Container App Update Fails from null secrets

[lastcoolnameleft]

Please provide us with the following information:

This issue is a: (mark with an x)

• [ X ] bug report -> please search issues before submitting
• documentation issue or request
• regression (a behavior that used to work and stopped in a new release)

Issue description

There appears to be an issue where a Container Registry secret was created from a previous Container App, but is null and it prevents other Container Apps from being modified.

Steps to reproduce

Create a Container App and specify registry credentials.
Create another container app and don't specify registry credentials.
Try to update the 2nd container app YAML and it fails with secrets being null.

az containerapp create \
  --name $ACA_WEB_NAME \
  --resource-group $RESOURCE_GROUP \
  --image $ACA_WEB_IMAGE \
  --environment $ACA_ENV_NAME \
  --target-port 3334 \
  --ingress 'external' \
  --registry-server $REGISTRY_SERVER \
  --registry-username $REGISTRY_USERNAME \
  --registry-password $REGISTRY_PASSWORD \
  --cpu 0.5 --memory 1.0Gi \
  --min-replicas 1 
             

➜  ACA_NAME=helloworld

➜  az containerapp create \
  --name $ACA_NAME \
  --resource-group $RESOURCE_GROUP \
  --environment $ACA_ENV_NAME \
  --image mcr.microsoft.com/azuredocs/containerapps-helloworld:latest \
  --target-port 80 \
  --ingress 'external' \
  --query properties.configuration.ingress.fqdn
Command group 'containerapp' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus
- Running ..
Container app created. Access your app at https://helloworld.livelycliff-917e6386.eastus.azurecontainerapps.io/

"helloworld.livelycliff-917e6386.eastus.azurecontainerapps.io"

➜  az containerapp show -n $ACA_WEB_NAME -g $RESOURCE_GROUP -o yaml > helloworld.yaml

WARNING: Command group 'containerapp' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus

## NOTE.  No changes to helloworld.yaml have been made.  But in the file, there is a refernce to a secret that I don't think should be there from a previous Container App.  
"spaghettidetective" is a Container App I created beforehand.

properties:
  configuration:
    registries:
    - passwordSecretRef: spaghettidetectiveazurecrio-spaghettidetective
      server: spaghettidetective.azurecr.io
      username: spaghettidetective
    secrets:
    - name: spaghettidetectiveazurecrio-spaghettidetective

➜  az containerapp update -n $ACA_WEB_NAME -g $RESOURCE_GROUP --yaml helloworld.yaml
Command group 'containerapp' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Invalid Request: Container app secret(s) with name(s) 'spaghettidetectiveazurecrio-spaghettidetective' cannot have a value of null.

Expected behavior

I expect to be able to update an un-modified configuration without error. Ultimately, I'd like to be able to modify the YAML to add a mount, but this prevents me from getting that far.

Actual behavior

Updating the Container App YAML fails, even if it's unmodified. I believe it's due to a Contaienr Registry secret from a previous Container App.

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context

Ex. Did this issue occur in the CLI or the Portal?

[lastcoolnameleft]

After playing with it some more, it appears that the same issue occurs when updating a Container App which uses a Private Registry

ACR_NAME=spaghettidetective
REGISTRY_SERVER=${ACR_NAME}.azurecr.io
REGISTRY_USERNAME=$(az acr credential show -n $ACR_NAME --query username -o tsv)
REGISTRY_PASSWORD=$(az acr credential show -n $ACR_NAME --query "passwords[0].value" -o tsv)
ACA_WEB_NAME=web
ACA_WEB_IMAGE=spaghettidetective.azurecr.io/obico-server-web:4

az containerapp create \
  --name $ACA_WEB_NAME \
  --resource-group $RESOURCE_GROUP \
  --image $ACA_WEB_IMAGE \
  --environment $ACA_ENV_NAME \
  --target-port 3334 \
  --ingress 'external' \
  --registry-server $REGISTRY_SERVER \
  --registry-username $REGISTRY_USERNAME \
  --registry-password $REGISTRY_PASSWORD \
  --cpu 0.5 --memory 1.0Gi \
  --min-replicas 1
az containerapp show -n $ACA_WEB_NAME -g $RESOURCE_GROUP -o yaml > web_app.yaml
# Don't change the yaml
az containerapp update -n $ACA_WEB_NAME -g $RESOURCE_GROUP --yaml web_app.yaml

Command group 'containerapp' is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Invalid Request: Container app secret(s) with name(s) 'spaghettidetectiveazurecrio-spaghettidetective' cannot have a value of null.

[dariagrigoriu]

This issue should be addressed by end of June.

[ghost]

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 4 days. It will be closed if no further activity occurs within 3 days of this comment.

[evklein]

Did this get closed out? I am getting this in the exact same circumstances.

[georgeOsdDev]

Same issue here.
az containerapp show not contains secret value but only secret name, so we could not reuse exported yaml if container app use secret for below scenario.

https://docs.microsoft.com/en-us/azure/container-apps/storage-mounts?pivots=aca-cli#azure-files

[georgeOsdDev]

REST API also does not contain secrets[].value
https://docs.microsoft.com/en-us/rest/api/containerapps/container-apps/get?tryIt=true&source=docs#secret

[StrawnSC]

Hey all, sorry about this. The problem here is that the update command uses a GET followed by a PUT to perform the update. Since the GET API doesn't return secrets, the update fails. We currently have a PR in review to change the CLI to use the PATCH API to perform updates with az containerapp update. This change should go out with the next version of the CLI extension

[torosent]

ref #299 (comment)

[ioaccept]

Hello I have the same problem. Does anyone have an idea for a workaround? When can I expect the next version?

[ranjeetkpGit]

Can not use Azure Container Registry with 'az containerapp update'
Hi ,

I am not able to use Azure Container Registry with 'az containerapp update' command in following way

• If Admin enabled in Azure Container Registry - Throws Unauthorized error

• If Admin not enabled in Azure Container Registry - Throws Unauthorized error

Is there any way to use Azure container Registry with 'az containerapp update' command?

[kendallroden]

Hi @ranjeetkpGit please create a new issue if you are experiencing this problem as it is unrelated to the initial report