When deploying the sample app to Azure environment env-azure-prod, the Radius resource trading-mqtt fails consistently.

[djong1]

Absolutely. Here is a ready-to-submit GitHub issue draft you can paste into your repo issues.

Title
Challenge 05 Azure MQTT recipe fails with InvalidTemplate (empty subscription identifier) even when Azure scope and RBAC are correct

Body

Summary

When deploying the sample app to Azure environment env-azure-prod, the Radius resource trading-mqtt fails consistently.

The failure is inside the Azure Event Grid MQTT recipe and reports an empty subscription identifier, even though:

• environment Azure provider scope is set correctly
• Azure workload identity credential is registered in Radius
• Contributor role assignment exists on the target resource group
• Microsoft.EventGrid provider is registered

This blocks Challenge 05 portability validation for the Azure MQTT path.

Repository and docs context

• Guide used: Solution-05.md
• Environment definition: aks-env.bicep
• MQTT recipe source: azure-event-grid.bicep
• Registered recipe path at runtime:
  ghcr.io/microsoft/adaptive-apps/recipes/mqtt-azure-event-grid:latest

Environment

• Radius CLI: 0.58
• Azure subscription: ******
• Radius workspace: ws-azure-prod
• Radius environment: env-azure-prod
• Radius group: rg-trading
• Azure resource group: adaptive-apps-azure1
• Azure credential in Radius: WorkloadIdentity
• Event Grid resource provider: Registered

Repro steps

1. Ensure env-azure-prod exists and has Azure provider scope:
   /subscriptions/ ******/resourceGroups/adaptive-apps-azure1
2. Register Azure workload identity in Radius.
3. Grant Contributor on adaptive-apps-azure1 to the Radius service principal object ID.
4. Confirm recipe mapping for Radius.Resources/mqttBrokers points to:
   ghcr.io/microsoft/adaptive-apps/recipes/mqtt-azure-event-grid:latest
5. Deploy app:
   rad deploy app.bicep --group rg-trading --environment env-azure-prod ...
6. Check resource:
   rad resource show Radius.Resources/mqttBrokers trading-mqtt -a adaptive-apps -o json

Actual result

• trading-mqtt provisioningState is Failed
• Deployment error includes:

InvalidTemplate
Deployment template validation failed: The provided value '' is not valid subscription identifier.
Path: properties.template.outputs.result

No Event Grid namespace is created in the target resource group.

Expected result

• trading-mqtt should succeed
• recipe should create Event Grid namespace and return host, ports, auth metadata
• app deployment should not fail on mqttBrokers

Additional diagnostics already validated

• rad environment show env-azure-prod -o json includes correct providers.azure.scope
• rad credential show azure -o json shows WorkloadIdentity with expected clientId/tenantId
• az role assignment list confirms Contributor role at RG scope for Radius SP object ID
• az provider show -n Microsoft.EventGrid reports Registered
• PostgreSQL recipe in same deployment succeeds; failure is isolated to mqttBrokers recipe

Notes

• Radius recipe registration requires OCI references. Local file path registration is rejected as invalid repository/tag.
• This appears to be either:
  1. an issue in the published latest recipe artifact, or
  2. a context propagation issue where subscription is not populated for this recipe at runtime.

Requested help

Please confirm whether mqtt-azure-event-grid:latest is currently known-bad, and provide:

• a known-good recipe tag to pin to, or
• a fix in recipe/context handling so subscription is resolved correctly.

Haishi2016