Port 47010 is already in use when running az connectedk8s proxy in Azure DevOps Pipeline, causing cascading failures in subsequent deployment steps

Hello 승록 이, As per your query you are facing issue during deployment, the step using az connectedk8s proxyfails with a port conflict error: ERROR: Port <port> is already in use

This causes the proxy to terminate, leading to empty kubeconfig, and subsequent failures in kubectl / helm.

The failure occurs because the az connectedk8s proxy command is being invoked multiple times within the same pipeline job, causing port collisions.

• Azure CLI proxy fails if another instance is already running or if the port is already in use
• The command supports a default listening port (commonly ~47011) and can be overridden via --port

In your pipeline:

• Proxy is started in background (&)
• Previous instance is not terminated
• Second invocation > port already in use > failure

Your analysis is correct on all points, and I can confirm the specifics:

• az connectedk8s proxy uses 47011 as the listen port and 47010 as an internal port (hardcoded defaults). A second proxy in the same job collides on these — that's your error.
• Microsoft-hosted agents get a fresh isolated VM per job, so cross-pipeline contention is impossible. The conflict is intra-job — the proxy is started more than once in one job (very likely because your job loops over multiple apps/namespaces like BIZ/COP and includes arc-proxy.yml per iteration), or a prior proxy in the job didn't exit first.
• The cascade (current-context is not set → helm flags cannot be placed before plugin name) is all secondary to the dead proxy + missing liveness check.

Recommended fix = both of your options plus a liveness gate:

1. Start one proxy per job (outside the per-app loop) and kill it in a condition: always() teardown step so nothing is orphaned on retries.
2. Add a liveness gate: after launching the proxy with &, loop kubectl get ns (with the proxy's --file kubeconfig) until it succeeds, and kill -0 $PID to fail fast if it died. This turns the silent cascade into an immediate, clear failure.
3. Only if you truly need concurrent proxies in one job, give each a unique --port and its own --file kubeconfig (space the ports out; don't reuse 47010).
4. Helm hygiene: helm list --kube-context "$CTX" (flag after subcommand) and guard : "${KUBE_CONTEXT:?not set}".

Also: upgrade the connectedk8s extension on the agent (az extension add --upgrade -n connectedk8s). The cleanest design for multi-app deploys is one proxy → loop deployments against that single kubeconfig via --kube-context, which sidesteps the port issue entirely.

Refs:

az connectedk8s proxy https://learn.microsoft.com/cli/azure/connectedk8s#az-connectedk8s-proxy

port 47011 shown at https://learn.microsoft.com/azure/aks/aksarc/aks-create-clusters-cli#connect-to-the-kubernetes-cluster

Hope this helps! thank you

hi 승록 이 & thx for sharing urs issue here at Q&A portal,

Yep, ur analysis is right. The first real failure is the az connectedk8s proxy port conflict. The kubeconfig/context/helm errors after that are just fallout bc the proxy never started.

On Microsoft-hosted agents, a conflict from another customer pipeline is unlikely. More likely the same job starts the Arc proxy more than once, or a previous background proxy process in the same job didn’t get killed.

Best fix: start one proxy per job, store its PID, wait until it’s actually listening, and always clean it up at the end.

az connectedk8s proxy \

--name <cluster-name> \

--resource-group <rg> \

--port 47011 &

PROXY_PID=$!

for i in {1..30}; do

if nc -z 127.0.0.1 47011; then

echo 'Arc proxy is ready'

break

fi

sleep 2

done

if ! kill -0 $PROXY_PID 2>/dev/null; then

echo 'Arc proxy failed to start'

exit 1

fi

Then cleanup in a final step with condition: always():

pkill -f 'az connectedk8s proxy' || true

If u really need multiple proxies in the same job, give each one a different --port. But simpler is better here: one proxy per job, reuse the kubeconfig/context for all kubectl/helm calls.

MS docs

https://learn.microsoft.com/en-us/cli/azure/connectedk8s?view=azure-cli-latest#az-connectedk8s-proxy

https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/cluster-connect

Also add a hard guard if kubeconfig has no current-context, stop immediately. Don’t let helm fail 6 steps later like a murder mystery.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/