ssh fails with Python error - No module named 'pkg_resources'

[azclibot]

Source: Azure/azure-cli#33110 (by Jack (@430am))
Affected extension: bastion (src/bastion/)

---

<<UNTRUSTED:issue-33110>>

Issue #33110 (by Jack (@430am))

Title

az network bastion ssh fails with Python error - No module named 'pkg_resources'

Body

Describe the bug

When trying to ssh through Azure Bastion with native client support from local machine, it fails with a python error - "No module named 'pkg_resources'"

Here is the full error:

The command failed with an unexpected error. Here is the traceback:
No module named 'pkg_resources'
Traceback (most recent call last):
File "/usr/lib64/az/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 682, in execute
raise ex
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 812, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 781, in _run_job
result = cmd_copy(params)
^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 336, in call
return self.handler(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/command_operation.py", line 120, in handler
return op(**command_args)
^^^^^^^^^^^^^^^^^^
File "/home/jackw/.azure/cliextensions/bastion/azext_bastion/custom.py", line 174, in ssh_bastion_host
_test_extension(SSH_EXTENSION_NAME)
File "/home/jackw/.azure/cliextensions/bastion/azext_bastion/custom.py", line 107, in _test_extension
from pkg_resources import parse_version
ModuleNotFoundError: No module named 'pkg_resources'

Related command

az network bastion ssh --name bastion-netscus --resource-group rg-networks --target-resource-id "/subscriptions//resourceGroups/rg-cyclecloud/providers/Microsoft.Compute/virtualMachines/vm-ccapp" --auth-type ssh-key --username azureuser --ssh-key ~/.ssh/id_ed25519

Errors

The command failed with an unexpected error. Here is the traceback:
No module named 'pkg_resources'
Traceback (most recent call last):
File "/usr/lib64/az/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 682, in execute
raise ex
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 812, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 781, in _run_job
result = cmd_copy(params)
^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 336, in call
return self.handler(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/command_operation.py", line 120, in handler
return op(**command_args)
^^^^^^^^^^^^^^^^^^
File "/home/jackw/.azure/cliextensions/bastion/azext_bastion/custom.py", line 174, in ssh_bastion_host
_test_extension(SSH_EXTENSION_NAME)
File "/home/jackw/.azure/cliextensions/bastion/azext_bastion/custom.py", line 107, in _test_extension
from pkg_resources import parse_version
ModuleNotFoundError: No module named 'pkg_resources'

Issue script & Debug output

az network bastion ssh --name bastion-netscus --resource-group rg-networks --target-resource-id "/subscriptions//resourceGroups/rg-cyclecloud/providers/Microsoft.Compute/virtualMachines/vm-ccapp" --auth-type ssh-key --username azureuser --ssh-key ~/.ssh/id_ed25519 --debug 2>&1 | tee ~/az_net_ssh_debug.log

DEBUG: cli.knack.cli: Command arguments: ['network', 'bastion', 'ssh', '--name', 'bastion-netscus', '--resource-group', 'rg-networks', '--target-resource-id', '/subscriptions//resourceGroups/rg-cyclecloud/providers/Microsoft.Compute/virtualMachines/vm-ccapp', '--auth-type', 'ssh-key', '--username', 'azureuser', '--ssh-key', '/home/jackw/.ssh/id_ed25519', '--debug']
DEBUG: cli.knack.cli: init debug log:
Cannot enable color.
DEBUG: cli.knack.cli: Event: Cli.PreExecute []
DEBUG: cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x7f1b9299ef20>, <function OutputProducer.on_global_arguments at 0x7f1b9271e020>, <function CLIQuery.on_global_arguments at 0x7f1b9275b560>]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
DEBUG: cli.azure.cli.core: Modules found from index for 'network': ['azure.cli.command_modules.privatedns', 'azure.cli.command_modules.network', 'azext_bastion']
DEBUG: cli.azure.cli.core: Loading command modules...
DEBUG: cli.azure.cli.core: Loaded command modules in parallel:
DEBUG: cli.azure.cli.core: Name Load Time Groups Commands
DEBUG: cli.azure.cli.core: privatedns 0.099 14 60
DEBUG: cli.azure.cli.core: network 0.381 122 370
DEBUG: cli.azure.cli.core: Total (2) 0.383 136 430
DEBUG: cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
DEBUG: cli.azure.cli.core: Loading extensions:
DEBUG: cli.azure.cli.core: Name Load Time Groups Commands Directory
DEBUG: cli.azure.cli.core: bastion 0.004 2 9 /home/jackw/.azure/cliextensions/bastion
DEBUG: cli.azure.cli.core: Total (1) 0.004 2 9
DEBUG: cli.azure.cli.core: Loaded 136 groups, 439 commands.
DEBUG: cli.azure.cli.core: Found a match in the command table.
DEBUG: cli.azure.cli.core: Raw command : network bastion ssh
DEBUG: cli.azure.cli.core: Command table: network bastion ssh
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x7f1b917a8720>]
DEBUG: cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/home/jackw/.azure/commands/2026-03-31.09-41-41.network_bastion_ssh.3442.log'.
INFO: az_command_data_logger: command args: network bastion ssh --name {} --resource-group {} --target-resource-id {} --auth-type {} --username {} --ssh-key {} --debug
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x7f1b9161cae0>]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x7f1b9161cb80>, <function register_cache_arguments..add_cache_arguments at 0x7f1b9161cd60>, <function register_upcoming_breaking_change_info..update_breaking_change_info at 0x7f1b9161ce00>]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x7f1b9271e0c0>, <function CLIQuery.handle_query_parameter at 0x7f1b9275b600>, <function register_ids_argument..parse_ids_arguments at 0x7f1b9161cc20>]
INFO: az_command_data_logger: extension name: bastion
INFO: az_command_data_logger: extension version: 1.4.2
DEBUG: cli.azure.cli.core.azclierror: Traceback (most recent call last):
File "/usr/lib64/az/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands
... [truncated, original was 14312 chars]

