How To Fix Azure AZ CLI Service Connection to KeyVault Fails with Image Not Found

Select Language:

If you’re facing issues with running the command az aks connection create keyvault --connection ..., here’s a simple solution that has worked for many users.

First, I tested the command myself using the default resources, which included Kubernetes version 1.32.6 and extensions version 0.20250815.1. It worked without any problems on my end. Based on this, I believe the issue you’re experiencing might be due to using an older extension version, specifically 0.20250417.1.

To resolve the problem, you’ll need to update the extension in your environment. Here’s how you can do that step by step:

Find the exact name of the extension installed on your cluster. You can do this by running the following command:

bash
az k8s-extension list –cluster-name –resource-group –cluster-type managedClusters

Look through the output for the extension with "extensionType": "microsoft.servicelinker.connection". The name associated with it is what you’ll need for the update.
Once you know the extension name, update it by running this command:

bash
az k8s-extension update \
–name \
–cluster-name \
–resource-group \
–cluster-type managedClusters

Replace <extension_name>, <your_cluster_name>, and <your_rg_name> with your specific details.
After the update completes, check the status of your pods using:

bash
kubectl describe pod

This will help you verify if the pods are still showing image errors after the extension update.

Following these steps should help you fix the issue by ensuring your environment has the latest extension version. If problems continue after updating, double-check the pod details and logs to further troubleshoot.