[App Service] Fix #21907: az webapp config container set: preserve Key Vault references#33071
Closed
[App Service] Fix #21907: az webapp config container set: preserve Key Vault references#33071
az webapp config container set: preserve Key Vault references#33071Conversation
…erve Key Vault references When running `az webapp config container set`, existing app settings containing Key Vault references (e.g., @Microsoft.KeyVault(...)) were being overwritten. This happened because: 1. ACR credential auto-detection replaced KV-ref credentials with raw values when a .azurecr.io URL was provided without explicit username/password. 2. The settings update used a read-modify-write cycle through update_app_settings that could interfere with non-container settings. This fix: - Adds _is_key_vault_reference() helper to detect KV reference values. - Skips ACR credential auto-detection when existing username/password settings are Key Vault references. - Merges only container-specific keys directly into the existing properties dict, preserving all other app settings as-is. - Adds unit tests verifying KV references survive container set operations. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
❌AzureCLI-FullTest
|
|
Hi @seligj95, |
️✔️AzureCLI-BreakingChangeTest
|
Collaborator
|
Thank you for your contribution! We will review the pull request and get back to you soon. |
|
The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR. Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions). pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>
|
microsoft-github-policy-service
bot
requested review from
jsntcy,
wangzelin007,
yonzhan and
zhoxing-ms
microsoft-github-policy-service
bot
added
Web Apps
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes az webapp config container set overwriting Key Vault reference app settings by changing how container-related app settings are detected and updated so KV-ref values are preserved.
Changes:
- Add
_is_key_vault_reference()helper and use it to skip ACR credential auto-detection when existing DOCKER credential settings are KV references. - Update
update_container_settingsto merge only container-related keys into existing app settings instead of using the prior update flow that could overwrite unrelated settings. - Add unit tests to ensure KV refs are preserved and ACR auto-detection is skipped when KV refs are present.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
src/azure-cli/azure/cli/command_modules/appservice/custom.py |
Updates container settings logic to preserve Key Vault reference values and avoid overwriting unrelated app settings. |
src/azure-cli/azure/cli/command_modules/appservice/tests/latest/test_webapp_commands_thru_mock.py |
Adds tests covering KV-ref preservation, ACR auto-detect skip behavior, and KV-ref detection helper. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+3611
to
+3614
| # Read existing app settings so we can preserve non-container settings and Key Vault references | ||
| existing_app_settings = _generic_site_operation(cmd.cli_ctx, resource_group_name, name, | ||
| 'list_application_settings', slot) | ||
| existing_properties = existing_app_settings.properties or {} |
There was a problem hiding this comment.
update_container_settings now calls list_application_settings unconditionally, even when no container app settings are being updated (e.g., only container_image_name/multicontainer/min/max are provided). This adds an extra network call on a hot command path; consider fetching existing app settings lazily only when needed (when container_updates will be applied and/or when ACR auto-detect needs to inspect existing DOCKER creds).
Comment on lines
+3613
to
+3614
| 'list_application_settings', slot) | ||
| existing_properties = existing_app_settings.properties or {} |
There was a problem hiding this comment.
existing_properties = existing_app_settings.properties or {} creates a fallback dict, but later updates write to existing_app_settings.properties[...]. If properties is None, this will still raise; assign the fallback back to the object (e.g., existing_app_settings.properties = existing_properties) before any reads/writes.
Suggested change
| 'list_application_settings', slot) | |
| existing_properties = existing_app_settings.properties or {} | |
| 'list_application_settings', slot) | |
| existing_properties = existing_app_settings.properties or {} | |
| if existing_app_settings.properties is None: | |
| existing_app_settings.properties = existing_properties |
Contributor
Author
|
Consolidated into #33064. The Key Vault reference fix has been cherry-picked and merged with the managed identity ACR pull changes, with conflicts resolved and all tests passing. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes #21907
When running
az webapp config container set, existing app settings containing Key Vault references (@Microsoft.KeyVault(...)) were being overwritten with raw values. This occurred because:.azurecr.ioURL was provided without explicit--docker-registry-server-user/--docker-registry-server-password.update_app_settingsthat could interfere with non-container settings.Changes
custom.py: Added_is_key_vault_reference()helper. Modifiedupdate_container_settingsto:DOCKER_REGISTRY_SERVER_USERNAMEorDOCKER_REGISTRY_SERVER_PASSWORDare Key Vault referencestest_webapp_commands_thru_mock.py: AddedTestUpdateContainerSettingsPreservesKeyVaultRefswith 3 tests:_is_key_vault_referencecorrectly identifies KV ref stringsTesting
azdev style appservice— PASSEDazdev linter appservice— pre-existingbatchmodule errors only; no appservice issuestest_webapp_commands_thru_mock.pypass