Comments

Comment by Yong Zhang (@yonzhan)

Thank you for opening this issue, we will look into it.

Comment by Pawel Winogrodzki (@PawelWMS)

I believe the CLI uses setuptools and they deprecated pkg_resources starting from version 82.0.0. Here's a message when running with 81.0.0:
'''

from pkg_resources import parse_version
:1: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
'''

There seems to be an ongoing thread regarding this topic in the upstream.

Comment by Shay Nehmad (@TheCoreMan)

Jack (@430am) This fixed it for me, just run:

'''
az extension update --name bastion
'''

Running az version after the update shows bastion 1.4.3

Comment by Pawel Winogrodzki (@PawelWMS)

Thanks, Shay Nehmad (@TheCoreMan), that solved it for me as well.

Comment by Paul (@paulvandenburg)

Shay Nehmad (@TheCoreMan)'s fix also worked for me.

However I'm using the official azure-cli deb source:
'''
Types: deb
URIs: https://packages.microsoft.com/repos/azure-cli/
Suites: noble
Components: main
Architectures: amd64
Signed-by: /etc/apt/keyrings/microsoft.gpg
'''

I think this should be handled by the package upgrade itself?
There might be other extensions that are in need of updates too that I just haven't run into problems with and I'm unaware of?

Comment by Mathijs (@toaomatis)

'''
az extension update --name bastion
'''

Can confirm this also works on the Arch / pacman version of azure-cli

Comment by David Stamen (@dstamen)

updating extension for me did not fix it. the from packaging.version import Version as parse_version did please m[~]erge this pr!
<<END:issue-33110>>

[azclibot]

This is a tracker issue for Azure/azure-cli#33110.

Bug Summary

az network bastion ssh fails with ModuleNotFoundError: No module named 'pkg_resources' when using the bastion extension version 1.4.2.

Root cause: azext_bastion/custom.py uses from pkg_resources import parse_version, but pkg_resources was deprecated in setuptools >= 82.0.0. The fix is to replace this import with from packaging.version import Version as parse_version (the packaging library is already a standard Azure CLI dependency).

Failing command:

az network bastion ssh --name <bastion-name> --resource-group <rg>   --target-resource-id <vm-resource-id>   --auth-type ssh-key --username <user> --ssh-key ~/.ssh/id_ed25519

Error:

ModuleNotFoundError: No module named 'pkg_resources'
  File "azext_bastion/custom.py", line 107, in _test_extension
    from pkg_resources import parse_version

Fix: In azext_bastion/custom.py, replace:

from pkg_resources import parse_version

with:

from packaging.version import Version as parse_version

PR title & description format (required)

This repo enforces a PR format (guide). Please author the PR exactly as follows or CI's Check the Format of Pull Request Title and Content will fail.

Title

• Start with [Bastion] — square brackets [] for a customer-facing change (added to HISTORY.rst), curly {} if not. A bug fix is customer-facing, so use [].
• Then Fix #9994: to link the issue.
• Then optionally the affected command az <command>:.
• Then a present-tense, capitalized verb (Fix for bug fixes; Add/Change/Deprecate/Remove otherwise) and a concise summary.
• Recommended title: [Bastion] Fix #9994: az <command>: Fix <concise description of the fix>

Description — follow the PR template and fill in:

• Link the issue — start the Description with a closing keyword so the PR auto-links and closes it: Fixes #9994.
• Related command — the az ... command this affects.
• Description (mandatory) — why the bug happens, what you changed, and the resulting behavior.
• Testing Guide — example command(s) showing the fix works.
• History Notes — leave the title to drive the history note, or add [Bastion] az <command>: <note> lines for extra notes.
• Keep the template checklist and tick the items you've satisfied.

---

Posted by agent-assist (autonomous bug-fix pipeline).

[yonzhan]

Thank you for opening this issue, we will look into it.