microsoft / microsoft/aspire

Docker Compose deployment silently materializes blank env values for Azure resource outputs used by existing Key Vault references

Open
#17,205 2 comments 0 reactions 0 assignees View on GitHub
area-deployment silent-failure triage:bot-seen
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 15h
Merged PRs (30d)
196

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

When deploying an Aspire app to Docker Compose, a referenced existing Azure Key Vault resource produces unresolved/blank environment values in the generated deployment artifacts.

In my case:

- AppHost uses `AddAzureKeyVault("key-vault")`
- the vault is configured with `RunAsExisting(...)` and `PublishAsExisting(...)`
- app resources use `.WithReference(keyVaultResource)`
- Docker Compose output contains:

```yaml
ConnectionStrings__key-vault: "${KEY_VAULT_OUTPUTS_VAULTURI}"
KEY_VAULT_URI: "${KEY_VAULT_OUTPUTS_VAULTURI}"
```

But the prepared environment file deployed to the host contains:

KEY_VAULT_OUTPUTS_VAULTURI=

The deployment succeeds without warning, so the containers start without the Key Vault URI.

### Expected Behavior

Docker Compose deployment resolves the Key Vault URI output before writing the prepared env file, or Aspire fails/warns clearly that this output cannot be materialized for the Docker Compose target and should be supplied explicitly.

### Steps To Reproduce

I have prepared a repro https://github.com/tjackadams/aspire-keyvault-compose-repro

### Exceptions (if any)

_No response_

### Aspire doctor output

```
❯ aspire doctor

Aspire Environment Check
========================

.NET SDK
✅ .NET 10.0.300 installed (x64)

Container Runtime
✅ Docker v29.1.3: running (auto-detected (default)) ← active

Environment
✅ HTTPS development certificate is trusted
⚠️ HTTPS development certificate has an older version (v5, v4)
Run 'aspire certs clean' to remove all certificates, then run 'aspire certs trust' to create and trust a new one.
See: https://aka.ms/aspire-prerequisites#dev-certs
Details:
Older certificate versions (< v4) may not support all certificate trust scenarios.

Summary: 3 passed, 1 warnings, 0 failed
For detailed prerequisites: https://aka.ms/aspire-prerequisites
```

### Anything else?

discovered while trying to deploy a container that references an existing key vault resource.
https://github.com/davidfowl/aspire-ssh-deploy

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.