unable to create services

[prod-o]

Environment: OpenShift 3.11

Trying to create a DB from the osba, we are getting the following error:
time="2019-04-12T09:52:27Z" level=error msg="error executing job; not submitting any follow-up tasks" error="error executing provisioning step "preProvision" for instance "xxxxxxxxxxxxxxxxxxxxxx": error executing provisioning step: error determining server name availability: azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to https://management.azure.com/subscriptions/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/providers/Microsoft.DBforMySQL/checkNameAvailability?api-version=2017-12-01: StatusCode=0 -- Original Error: adal: Failed to execute the refresh request. Error = 'Post https://login.microsoftonline.com/xxxxxxxxxxxxxxxx/oauth2/token?api-version=1.0: dial tcp: lookup login.microsoftonline.com on 10.44.9.16:53: no such host'" job=executeProvisioningStep taskID=xxxxxxxxxxxxxxxxxxx

The VMs have internal, non public, IPs.
Opening Ports and configuring externad DNS, it's possible to create the service and the binding.

Is it really needed internet access to create services and bindings using osba? Or is there any configuration to not require that connectivity?

[cforce]

You can use service endpoint which must be configured on provisionning as virtualNetworkRules

./svcat provision $(microservice.name).$(namespace.name).db --class $(postgresql.class) --plan $(postgresql.plan) -n$(namespace.name) --params-json '{"cores":1,"storage":10,"backupRetention":7,"tags":{"microservice":"$(microservice.name)","environment":"$(namespace.name)"},"location": "$(azure.location)","resourceGroup": "$(azure.ressourcegroup)","extensions": ["uuid-ossp","postgis"],"virtualNetworkRules": [{"name": "$(azure.ressourcegroup)","subnetId": "/subscriptions/$(azure.subscription.id)/resourceGroups/$(azure.ressourcegroup)/providers/Microsoft.Network/virtualNetworks/$(azure.ressourcegroup.vnet)"}]}'

[zhongyi-zhang]

The error showed indicates the first step to touch Azure -- getting ARM REST API token with your Service Principal. Can have a check on the network health inside the pod? Is it able to ping login.microsoftonline.com?

[prod-o]

The error showed indicates the first step to touch Azure -- getting ARM REST API token with your Service Principal. Can have a check on the network health inside the pod? Is it able to ping login.microsoftonline.com?

It is not possible to ping login.microsoftonline.com or management.azure.com by default, from the pod, but also from the OpenShift node.
The IP is non public. We need to configure an external DNS (e.g. 8.8.8.8) in dnsmasq to be able to create the services.

Is there any other way to be able to create the services, without internet access?