Azure Machine Learning deployment fails with error <ValidationError: "{} is not of type 'string'">

[rahulhanumantchavan]

Azure Machine Learning deployment fails with error <ValidationError: "{} is not of type 'string'">

Initial Deployment error:
<ValidationError: "{} is not of type 'string'">

Error on Update:
f6f1fe59-c32e-4c2c-bb4c-0ec2989cd6f8: Error message: could not find installation /f6f1fe59-c32e-4c2c-bb4c-0ec2989cd6f8: Installation not found could not find installation /f6f1fe59-c32e-4c2c-bb4c-0ec2989cd6f8: Installation not found ; Command executed: porter upgrade f6f1fe59-c32e-4c2c-bb4c-0ec2989cd6f8 --reference acatre30acr.azurecr.io/tre-service-azureml:v1.1.2 --param address_space=10.1.11.0/24 --param arm_environment=public --param arm_use_msi=true --param description=Azure Machine Learning empowers data scientists and developers to build, deploy, and manage high-quality models faster and with confidence. --param display_name=Azure Machine Learning --param enable_cmk_encryption=false --param id=f6f1fe59-c32e-4c2c-bb4c-0ec2989cd6f8 --param is_exposed_externally=True --param key_store_id= --param tfstate_container_name=tfstate --param tfstate_resource_group_name=acatre30mgmt-rg --param tfstate_storage_account_name=acatre30storageaccount --param tre_id=acatre30 --param workspace_id=469efddd-3513-4517-847a-f0f28f7d4523 --force --credential-set arm_auth --credential-set aad_auth --force-upgrade

A clear and concise description of what the bug is.

Steps to reproduce

1. Create Azure Machine Learning deployment
2. Select Is exposed externally : false
3. Deploy Azure Machine Learning deployment

Azure TRE release version (e.g. v0.14.0 or main):
0.27.0

Deployed Azure TRE components - click the (i) in the UI:
Azure TRE
UI Version:
0.8.25
API Version:
0.25.13

[marrobi]

Hmm, I reckon it was tested with #4184 mrrged.

This should be fixed by #4814 which addressed type mismatches in property substitution. The is_exposed_externally boolean was being incorrectly converted during substitution, causing the {} is not of type 'string' error.

I dont believe #4814 was in the latest release, so you might need to pull it into your fork.

Can you give this a go?

[marrobi]

Hmm, that fix was in the release.

@JC-wk thoughts?

[marrobi]

Actually. As per the CHANGELOG, In v0.27.0, the AzureML workspace service now requires Entra ID workspace groups (#4687 — the legacy service-principal role assignment fallback was removed). Do you have AUTO_WORKSPACE_GROUP_CREATION set to true? If not, the workspace_owners_group_id and workspace_researchers_group_id properties won't be populated on the workspace, which could cause this failure when deploying the AzureML service.

[rahulhanumantchavan]

@marrobi auto_workspace_group_creation was set to false while creation. Is there a way to update it?

[marrobi]

Is it true in yhe config.yaml and has the automation admin got group create or similar permissions?

If so update the workspace with auto creare groups enabled.

[JC-wk]

If you see "could not find installation" like in your initial message you need to delete the resource and re-deploy in my experience.

[rahulhanumantchavan]

@marrobi I am still getting error "<ValidationError: "{} is not of type 'string'">"
Getting same error for update and create new workspace

authentication:
  # Setting AUTO_WORKSPACE_APP_REGISTRATION to false will:
  # create an identity with `Application.ReadWrite.OwnedBy`.
  # Setting AUTO_WORKSPACE_APP_REGISTRATION to true will:
  # create an identity with `Application.ReadWrite.All` and `Directory.Read.All`.
  # When this is true, create Workspaces will also create an AAD Application automatically.
  # When this is false, the AAD Application will need creating manually.
  auto_workspace_app_registration: true
  # Setting AUTO_WORKSPACE_GROUP_CREATION to true will create an identity with `Group.ReadWrite.All`
  auto_workspace_group_creation: true
  # Setting this to true will remove the need for users to manually grant consent when creating new workspaces.
  # The identity will be granted Application.ReadWrite.All and DelegatedPermissionGrant.ReadWrite.All permissions.
  auto_grant_workspace_consent: true

[marrobi]

Does a new workspace work?

[rahulhanumantchavan]

@marrobi No both old and new workspace did not work

[marrobi]

So when you deploy a fresh base workspace you get this error?

Deploy a fresh base workspace and what do you see in details for the group ids.

[rahulhanumantchavan]

@marrobi
Group ids are not generated for fresh base workspace.

Workspace Owner:

Workspace Researchers:

Airlock Manager:

Deployment Configurations:
"UPSTREAM_REPO": "microsoft/AzureTRE",
"UPSTREAM_REPO_VERSION": "v0.27.0",

config.yaml:

authentication:
aad_tenant_id: <aad_tenant_id>
auto_workspace_app_registration: true
auto_workspace_group_creation: true
auto_grant_workspace_consent: true

[marrobi]

Whats auto create groups set to on the details tab?

Also if check the API web app environment config have the settings propogated? Did you run make deploy-core to update the web app?

[rahulhanumantchavan]

@marrobi
auto create groups is not listed on the details tab.

On existing workspace I had run make deploy-core. Do you want me to run this on newly created workspace?